From 262b7c2c5dae467759f8e693b8caac27437471c6 Mon Sep 17 00:00:00 2001
From: Paolo Capriotti <paolo@capriotti.io>
Date: Mon, 13 Dec 2021 11:57:38 +0100
Subject: [PATCH 01/74] Do not purge bucket in fake-s3 (#1981)

* Do not purge bucket in fake-s3

With `purge: true` the reaper script will delete the bucket's content
when it runs, causing integration tests to fail occasionally.

This fixes a very frequent flake in CI integration tests (e.g.
https://bridge-ie-concourse.zinfra.io/builds/21651258).
---
 changelog.d/5-internal/fix-cargohold-flake | 1 +
 charts/fake-aws-s3/values.yaml             | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)
 create mode 100644 changelog.d/5-internal/fix-cargohold-flake

diff --git a/changelog.d/5-internal/fix-cargohold-flake b/changelog.d/5-internal/fix-cargohold-flake
new file mode 100644
index 00000000000..3281ab93589
--- /dev/null
+++ b/changelog.d/5-internal/fix-cargohold-flake
@@ -0,0 +1 @@
+Set `purge: false` in fake-s3 chart
diff --git a/charts/fake-aws-s3/values.yaml b/charts/fake-aws-s3/values.yaml
index 3c7ffd4774d..a736eb82cb0 100644
--- a/charts/fake-aws-s3/values.yaml
+++ b/charts/fake-aws-s3/values.yaml
@@ -21,7 +21,7 @@ minio:
       memory: 200Mi
   buckets:
     - name: dummy-bucket
-      purge: true
+      purge: false
       policy: none
     - name: assets
       purge: false

From fb912aeec18e2890e3d2c4a04f9d5c634cabfe85 Mon Sep 17 00:00:00 2001
From: Paolo Capriotti <paolo@capriotti.io>
Date: Mon, 13 Dec 2021 18:03:19 +0100
Subject: [PATCH 02/74] Fix `make c test=1` (#1987)

---
 changelog.d/5-internal/cabal-make-c-test-all |  1 +
 hack/bin/cabal-run-tests.sh                  | 22 ++++++++++++--------
 2 files changed, 14 insertions(+), 9 deletions(-)
 create mode 100644 changelog.d/5-internal/cabal-make-c-test-all

diff --git a/changelog.d/5-internal/cabal-make-c-test-all b/changelog.d/5-internal/cabal-make-c-test-all
new file mode 100644
index 00000000000..305c0c8d6ce
--- /dev/null
+++ b/changelog.d/5-internal/cabal-make-c-test-all
@@ -0,0 +1 @@
+Fix test runner for global cabal make target
diff --git a/hack/bin/cabal-run-tests.sh b/hack/bin/cabal-run-tests.sh
index a9b17b4c462..46a9099ecad 100755
--- a/hack/bin/cabal-run-tests.sh
+++ b/hack/bin/cabal-run-tests.sh
@@ -4,15 +4,19 @@ set -euo pipefail
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 TOP_LEVEL="$(cd "$DIR/../.." && pwd)"
 
-pkgName=${1:-Please specify package name}
+package=${1:-all}
 
-# This is required because some tests (e.g. golden tests) depend on the path
-# where they are run from.
-pkgDir=$(find "$TOP_LEVEL" -name "$pkgName.cabal" | grep -v dist-newstyle | head -1 | xargs -n 1 dirname)
-cd "$pkgDir"
-
-test_suites=$(cabal-plan list-bins "$pkgName"':test:*' | awk '{print $2}')
-
-for test_suite in $test_suites; do
+if [[ "$package" == all ]]; then
+  pattern='*.cabal'
+else
+  pattern="$package.cabal"
+fi
+for cabal in $(find "$TOP_LEVEL" -name "$pattern" | grep -v dist-newstyle); do
+  # This is required because some tests (e.g. golden tests) must be run from
+  # the package root.
+  cd "$(dirname $cabal)"
+  package="$(basename ${cabal%.*})"
+  for test_suite in $(cabal-plan list-bins "$package:test:*" | awk '{print $2}'); do
     $test_suite "${@:2}"
+  done
 done

From 4c04c3f0486e8a3d20edf3764e93fa6055cb66fd Mon Sep 17 00:00:00 2001
From: Julia Longtin <julia.longtin@wire.com>
Date: Tue, 14 Dec 2021 13:27:50 +0100
Subject: [PATCH 03/74]  Tag/add integration tests for certification (#1869)

* add first mapping

* further discovered tests.

* ormolu

* changelog entry

* fixup; add two tests

* Add another test

* fixup

* comments

* Add annotation for access token tests

* Add subsystem tags in ZAuth.hs

* Add subsystem tags

* add testmapping to test from documentation

* Update services/brig/test/integration/API/User/Auth.hs

* Update services/brig/test/integration/API/User/Auth.hs

* Update services/brig/test/integration/API/User/Auth.hs

* Update services/brig/test/integration/API/User/Client.hs

* Update services/brig/test/integration/API/User/Client.hs

* Update services/brig/test/integration/API/User/Handles.hs

* Update services/brig/test/integration/API/User/Auth.hs

* Update services/brig/test/integration/API/User/Client.hs

* Update services/brig/test/integration/API/User/Client.hs

* Update services/spar/test-integration/Test/Spar/Scim/AuthSpec.hs

* Update services/spar/test-integration/Test/Spar/Scim/UserSpec.hs

* hi ci

Co-authored-by: jschaul <jschaul@users.noreply.github.com>
Co-authored-by: VictorWissink <victor-wissink@hotmail.com>
Co-authored-by: fisx <mf@zerobuzz.net>
Co-authored-by: Leif Battermann <leif.battermann@wire.com>
---
 changelog.d/4-docs/pr-1869                    |  1 +
 libs/zauth/test/ZAuth.hs                      |  4 ++
 .../brig/test/integration/API/User/Account.hs | 65 ++++++++++++++++++-
 .../brig/test/integration/API/User/Auth.hs    | 12 ++++
 .../brig/test/integration/API/User/Client.hs  |  8 +++
 .../brig/test/integration/API/User/Handles.hs |  4 ++
 services/brig/test/integration/Util.hs        |  9 +++
 .../Test/Spar/Scim/AuthSpec.hs                |  3 +-
 .../Test/Spar/Scim/UserSpec.hs                |  5 +-
 9 files changed, 108 insertions(+), 3 deletions(-)
 create mode 100644 changelog.d/4-docs/pr-1869

diff --git a/changelog.d/4-docs/pr-1869 b/changelog.d/4-docs/pr-1869
new file mode 100644
index 00000000000..5b3e780a9e3
--- /dev/null
+++ b/changelog.d/4-docs/pr-1869
@@ -0,0 +1 @@
+Annotate a first batch of integration and unit tests to map them to externally-facing documentation
diff --git a/libs/zauth/test/ZAuth.hs b/libs/zauth/test/ZAuth.hs
index 43e27cac49f..67729073b45 100644
--- a/libs/zauth/test/ZAuth.hs
+++ b/libs/zauth/test/ZAuth.hs
@@ -93,6 +93,10 @@ testNotExpired p = do
   x <- liftIO $ runValidate p $ check t
   liftIO $ assertBool "testNotExpired: validation failed" (isRight x)
 
+-- The testExpired test conforms to the following testing standards:
+-- @SF.Channel @TSFI.RESTfulAPI @S2 @S3
+--
+-- Using an expired access token should fail
 testExpired :: V.Env -> Create ()
 testExpired p = do
   u <- liftIO nextRandom
diff --git a/services/brig/test/integration/API/User/Account.hs b/services/brig/test/integration/API/User/Account.hs
index f723e318aa0..f09af13c4a9 100644
--- a/services/brig/test/integration/API/User/Account.hs
+++ b/services/brig/test/integration/API/User/Account.hs
@@ -90,9 +90,12 @@ tests _ at opts p b c ch g aws =
   testGroup
     "account"
     [ test' aws p "post /register - 201 (with preverified)" $ testCreateUserWithPreverified opts b aws,
+      test' aws p "post /register - 400 (with preverified)" $ testCreateUserWithInvalidVerificationCode b,
       test' aws p "post /register - 201" $ testCreateUser b g,
       test' aws p "post /register - 201 + no email" $ testCreateUserNoEmailNoPassword b,
       test' aws p "post /register - 201 anonymous" $ testCreateUserAnon b g,
+      test' aws p "post /register - 400 empty name" $ testCreateUserEmptyName b,
+      test' aws p "post /register - 400 name too long" $ testCreateUserLongName b,
       test' aws p "post /register - 201 anonymous expiry" $ testCreateUserAnonExpiry b,
       test' aws p "post /register - 201 pending" $ testCreateUserPending opts b,
       test' aws p "post /register - 201 existing activation" $ testCreateAccountPendingActivationKey opts b,
@@ -148,6 +151,32 @@ tests _ at opts p b c ch g aws =
         ]
     ]
 
+-- The testCreateUserWithInvalidVerificationCode test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
+--
+-- Registering with an invalid verification code and valid account details should fail.
+testCreateUserWithInvalidVerificationCode :: Brig -> Http ()
+testCreateUserWithInvalidVerificationCode brig = do
+  -- Attempt to register (pre verified) user with phone
+  p <- randomPhone
+  code <- randomActivationCode -- incorrect but syntactically valid activation code
+  let Object regPhone =
+        object
+          [ "name" .= Name "Alice",
+            "phone" .= fromPhone p,
+            "phone_code" .= code
+          ]
+  postUserRegister' regPhone brig !!! const 404 === statusCode
+  -- Attempt to register (pre verified) user with email
+  e <- randomEmail
+  let Object regEmail =
+        object
+          [ "name" .= Name "Alice",
+            "email" .= fromEmail e,
+            "email_code" .= code
+          ]
+  postUserRegister' regEmail brig !!! const 404 === statusCode
+
 testUpdateUserEmailByTeamOwner :: Brig -> Http ()
 testUpdateUserEmailByTeamOwner brig = do
   (_, teamOwner, emailOwner : otherTeamMember : _) <- createPopulatedBindingTeamWithNamesAndHandles brig 2
@@ -263,6 +292,33 @@ testCreateUser brig galley = do
       b <- responseBody r
       b ^? key "conversations" . nth 0 . key "type" >>= maybeFromJSON
 
+-- The testCreateUserEmptyName test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
+--
+-- An empty name is not allowed on registration
+testCreateUserEmptyName :: Brig -> Http ()
+testCreateUserEmptyName brig = do
+  let p =
+        RequestBodyLBS . encode $
+          object
+            ["name" .= ("" :: Text)]
+  post (brig . path "/register" . contentJson . body p)
+    !!! const 400 === statusCode
+
+-- The testCreateUserLongName test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
+--
+-- a name with > 128 characters is not allowed.
+testCreateUserLongName :: Brig -> Http ()
+testCreateUserLongName brig = do
+  let nameTooLong = cs $ concat $ replicate 129 "a"
+  let p =
+        RequestBodyLBS . encode $
+          object
+            ["name" .= (nameTooLong :: Text)]
+  post (brig . path "/register" . contentJson . body p)
+    !!! const 400 === statusCode
+
 testCreateUserAnon :: Brig -> Galley -> Http ()
 testCreateUserAnon brig galley = do
   let p =
@@ -348,7 +404,10 @@ testCreateUserNoEmailNoPassword brig = do
     getPhoneLoginCode brig p
   initiateEmailUpdateLogin brig e (SmsLogin p code Nothing) uid !!! (const 202 === statusCode)
 
--- | email address must not be taken on @/register@.
+-- The testCreateUserConflict test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
+--
+-- email address must not be taken on @/register@.
 testCreateUserConflict :: Opt.Opts -> Brig -> Http ()
 testCreateUserConflict (Opt.setRestrictUserCreation . Opt.optSettings -> Just True) _ = pure ()
 testCreateUserConflict _ brig = do
@@ -378,6 +437,10 @@ testCreateUserConflict _ brig = do
     const 409 === statusCode
     const (Just "key-exists") === fmap Error.label . responseJsonMaybe
 
+-- The testCreateUserInvalidEmailOrPhone test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
+--
+-- Test to make sure a new user cannot be created with an invalid email address or invalid phone number.
 testCreateUserInvalidEmailOrPhone :: Opt.Opts -> Brig -> Http ()
 testCreateUserInvalidEmailOrPhone (Opt.setRestrictUserCreation . Opt.optSettings -> Just True) _ = pure ()
 testCreateUserInvalidEmailOrPhone _ brig = do
diff --git a/services/brig/test/integration/API/User/Auth.hs b/services/brig/test/integration/API/User/Auth.hs
index 37e803e54bd..c13b3b77315 100644
--- a/services/brig/test/integration/API/User/Auth.hs
+++ b/services/brig/test/integration/API/User/Auth.hs
@@ -361,6 +361,10 @@ testSendLoginCode brig = do
   let _timeout = fromLoginCodeTimeout <$> responseJsonMaybe rsp2
   liftIO $ assertEqual "timeout" (Just (Code.Timeout 600)) _timeout
 
+-- The testLoginFailure test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
+--
+-- Test that trying to log in with a wrong password or non-existent email fails.
 testLoginFailure :: Brig -> Http ()
 testLoginFailure brig = do
   Just email <- userEmail <$> randomUser brig
@@ -395,6 +399,8 @@ testThrottleLogins conf b = do
     threadDelay (1000000 * (n + 1))
   login b (defEmailLogin e) SessionCookie !!! const 200 === statusCode
 
+-- The testLimitRetries test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
 testLimitRetries :: HasCallStack => Opts.Opts -> Brig -> Http ()
 testLimitRetries conf brig = do
   let Just opts = Opts.setLimitFailedLogins . Opts.optSettings $ conf
@@ -566,6 +572,10 @@ testNoUserSsoLogin brig = do
 -------------------------------------------------------------------------------
 -- Token Refresh
 
+-- The testInvalidCookie test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
+--
+-- Test that invalid and expired tokens do not work.
 testInvalidCookie :: forall u. ZAuth.UserTokenLike u => ZAuth.Env -> Brig -> Http ()
 testInvalidCookie z b = do
   -- Syntactically invalid
@@ -898,6 +908,8 @@ testRemoveCookiesByLabelAndId b = do
   let lbl = cookieLabel c4
   listCookies b (userId u) >>= liftIO . ([lbl] @=?) . map cookieLabel
 
+-- The testTooManyCookies test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
 testTooManyCookies :: Opts.Opts -> Brig -> Http ()
 testTooManyCookies config b = do
   u <- randomUser b
diff --git a/services/brig/test/integration/API/User/Client.hs b/services/brig/test/integration/API/User/Client.hs
index f086ebbdafd..d538c3208b9 100644
--- a/services/brig/test/integration/API/User/Client.hs
+++ b/services/brig/test/integration/API/User/Client.hs
@@ -416,6 +416,8 @@ testMultiUserGetPrekeysQualified brig opts = do
       const 200 === statusCode
       const (Right $ expectedUserClientMap) === responseJsonEither
 
+-- The testTooManyClients test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
 testTooManyClients :: Opt.Opts -> Brig -> Http ()
 testTooManyClients opts brig = do
   uid <- userId <$> randomUser brig
@@ -436,6 +438,8 @@ testTooManyClients opts brig = do
       const (Just "too-many-clients") === fmap Error.label . responseJsonMaybe
       const (Just "application/json;charset=utf-8") === getHeader "Content-Type"
 
+-- The testRemoveClient test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
 testRemoveClient :: Bool -> Brig -> Cannon -> Http ()
 testRemoveClient hasPwd brig cannon = do
   u <- randomUser' hasPwd brig
@@ -475,6 +479,8 @@ testRemoveClient hasPwd brig cannon = do
           newClientCookie = Just defCookieLabel
         }
 
+-- The testRemoveClientShortPwd test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
 testRemoveClientShortPwd :: Brig -> Http ()
 testRemoveClientShortPwd brig = do
   u <- randomUser brig
@@ -661,6 +667,8 @@ testMissingClient brig = do
     const ["text/plain;charset=utf-8"]
       === map snd . filter ((== "Content-Type") . fst) . responseHeaders
 
+-- The testAddMultipleTemporary test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
 -- Legacy (galley)
 testAddMultipleTemporary :: Brig -> Galley -> Http ()
 testAddMultipleTemporary brig galley = do
diff --git a/services/brig/test/integration/API/User/Handles.hs b/services/brig/test/integration/API/User/Handles.hs
index 356e70e5bd0..a1e4cba18d4 100644
--- a/services/brig/test/integration/API/User/Handles.hs
+++ b/services/brig/test/integration/API/User/Handles.hs
@@ -66,6 +66,10 @@ tests _cl _at conf p b c g =
       test p "GET /users/by-handle/<domain>/<handle> : no federation" $ testGetUserByQualifiedHandleNoFederation conf b
     ]
 
+-- The next line contains a mapping from the testHandleUpdate test to the following test standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
+--
+-- Test changes to the user's handle.
 testHandleUpdate :: Brig -> Cannon -> Http ()
 testHandleUpdate brig cannon = do
   user <- randomUser brig
diff --git a/services/brig/test/integration/Util.hs b/services/brig/test/integration/Util.hs
index 2b9879c7d91..79eb10e70de 100644
--- a/services/brig/test/integration/Util.hs
+++ b/services/brig/test/integration/Util.hs
@@ -60,6 +60,7 @@ import Data.Misc (PlainTextPassword (..))
 import Data.Proxy
 import Data.Qualified
 import Data.Range
+import qualified Data.Text as T
 import qualified Data.Text as Text
 import qualified Data.Text.Ascii as Ascii
 import Data.Text.Encoding (encodeUtf8)
@@ -76,6 +77,7 @@ import qualified Network.Wai as Wai
 import qualified Network.Wai.Handler.Warp as Warp
 import Network.Wai.Test (Session)
 import qualified Network.Wai.Test as WaiTest
+import OpenSSL.BN (randIntegerZeroToNMinusOne)
 import Servant.Client.Generic (AsClientT)
 import System.Random (randomIO, randomRIO)
 import qualified System.Timeout as System
@@ -83,6 +85,7 @@ import Test.Tasty (TestName, TestTree)
 import Test.Tasty.Cannon
 import qualified Test.Tasty.Cannon as WS
 import Test.Tasty.HUnit
+import Text.Printf (printf)
 import qualified UnliftIO.Async as Async
 import Util.AWS
 import Util.Options (Endpoint (Endpoint))
@@ -740,6 +743,12 @@ randomPhone = liftIO $ do
   let phone = parsePhone . Text.pack $ "+0" ++ concat nrs
   return $ fromMaybe (error "Invalid random phone#") phone
 
+randomActivationCode :: (HasCallStack, MonadIO m) => m ActivationCode
+randomActivationCode =
+  liftIO $
+    ActivationCode . Ascii.unsafeFromText . T.pack . printf "%06d"
+      <$> randIntegerZeroToNMinusOne 1000000
+
 updatePhone :: HasCallStack => Brig -> UserId -> Phone -> Http ()
 updatePhone brig uid phn = do
   -- update phone
diff --git a/services/spar/test-integration/Test/Spar/Scim/AuthSpec.hs b/services/spar/test-integration/Test/Spar/Scim/AuthSpec.hs
index 20c3bdc071c..6ac1b2bbf30 100644
--- a/services/spar/test-integration/Test/Spar/Scim/AuthSpec.hs
+++ b/services/spar/test-integration/Test/Spar/Scim/AuthSpec.hs
@@ -147,7 +147,8 @@ testNumIdPs = do
   createToken_ owner (CreateScimToken "drei" (Just defPassword)) (env ^. teSpar)
     !!! checkErr 400 (Just "more-than-one-idp")
 
--- | Test that a token can only be created as a team owner
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
+-- Test that a token can only be created as a team owner
 testCreateTokenAuthorizesOnlyAdmins :: TestSpar ()
 testCreateTokenAuthorizesOnlyAdmins = do
   env <- ask
diff --git a/services/spar/test-integration/Test/Spar/Scim/UserSpec.hs b/services/spar/test-integration/Test/Spar/Scim/UserSpec.hs
index a73b15ed147..e04cf943236 100644
--- a/services/spar/test-integration/Test/Spar/Scim/UserSpec.hs
+++ b/services/spar/test-integration/Test/Spar/Scim/UserSpec.hs
@@ -466,7 +466,10 @@ testExternalIdIsRequired = do
   createUser_ (Just tok) user' (env ^. teSpar)
     !!! const 400 === statusCode
 
--- | Test that user creation fails if handle is invalid
+-- The next line contains a mapping from this test to the following test standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
+--
+-- Test that user creation fails if handle is invalid
 testCreateRejectsInvalidHandle :: TestSpar ()
 testCreateRejectsInvalidHandle = do
   env <- ask

From 5ace5956b1482a428b3e7833191f15612156176d Mon Sep 17 00:00:00 2001
From: Leif Battermann <leif.battermann@gmail.com>
Date: Tue, 14 Dec 2021 13:28:28 +0100
Subject: [PATCH 04/74] Tag/add integration tests (Missing Clients) (BSI Docs)
 (#1985)

* added stand alone test for checking that sending messages with missing clients should fail

* naming

Co-authored-by: fisx <mf@zerobuzz.net>

* naming

Co-authored-by: fisx <mf@zerobuzz.net>

* description and more tags

* changelog

* wip

* test for point 1.

Co-authored-by: fisx <mf@zerobuzz.net>
---
 changelog.d/5-internal/sqservices-1118  |  1 +
 services/galley/test/integration/API.hs | 66 ++++++++++++++++++++++++-
 2 files changed, 65 insertions(+), 2 deletions(-)
 create mode 100644 changelog.d/5-internal/sqservices-1118

diff --git a/changelog.d/5-internal/sqservices-1118 b/changelog.d/5-internal/sqservices-1118
new file mode 100644
index 00000000000..0d240283035
--- /dev/null
+++ b/changelog.d/5-internal/sqservices-1118
@@ -0,0 +1 @@
+Tag integration tests for certification.
diff --git a/services/galley/test/integration/API.hs b/services/galley/test/integration/API.hs
index d394a30c025..801d020109d 100644
--- a/services/galley/test/integration/API.hs
+++ b/services/galley/test/integration/API.hs
@@ -220,7 +220,9 @@ tests s =
           test s "cannot join private conversation" postJoinConvFail,
           test s "remove user with only local convs" removeUserNoFederation,
           test s "remove user with local and remote convs" removeUser,
-          test s "iUpsertOne2OneConversation" testAllOne2OneConversationRequests
+          test s "iUpsertOne2OneConversation" testAllOne2OneConversationRequests,
+          test s "post message - reject if missing client" postMessageRejectIfMissingClients,
+          test s "post message - client that is not in group doesn't receive message" postMessageClientNotInGroupDoesNotReceiveMsg
         ]
 
 emptyFederatedBrig :: F.BrigApi (AsServerT Handler)
@@ -366,6 +368,7 @@ postConvWithRemoteUsersOk = do
 
 -- | This test verifies whether a message actually gets sent all the way to
 -- cannon.
+-- @SF.Separation @TSFI.RESTfulAPI @S2
 postCryptoMessage1 :: TestM ()
 postCryptoMessage1 = do
   localDomain <- viewFederationDomain
@@ -450,6 +453,7 @@ postCryptoMessage1 = do
       assertNoMsg wsB2 (wsAssertOtr qconv qalice ac bc cipher)
 
 -- | This test verifies basic mismatch behaviour of the the JSON endpoint.
+-- @SF.Separation @TSFI.RESTfulAPI @S2
 postCryptoMessage2 :: TestM ()
 postCryptoMessage2 = do
   b <- view tsBrig
@@ -475,6 +479,7 @@ postCryptoMessage2 = do
     Map.keys <$> Map.lookup eve (userClientMap (getUserClientPrekeyMap p)) @=? Just [ec]
 
 -- | This test verifies basic mismatch behaviour of the protobuf endpoint.
+-- @SF.Separation @TSFI.RESTfulAPI @S2
 postCryptoMessage3 :: TestM ()
 postCryptoMessage3 = do
   b <- view tsBrig
@@ -501,7 +506,7 @@ postCryptoMessage3 = do
     Map.keys (userClientMap (getUserClientPrekeyMap p)) @=? [eve]
     Map.keys <$> Map.lookup eve (userClientMap (getUserClientPrekeyMap p)) @=? Just [ec]
 
--- | This test verfies behaviour when an unknown client posts the message. Only
+-- | This test verifies behaviour when an unknown client posts the message. Only
 -- tests the Protobuf endpoint.
 postCryptoMessage4 :: TestM ()
 postCryptoMessage4 = do
@@ -516,8 +521,63 @@ postCryptoMessage4 = do
   postProtoOtrMessage alice (ClientId "172618352518396") conv m
     !!! const 403 === statusCode
 
+-- | This test verifies the following scenario.
+-- A client sends a message to all clients of a group and one more who is not part of the group.
+-- The server must not send this message to client ids not part of the group.
+-- @SF.Separation @TSFI.RESTfulAPI @S2
+postMessageClientNotInGroupDoesNotReceiveMsg :: TestM ()
+postMessageClientNotInGroupDoesNotReceiveMsg = do
+  localDomain <- viewFederationDomain
+  cannon <- view tsCannon
+  (alice, ac) <- randomUserWithClient (someLastPrekeys !! 0)
+  (bob, bc) <- randomUserWithClient (someLastPrekeys !! 1)
+  (eve, ec) <- randomUserWithClient (someLastPrekeys !! 2)
+  (chad, cc) <- randomUserWithClient (someLastPrekeys !! 3)
+  connectUsers alice (list1 bob [eve, chad])
+  conversationWithAllButChad <- decodeConvId <$> postConv alice [bob, eve] (Just "gossip") [] Nothing Nothing
+  let qalice = Qualified alice localDomain
+      qconv = Qualified conversationWithAllButChad localDomain
+  WS.bracketR3 cannon bob eve chad $ \(wsBob, wsEve, wsChad) -> do
+    let msgToAllIncludingChad = [(bob, bc, toBase64Text "ciphertext2"), (eve, ec, toBase64Text "ciphertext2"), (chad, cc, toBase64Text "ciphertext2")]
+    postOtrMessage id alice ac conversationWithAllButChad msgToAllIncludingChad !!! const 201 === statusCode
+    let checkBobGetsMsg = void . liftIO $ WS.assertMatch (5 # Second) wsBob (wsAssertOtr qconv qalice ac bc (toBase64Text "ciphertext2"))
+    let checkEveGetsMsg = void . liftIO $ WS.assertMatch (5 # Second) wsEve (wsAssertOtr qconv qalice ac ec (toBase64Text "ciphertext2"))
+    let checkChadDoesNotGetMsg = assertNoMsg wsChad (wsAssertOtr qconv qalice ac ac (toBase64Text "ciphertext2"))
+    checkBobGetsMsg
+    checkEveGetsMsg
+    checkChadDoesNotGetMsg
+
+-- | This test verifies that when a client sends a message not to all clients of a group then the server should reject the message and sent a notification to the sender (412 Missing clients).
+-- The test is somewhat redundant because this is already tested as part of other tests already. This is a stand alone test that solely tests the behavior described above.
+-- @SF.Separation @TSFI.RESTfulAPI @S2
+postMessageRejectIfMissingClients :: TestM ()
+postMessageRejectIfMissingClients = do
+  (sender, senderClient) : allReceivers <- randomUserWithClient `traverse` someLastPrekeys
+  let (receiver1, receiverClient1) : otherReceivers = allReceivers
+  connectUsers sender (list1 receiver1 (fst <$> otherReceivers))
+  conv <- decodeConvId <$> postConv sender (receiver1 : (fst <$> otherReceivers)) (Just "gossip") [] Nothing Nothing
+  let msgToAllClients = mkMsg "hello!" <$> allReceivers
+  let msgMissingClients = mkMsg "hello!" <$> drop 1 allReceivers
+
+  let checkSendToAllClientShouldBeSuccessful =
+        postOtrMessage id sender senderClient conv msgToAllClients !!! do
+          const 201 === statusCode
+          assertMismatch [] [] []
+
+  let checkSendWitMissingClientsShouldFail =
+        postOtrMessage id sender senderClient conv msgMissingClients !!! do
+          const 412 === statusCode
+          assertMismatch [(receiver1, Set.singleton receiverClient1)] [] []
+
+  checkSendToAllClientShouldBeSuccessful
+  checkSendWitMissingClientsShouldFail
+  where
+    mkMsg :: ByteString -> (UserId, ClientId) -> (UserId, ClientId, Text)
+    mkMsg text (userId, clientId) = (userId, clientId, toBase64Text text)
+
 -- | This test verifies behaviour under various values of ignore_missing and
 -- report_missing. Only tests the JSON endpoint.
+-- @SF.Separation @TSFI.RESTfulAPI @S2
 postCryptoMessage5 :: TestM ()
 postCryptoMessage5 = do
   (alice, ac) <- randomUserWithClient (someLastPrekeys !! 0)
@@ -709,6 +769,7 @@ postMessageQualifiedLocalOwningBackendSuccess = do
 -- | Sets up a conversation on Backend A known as "owning backend". One of the
 -- users from Backend A will send the message but have a missing client. It is
 -- expected that the message will not be sent.
+-- @SF.Separation @TSFI.RESTfulAPI @S2
 postMessageQualifiedLocalOwningBackendMissingClients :: TestM ()
 postMessageQualifiedLocalOwningBackendMissingClients = do
   -- Cannon for local users
@@ -868,6 +929,7 @@ postMessageQualifiedLocalOwningBackendRedundantAndDeletedClients = do
 -- users from Backend A will send the message but have a missing client. It is
 -- expected that the message will be sent except when it is specifically
 -- requested to report on missing clients of a user.
+-- @SF.Separation @TSFI.RESTfulAPI @S2
 postMessageQualifiedLocalOwningBackendIgnoreMissingClients :: TestM ()
 postMessageQualifiedLocalOwningBackendIgnoreMissingClients = do
   -- WS receive timeout

From 9d1ae79ad1904a2f5f82af652a3a346d4139c315 Mon Sep 17 00:00:00 2001
From: Paolo Capriotti <paolo@capriotti.io>
Date: Tue, 14 Dec 2021 15:08:48 +0100
Subject: [PATCH 05/74] Streaming federator (#1966)

* Add body argument to Service effect

Also remove use of polysemy-mock from ExternalServer tests.

* Remove dependency on polysemy-mocks

* Federator: initial impl of service streaming

* Remove unused function interpretService

* Forward Content-Type header of service calls

Co-authored-by: Sven Tennie <sven.tennie@gmail.com>

* Use Codensity IO as a base monad for Service

This implements the bracketing pattern needed for closing a streaming
response at the level of the base monad, instead of introducing CPS for
the main polysemy actions.

* Formatting fixes

* Add basic response streaming primitive for HTTP2

Also use the same return type for the response as the one in
Servant.Client, namely `ResponseF`.

* RunStreamingClient instance for FederatorClient

* Create test for withHTTP2Request

* Fix CPS to Codensity in federator client

* Test federator client streaming

* Enable streaming in outward service

Co-authored-by: Sven Tennie <sven.tennie@gmail.com>
---
 cabal.project                                 |   2 +-
 cabal.project.freeze                          |   1 -
 changelog.d/6-federation/federator-streaming  |   1 +
 libs/wire-api-federation/package.yaml         |   1 +
 .../src/Wire/API/Federation/Client.hs         | 204 ++++++++++------
 .../wire-api-federation.cabal                 |   4 +-
 services/federator/federator.cabal            |  15 +-
 services/federator/package.yaml               |   4 +-
 services/federator/src/Federator/App.hs       |   2 -
 services/federator/src/Federator/Env.hs       |   4 +-
 .../federator/src/Federator/ExternalServer.hs |  20 +-
 .../federator/src/Federator/InternalServer.hs |   5 +-
 services/federator/src/Federator/Remote.hs    |  28 ++-
 services/federator/src/Federator/Response.hs  |  32 ++-
 services/federator/src/Federator/Run.hs       |  10 +-
 services/federator/src/Federator/Service.hs   |  87 +++++--
 .../integration/Test/Federator/IngressSpec.hs |  16 +-
 .../test/unit/Test/Federator/Client.hs        |  77 +++++-
 .../unit/Test/Federator/ExternalServer.hs     | 230 +++++++++---------
 .../unit/Test/Federator/InternalServer.hs     |  21 +-
 .../test/unit/Test/Federator/Remote.hs        |   3 +
 stack.yaml                                    |   6 +-
 stack.yaml.lock                               |  13 +-
 23 files changed, 509 insertions(+), 277 deletions(-)
 create mode 100644 changelog.d/6-federation/federator-streaming

diff --git a/cabal.project b/cabal.project
index 35f93fb1000..94b8595b0a0 100644
--- a/cabal.project
+++ b/cabal.project
@@ -135,7 +135,7 @@ source-repository-package
 source-repository-package
     type: git
     location: https://github.com/wireapp/http2
-    tag: 1ee1ce432d923839dab6782410e91dc17df2a880
+    tag: aa3501ad58e1abbd196781fac25a84f41ec2a787
 
 source-repository-package
     type: git
diff --git a/cabal.project.freeze b/cabal.project.freeze
index 22013305b8f..6e81f6e4022 100644
--- a/cabal.project.freeze
+++ b/cabal.project.freeze
@@ -1691,7 +1691,6 @@ constraints: any.AC-Angle ==1.0,
              any.polyparse ==1.13,
              any.polysemy ==1.7.0.0,
              any.polysemy-check ==0.8.1.0,
-             any.polysemy-mocks ==0.2.0.0,
              any.polysemy-plugin ==0.4.2.0,
              any.pooled-io ==0.0.2.2,
              any.port-utils ==0.2.1.0,
diff --git a/changelog.d/6-federation/federator-streaming b/changelog.d/6-federation/federator-streaming
new file mode 100644
index 00000000000..7901572b90b
--- /dev/null
+++ b/changelog.d/6-federation/federator-streaming
@@ -0,0 +1 @@
+Make federator capable of streaming responses
diff --git a/libs/wire-api-federation/package.yaml b/libs/wire-api-federation/package.yaml
index 6b4ff64da17..8fb6f5d3003 100644
--- a/libs/wire-api-federation/package.yaml
+++ b/libs/wire-api-federation/package.yaml
@@ -25,6 +25,7 @@ dependencies:
 - http-types
 - http2
 - imports
+- kan-extensions
 - lifted-base
 - metrics-wai
 - mtl
diff --git a/libs/wire-api-federation/src/Wire/API/Federation/Client.hs b/libs/wire-api-federation/src/Wire/API/Federation/Client.hs
index 4215def0283..4dae263caf3 100644
--- a/libs/wire-api-federation/src/Wire/API/Federation/Client.hs
+++ b/libs/wire-api-federation/src/Wire/API/Federation/Client.hs
@@ -22,13 +22,17 @@ module Wire.API.Federation.Client
   ( FederatorClientEnv (..),
     FederatorClient,
     runFederatorClient,
+    runFederatorClientToCodensity,
     performHTTP2Request,
+    withHTTP2Request,
+    streamingResponseStrictBody,
     headersFromTable,
   )
 where
 
 import qualified Control.Exception as E
 import Control.Monad.Catch
+import Control.Monad.Codensity
 import Control.Monad.Except
 import qualified Data.Aeson as Aeson
 import qualified Data.ByteString as BS
@@ -52,6 +56,7 @@ import Network.TLS as TLS
 import qualified Network.Wai.Utilities.Error as Wai
 import Servant.Client
 import Servant.Client.Core
+import Servant.Types.SourceT
 import qualified System.TimeManager
 import Util.Options (Endpoint (..))
 import Wire.API.Federation.Component
@@ -65,7 +70,7 @@ data FederatorClientEnv = FederatorClientEnv
   }
 
 newtype FederatorClient (c :: Component) a = FederatorClient
-  {unFederatorClient :: ReaderT FederatorClientEnv (ExceptT FederatorClientError IO) a}
+  {unFederatorClient :: ReaderT FederatorClientEnv (ExceptT FederatorClientError (Codensity IO)) a}
   deriving newtype
     ( Functor,
       Applicative,
@@ -75,6 +80,9 @@ newtype FederatorClient (c :: Component) a = FederatorClient
       MonadIO
     )
 
+liftCodensity :: Codensity IO a -> FederatorClient c a
+liftCodensity = FederatorClient . lift . lift
+
 headersFromTable :: HTTP2.HeaderTable -> [HTTP.Header]
 headersFromTable (headerList, _) = flip map headerList $ \(token, headerValue) ->
   (HTTP2.tokenKey token, headerValue)
@@ -90,93 +98,136 @@ performHTTP2Request ::
   HTTP2.Request ->
   ByteString ->
   Int ->
-  IO (Either FederatorClientHTTP2Error (HTTP.Status, [HTTP.Header], Builder))
-performHTTP2Request mtlsConfig req hostname port = do
-  let drainResponse resp = go mempty
-        where
-          go acc = do
-            chunk <- HTTP2.getResponseBodyChunk resp
-            if BS.null chunk
-              then pure acc
-              else go (acc <> byteString chunk)
+  IO (Either FederatorClientHTTP2Error (ResponseF Builder))
+performHTTP2Request mtlsConfig req hostname port = try $ do
+  withHTTP2Request mtlsConfig req hostname port $ \resp -> do
+    b <-
+      fmap (either (const mempty) id)
+        . runExceptT
+        . runSourceT
+        . responseBody
+        $ resp
+    pure $ resp $> foldMap byteString b
+
+withHTTP2Request ::
+  Maybe TLS.ClientParams ->
+  HTTP2.Request ->
+  ByteString ->
+  Int ->
+  (StreamingResponse -> IO a) ->
+  IO a
+withHTTP2Request mtlsConfig req hostname port k = do
   let clientConfig =
         HTTP2.ClientConfig
           "https"
           hostname
           {- cacheLimit: -} 20
-  flip
-    E.catches
-    [ -- catch FederatorClientHTTP2Error (e.g. connection and TLS errors)
-      E.Handler (pure . Left),
-      -- catch HTTP2 exceptions
-      E.Handler (pure . Left . FederatorClientHTTP2Exception)
-    ]
-    $ bracket (connectSocket hostname port) NS.close $ \sock -> do
-      let withHTTP2Config k = case mtlsConfig of
-            Nothing -> bracket (HTTP2.allocSimpleConfig sock 4096) HTTP2.freeSimpleConfig k
+  E.handle (E.throw . FederatorClientHTTP2Exception) $
+    bracket (connectSocket hostname port) NS.close $ \sock -> do
+      let withHTTP2Config k' = case mtlsConfig of
+            Nothing -> bracket (HTTP2.allocSimpleConfig sock 4096) HTTP2.freeSimpleConfig k'
             -- FUTUREWORK(federation): Use openssl
             Just tlsConfig -> do
               ctx <- E.handle (E.throw . FederatorClientTLSException) $ do
                 ctx <- TLS.contextNew sock tlsConfig
                 TLS.handshake ctx
                 pure ctx
-              bracket (allocTLSConfig ctx 4096) freeTLSConfig k
-      withHTTP2Config $ \conf ->
-        HTTP2.run clientConfig conf $ \sendRequest -> do
+              bracket (allocTLSConfig ctx 4096) freeTLSConfig k'
+      withHTTP2Config $ \conf -> do
+        HTTP2.run clientConfig conf $ \sendRequest ->
           sendRequest req $ \resp -> do
-            result <- drainResponse resp
             let headers = headersFromTable (HTTP2.responseHeaders resp)
-            pure $ case HTTP2.responseStatus resp of
-              Nothing -> Left FederatorClientNoStatusCode
-              Just status -> Right (status, headers, result)
+                result = fromAction BS.null (HTTP2.getResponseBodyChunk resp)
+            case HTTP2.responseStatus resp of
+              Nothing -> E.throw FederatorClientNoStatusCode
+              Just status ->
+                k
+                  Response
+                    { responseStatusCode = status,
+                      responseHeaders = Seq.fromList headers,
+                      responseHttpVersion = HTTP.http20,
+                      responseBody = result
+                    }
 
 instance KnownComponent c => RunClient (FederatorClient c) where
   runRequestAcceptStatus expectedStatuses req = do
-    env <- ask
-    let baseUrlPath =
-          HTTP.encodePathSegments
-            [ "rpc",
-              domainText (ceTargetDomain env),
-              componentName (componentVal @c)
-            ]
-    let path = baseUrlPath <> requestPath req
-    body <- case requestBody req of
-      Just (RequestBodyLBS lbs, _) -> pure lbs
-      Just (RequestBodyBS bs, _) -> pure (LBS.fromStrict bs)
-      Just (RequestBodySource _, _) ->
-        throwError FederatorClientStreamingNotSupported
-      Nothing -> pure mempty
-    let req' =
-          HTTP2.requestBuilder
-            (requestMethod req)
-            (LBS.toStrict (toLazyByteString path))
-            (toList (requestHeaders req) <> [(originDomainHeaderName, toByteString' (ceOriginDomain env))])
-            (lazyByteString body)
-    let Endpoint (Text.encodeUtf8 -> hostname) (fromIntegral -> port) = ceFederator env
-    eresp <- liftIO $ performHTTP2Request Nothing req' hostname port
-    case eresp of
-      Left err -> throwError (FederatorClientHTTP2Error err)
-      Right (status, headers, result)
-        | maybe (HTTP.statusIsSuccessful status) (elem status) expectedStatuses ->
-          pure $
-            Response
-              { responseStatusCode = status,
-                responseHeaders = Seq.fromList headers,
-                responseHttpVersion = HTTP.http20,
-                responseBody = toLazyByteString result
-              }
-        | otherwise ->
-          throwError $
-            FederatorClientError
-              ( mkFailureResponse
-                  status
-                  (ceTargetDomain env)
-                  (toLazyByteString (requestPath req))
-                  (toLazyByteString result)
-              )
+    let successfulStatus status =
+          maybe
+            (HTTP.statusIsSuccessful status)
+            (elem status)
+            expectedStatuses
+    withHTTP2StreamingRequest successfulStatus req $ \resp -> do
+      bdy <-
+        fmap (either (const mempty) (toLazyByteString . foldMap byteString))
+          . runExceptT
+          . runSourceT
+          . responseBody
+          $ resp
+      pure $ resp $> bdy
 
   throwClientError = throwError . FederatorClientServantError
 
+instance KnownComponent c => RunStreamingClient (FederatorClient c) where
+  withStreamingRequest = withHTTP2StreamingRequest HTTP.statusIsSuccessful
+
+streamingResponseStrictBody :: StreamingResponse -> IO Builder
+streamingResponseStrictBody resp =
+  fmap (either stringUtf8 (foldMap byteString))
+    . runExceptT
+    . runSourceT
+    . responseBody
+    $ resp
+
+withHTTP2StreamingRequest ::
+  forall c a.
+  KnownComponent c =>
+  (HTTP.Status -> Bool) ->
+  Request ->
+  (StreamingResponse -> IO a) ->
+  FederatorClient c a
+withHTTP2StreamingRequest successfulStatus req handleResponse = do
+  env <- ask
+  let baseUrlPath =
+        HTTP.encodePathSegments
+          [ "rpc",
+            domainText (ceTargetDomain env),
+            componentName (componentVal @c)
+          ]
+  let path = baseUrlPath <> requestPath req
+  body <- case requestBody req of
+    Just (RequestBodyLBS lbs, _) -> pure lbs
+    Just (RequestBodyBS bs, _) -> pure (LBS.fromStrict bs)
+    Just (RequestBodySource _, _) ->
+      throwError FederatorClientStreamingNotSupported
+    Nothing -> pure mempty
+  let req' =
+        HTTP2.requestBuilder
+          (requestMethod req)
+          (LBS.toStrict (toLazyByteString path))
+          (toList (requestHeaders req) <> [(originDomainHeaderName, toByteString' (ceOriginDomain env))])
+          (lazyByteString body)
+  let Endpoint (Text.encodeUtf8 -> hostname) (fromIntegral -> port) = ceFederator env
+  resp <-
+    (either throwError pure =<<) . liftCodensity $
+      Codensity $ \k ->
+        E.catch
+          (withHTTP2Request Nothing req' hostname port (k . Right))
+          (k . Left . FederatorClientHTTP2Error)
+
+  if successfulStatus (responseStatusCode resp)
+    then liftIO $ handleResponse resp
+    else do
+      -- in case of an error status code, read the whole body to construct the error
+      bdy <- liftIO $ streamingResponseStrictBody resp
+      throwError $
+        FederatorClientError
+          ( mkFailureResponse
+              (responseStatusCode resp)
+              (ceTargetDomain env)
+              (toLazyByteString (requestPath req))
+              (toLazyByteString bdy)
+          )
+
 mkFailureResponse :: HTTP.Status -> Domain -> LByteString -> LByteString -> Wai.Error
 mkFailureResponse status domain path body
   -- If the outward federator fails with 403, that means that there was an
@@ -211,12 +262,25 @@ mkFailureResponse status domain path body
         "unknown-federation-error"
         (LText.decodeUtf8With Text.lenientDecode body)
 
+-- | Run federator client synchronously.
 runFederatorClient ::
   KnownComponent c =>
   FederatorClientEnv ->
   FederatorClient c a ->
   IO (Either FederatorClientError a)
-runFederatorClient env action = runExceptT (runReaderT (unFederatorClient action) env)
+runFederatorClient env =
+  lowerCodensity
+    . runFederatorClientToCodensity env
+
+runFederatorClientToCodensity ::
+  KnownComponent c =>
+  FederatorClientEnv ->
+  FederatorClient c a ->
+  Codensity IO (Either FederatorClientError a)
+runFederatorClientToCodensity env =
+  runExceptT
+    . flip runReaderT env
+    . unFederatorClient
 
 freeTLSConfig :: HTTP2.Config -> IO ()
 freeTLSConfig cfg = free (HTTP2.confWriteBuffer cfg)
diff --git a/libs/wire-api-federation/wire-api-federation.cabal b/libs/wire-api-federation/wire-api-federation.cabal
index a1592e461ea..5d665a791a6 100644
--- a/libs/wire-api-federation/wire-api-federation.cabal
+++ b/libs/wire-api-federation/wire-api-federation.cabal
@@ -4,7 +4,7 @@ cabal-version: 1.12
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 621c254076cf520b525269ca4fc550df57f410aea52a288f6cb68bd2d6f1ada3
+-- hash: f62744549c34b54e9900b31c33a4ebad5c51ac13ec44010ad2da6c6ca67fdc29
 
 name:           wire-api-federation
 version:        0.1.0
@@ -51,6 +51,7 @@ library
     , http-types
     , http2
     , imports
+    , kan-extensions
     , lifted-base
     , metrics-wai
     , mtl
@@ -110,6 +111,7 @@ test-suite spec
     , http-types
     , http2
     , imports
+    , kan-extensions
     , lifted-base
     , metrics-wai
     , mtl
diff --git a/services/federator/federator.cabal b/services/federator/federator.cabal
index fca3d7731cf..7bfdce95e1c 100644
--- a/services/federator/federator.cabal
+++ b/services/federator/federator.cabal
@@ -4,7 +4,7 @@ cabal-version: 1.12
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 2131bf1a367dd734cbccd900c4724c5b48e3f494501b2221e3f32ecaf0a12ec4
+-- hash: 371580e0c3adbdb4994c74a23ada11c91023bc654f2f0fe304ead7e88a3b8ba6
 
 name:           federator
 version:        1.0.0
@@ -83,6 +83,7 @@ library
     , http-types
     , http2
     , imports
+    , kan-extensions
     , lens
     , metrics-core
     , metrics-wai
@@ -94,7 +95,7 @@ library
     , polysemy-wire-zoo
     , retry
     , servant
-    , servant-server
+    , servant-client-core
     , streaming-commons
     , string-conversions
     , text
@@ -149,6 +150,7 @@ executable federator
     , http-types
     , http2
     , imports
+    , kan-extensions
     , lens
     , metrics-core
     , metrics-wai
@@ -160,7 +162,7 @@ executable federator
     , polysemy-wire-zoo
     , retry
     , servant
-    , servant-server
+    , servant-client-core
     , streaming-commons
     , string-conversions
     , text
@@ -224,6 +226,7 @@ executable federator-integration
     , http-types
     , http2
     , imports
+    , kan-extensions
     , lens
     , metrics-core
     , metrics-wai
@@ -237,7 +240,7 @@ executable federator-integration
     , random
     , retry
     , servant
-    , servant-server
+    , servant-client-core
     , streaming-commons
     , string-conversions
     , tasty
@@ -308,6 +311,7 @@ test-suite federator-tests
     , http2
     , imports
     , interpolate
+    , kan-extensions
     , lens
     , metrics-core
     , metrics-wai
@@ -316,12 +320,11 @@ test-suite federator-tests
     , network-uri
     , pem
     , polysemy
-    , polysemy-mocks
     , polysemy-wire-zoo
     , retry
     , servant
     , servant-client
-    , servant-server
+    , servant-client-core
     , streaming-commons
     , string-conversions
     , tasty
diff --git a/services/federator/package.yaml b/services/federator/package.yaml
index bb4c0b9655a..0c9abdd8509 100644
--- a/services/federator/package.yaml
+++ b/services/federator/package.yaml
@@ -31,6 +31,7 @@ dependencies:
 - http-client-openssl
 - http-types
 - http2
+- kan-extensions
 - imports
 - lens
 - metrics-core
@@ -43,7 +44,7 @@ dependencies:
 - polysemy-wire-zoo
 - retry
 - servant
-- servant-server
+- servant-client-core
 - streaming-commons
 - string-conversions
 - text
@@ -111,7 +112,6 @@ tests:
     - directory
     - federator
     - interpolate
-    - polysemy-mocks
     - QuickCheck
     - servant-client
     - streaming-commons
diff --git a/services/federator/src/Federator/App.hs b/services/federator/src/Federator/App.hs
index e1601ed8900..2a33cd98600 100644
--- a/services/federator/src/Federator/App.hs
+++ b/services/federator/src/Federator/App.hs
@@ -34,8 +34,6 @@ import Federator.Env (Env, applog, httpManager, requestId)
 import Imports
 import Polysemy
 import Polysemy.Input
-import Servant.API.Generic ()
-import Servant.Server ()
 import System.Logger.Class as LC
 import qualified System.Logger.Extended as Log
 
diff --git a/services/federator/src/Federator/Env.hs b/services/federator/src/Federator/Env.hs
index 4594b4fd852..ced29deb2bd 100644
--- a/services/federator/src/Federator/Env.hs
+++ b/services/federator/src/Federator/Env.hs
@@ -21,7 +21,6 @@
 module Federator.Env where
 
 import Bilge (RequestId)
-import qualified Bilge as RPC
 import Control.Lens (makeLenses)
 import Data.Metrics (Metrics)
 import Data.X509.CertificateStore
@@ -31,6 +30,7 @@ import Network.DNS.Resolver (Resolver)
 import qualified Network.HTTP.Client as HTTP
 import qualified Network.TLS as TLS
 import qualified System.Logger.Class as LC
+import Util.Options
 import Wire.API.Federation.Component
 
 data TLSSettings = TLSSettings
@@ -44,7 +44,7 @@ data Env = Env
     _requestId :: RequestId,
     _dnsResolver :: Resolver,
     _runSettings :: RunSettings,
-    _service :: Component -> RPC.Request,
+    _service :: Component -> Endpoint,
     _httpManager :: HTTP.Manager,
     _tls :: IORef TLSSettings
   }
diff --git a/services/federator/src/Federator/ExternalServer.hs b/services/federator/src/Federator/ExternalServer.hs
index 59546eb2165..b81c7b18691 100644
--- a/services/federator/src/Federator/ExternalServer.hs
+++ b/services/federator/src/Federator/ExternalServer.hs
@@ -18,8 +18,9 @@
 module Federator.ExternalServer (callInward, serveInward, parseRequestData, RequestData (..)) where
 
 import qualified Data.ByteString as BS
-import Data.ByteString.Builder (toLazyByteString)
+import Data.ByteString.Builder
 import qualified Data.ByteString.Lazy as LBS
+import qualified Data.Sequence as Seq
 import qualified Data.Text as Text
 import Federator.Discovery
 import Federator.Env
@@ -36,6 +37,7 @@ import Polysemy.Error
 import Polysemy.Input
 import Polysemy.TinyLog (TinyLog)
 import qualified Polysemy.TinyLog as Log
+import Servant.Client.Core
 import qualified System.Logger.Message as Log
 import Wire.API.Federation.Component
 import Wire.API.Federation.Domain
@@ -43,7 +45,7 @@ import Wire.API.Federation.Domain
 -- FUTUREWORK(federation): Versioning of the federation API.
 callInward ::
   Members
-    '[ Service,
+    '[ ServiceStreaming,
        Embed IO,
        TinyLog,
        DiscoverFederator,
@@ -67,12 +69,18 @@ callInward wreq = do
 
   let path = LBS.toStrict (toLazyByteString (HTTP.encodePathSegments ["federation", rdRPC req]))
 
-  (status, body) <- serviceCall (rdComponent req) path (rdBody req) validatedDomain
+  resp <- serviceCall (rdComponent req) path (rdBody req) validatedDomain
   Log.debug $
     Log.msg ("Inward Request response" :: ByteString)
-      . Log.field "status" (show status)
-
-  pure $ Wai.responseLBS status defaultHeaders (fromMaybe mempty body)
+      . Log.field "status" (show (responseStatusCode resp))
+  pure $
+    streamingResponseToWai
+      resp
+        { responseHeaders =
+            Seq.filter
+              (\(name, _) -> name == "Content-Type")
+              (responseHeaders resp)
+        }
 
 data RequestData = RequestData
   { rdComponent :: Component,
diff --git a/services/federator/src/Federator/InternalServer.hs b/services/federator/src/Federator/InternalServer.hs
index a3fadf6f2ec..5493448f32b 100644
--- a/services/federator/src/Federator/InternalServer.hs
+++ b/services/federator/src/Federator/InternalServer.hs
@@ -65,6 +65,7 @@ import qualified Polysemy.Input as Polysemy
 import qualified Polysemy.Resource as Polysemy
 import Polysemy.TinyLog (TinyLog)
 import qualified Polysemy.TinyLog as Log
+import Servant.Client.Core
 import qualified System.TimeManager as T
 import qualified System.X509 as TLS
 import Wire.API.Federation.Component
@@ -118,14 +119,14 @@ callOutward req = do
   rd <- parseRequestData req
   domain <- parseDomainText (rdTargetDomain rd)
   ensureCanFederateWith domain
-  (status, result) <-
+  resp <-
     discoverAndCall
       domain
       (rdComponent rd)
       (rdRPC rd)
       (rdHeaders rd)
       (fromLazyByteString (rdBody rd))
-  pure $ Wai.responseBuilder status defaultHeaders result
+  pure $ streamingResponseToWai resp
 
 serveOutward :: Env -> Int -> IO ()
 serveOutward = serve callOutward
diff --git a/services/federator/src/Federator/Remote.hs b/services/federator/src/Federator/Remote.hs
index bbf5146da53..a206fcea360 100644
--- a/services/federator/src/Federator/Remote.hs
+++ b/services/federator/src/Federator/Remote.hs
@@ -26,7 +26,9 @@ module Federator.Remote
   )
 where
 
+import qualified Control.Exception as E
 import Control.Lens ((^.))
+import Control.Monad.Codensity
 import Data.Binary.Builder
 import Data.ByteString.Conversion (toByteString')
 import qualified Data.ByteString.Lazy as LBS
@@ -49,6 +51,7 @@ import qualified Network.TLS.Extra.Cipher as TLS
 import Polysemy
 import Polysemy.Error
 import Polysemy.Input
+import Servant.Client.Core
 import Wire.API.Federation.Client
 import Wire.API.Federation.Component
 import Wire.API.Federation.Error
@@ -93,13 +96,13 @@ data Remote m a where
     Text ->
     [HTTP.Header] ->
     Builder ->
-    Remote m (HTTP.Status, Builder)
+    Remote m StreamingResponse
 
 makeSem ''Remote
 
 interpretRemote ::
   Members
-    '[ Embed IO,
+    '[ Embed (Codensity IO),
        DiscoverFederator,
        Error DiscoveryFailure,
        Error RemoteError,
@@ -117,12 +120,21 @@ interpretRemote = interpret $ \case
             HTTP.encodePathSegments ["federation", componentName component, rpc]
         req' = HTTP2.requestBuilder HTTP.methodPost path headers body
         tlsConfig = mkTLSConfig settings hostname port
-    (status, _, result) <-
-      mapError (RemoteError target) . (fromEither =<<) . embed $
-        performHTTP2Request (Just tlsConfig) req' hostname (fromIntegral port)
-    unless (HTTP.statusIsSuccessful status) $
-      throw $ RemoteErrorResponse target status (toLazyByteString result)
-    pure (status, result)
+
+    resp <- mapError (RemoteError target) . (fromEither @FederatorClientHTTP2Error =<<) . embed $
+      Codensity $ \k ->
+        E.catch
+          (withHTTP2Request (Just tlsConfig) req' hostname (fromIntegral port) (k . Right))
+          (k . Left)
+
+    unless (HTTP.statusIsSuccessful (responseStatusCode resp)) $ do
+      bdy <- embed @(Codensity IO) . liftIO $ streamingResponseStrictBody resp
+      throw $
+        RemoteErrorResponse
+          target
+          (responseStatusCode resp)
+          (toLazyByteString bdy)
+    pure resp
 
 mkTLSConfig :: TLSSettings -> ByteString -> Word16 -> TLS.ClientParams
 mkTLSConfig settings hostname port =
diff --git a/services/federator/src/Federator/Response.hs b/services/federator/src/Federator/Response.hs
index 7edab1111b2..76e2649a85f 100644
--- a/services/federator/src/Federator/Response.hs
+++ b/services/federator/src/Federator/Response.hs
@@ -20,10 +20,13 @@ module Federator.Response
     serve,
     runWaiError,
     runWaiErrors,
+    streamingResponseToWai,
   )
 where
 
 import Control.Lens
+import Control.Monad.Codensity
+import Data.ByteString.Builder
 import Federator.Discovery
 import Federator.Env
 import Federator.Error
@@ -39,10 +42,13 @@ import qualified Network.Wai.Handler.Warp as Warp
 import qualified Network.Wai.Utilities.Error as Wai
 import qualified Network.Wai.Utilities.Server as Wai
 import Polysemy
+import Polysemy.Embed
 import Polysemy.Error
 import Polysemy.Input
 import Polysemy.Internal
 import Polysemy.TinyLog
+import Servant.Client.Core
+import Servant.Types.SourceT
 import Wire.Network.DNS.Effect
 
 defaultHeaders :: [HTTP.Header]
@@ -96,14 +102,13 @@ serve action env port =
   where
     app :: Wai.Application
     app req respond =
-      runFederator env (action req)
-        >>= respond
+      runCodensity (runFederator env (action req)) respond
 
 type AllEffects =
   '[ Remote,
      DiscoverFederator,
      DNSLookup, -- needed by DiscoverFederator
-     Service,
+     ServiceStreaming,
      Input RunSettings,
      Input TLSSettings, -- needed by Remote
      Input Env, -- needed by Service
@@ -112,14 +117,16 @@ type AllEffects =
      Error ServerError,
      Error DiscoveryFailure,
      TinyLog,
-     Embed IO
+     Embed IO,
+     Embed (Codensity IO)
    ]
 
 -- | Run Sem action containing HTTP handlers. All errors have to been handled
 -- already by this point.
-runFederator :: Env -> Sem AllEffects Wai.Response -> IO Wai.Response
+runFederator :: Env -> Sem AllEffects Wai.Response -> Codensity IO Wai.Response
 runFederator env =
-  runM @IO
+  runM
+    . runEmbedded @IO @(Codensity IO) liftIO
     . runTinyLog (view applog env) -- FUTUREWORK: add request id
     . runWaiErrors
       @'[ ValidationError,
@@ -130,7 +137,18 @@ runFederator env =
     . runInputConst env
     . runInputSem (embed @IO (readIORef (view tls env)))
     . runInputConst (view runSettings env)
-    . interpretService
+    . interpretServiceHTTP
     . runDNSLookupWithResolver (view dnsResolver env)
     . runFederatorDiscovery
     . interpretRemote
+
+streamingResponseToWai :: StreamingResponse -> Wai.Response
+streamingResponseToWai resp =
+  let headers = toList (responseHeaders resp)
+      status = responseStatusCode resp
+      streamingBody output flush =
+        foreach
+          (const (pure ()))
+          (\chunk -> output (byteString chunk) *> flush)
+          (responseBody resp)
+   in Wai.responseStream status headers streamingBody
diff --git a/services/federator/src/Federator/Run.hs b/services/federator/src/Federator/Run.hs
index 3e9312a4604..a41b259451b 100644
--- a/services/federator/src/Federator/Run.hs
+++ b/services/federator/src/Federator/Run.hs
@@ -34,13 +34,11 @@ module Federator.Run
   )
 where
 
-import qualified Bilge as RPC
 import Control.Concurrent.Async
 import Control.Exception (bracket)
 import Control.Lens ((^.))
 import Data.Default (def)
 import qualified Data.Metrics.Middleware as Metrics
-import Data.Text.Encoding (encodeUtf8)
 import Federator.Env
 import Federator.ExternalServer (serveInward)
 import Federator.InternalServer (serveOutward)
@@ -95,14 +93,12 @@ newEnv o _dnsResolver = do
   _applog <- LogExt.mkLogger (Opt.logLevel o) (Opt.logNetStrings o) (Opt.logFormat o)
   let _requestId = def
   let _runSettings = Opt.optSettings o
-  let _service Brig = mkEndpoint (Opt.brig o)
-      _service Galley = mkEndpoint (Opt.galley o)
-      _service Cargohold = mkEndpoint (Opt.cargohold o)
+  let _service Brig = Opt.brig o
+      _service Galley = Opt.galley o
+      _service Cargohold = Opt.cargohold o
   _httpManager <- initHttpManager
   _tls <- mkTLSSettingsOrThrow _runSettings >>= newIORef
   return Env {..}
-  where
-    mkEndpoint s = RPC.host (encodeUtf8 (s ^. epHost)) . RPC.port (s ^. epPort) $ RPC.empty
 
 closeEnv :: Env -> IO ()
 closeEnv e = do
diff --git a/services/federator/src/Federator/Service.hs b/services/federator/src/Federator/Service.hs
index 99b024fcc31..9514f9ecf24 100644
--- a/services/federator/src/Federator/Service.hs
+++ b/services/federator/src/Federator/Service.hs
@@ -15,35 +15,57 @@
 -- You should have received a copy of the GNU Affero General Public License along
 -- with this program. If not, see <https://www.gnu.org/licenses/>.
 
-module Federator.Service where
+module Federator.Service
+  ( Service (..),
+    ServiceStreaming,
+    interpretServiceHTTP,
+    serviceCall,
+  )
+where
 
 -- FUTUREWORK(federation): Once we authenticate the call, we should send authentication data
 -- to brig so brig can do some authorization as required.
 
 import qualified Bilge as RPC
-import Bilge.RPC (rpc')
+import Control.Exception
 import Control.Lens (view)
+import Control.Monad.Codensity
+import qualified Data.ByteString as BS
 import Data.Domain
+import qualified Data.Sequence as Seq
 import Data.String.Conversions (cs)
-import qualified Data.Text.Lazy as LText
-import Federator.App
+import qualified Data.Text.Encoding as Text
 import Federator.Env
 import Imports
+import Network.HTTP.Client
 import qualified Network.HTTP.Types as HTTP
 import Polysemy
 import Polysemy.Input
+import Polysemy.TinyLog
+import qualified Servant.Client.Core as Servant
+import Servant.Types.SourceT
+import Util.Options
 import Wire.API.Federation.Component
 import Wire.API.Federation.Domain (originDomainHeaderName)
 
-newtype ServiceError = ServiceErrorInvalidStatus HTTP.Status
-  deriving (Eq, Show)
+type ServiceStreaming = Service (SourceT IO ByteString)
 
-data Service m a where
-  -- | Returns status and body, 'HTTP.Response' is not nice to work with in tests
-  ServiceCall :: Component -> ByteString -> LByteString -> Domain -> Service m (HTTP.Status, Maybe LByteString)
+data Service body m a where
+  -- | Returns status, headers and body, 'HTTP.Response' is not nice to work with in tests
+  ServiceCall :: Component -> ByteString -> LByteString -> Domain -> Service body m (Servant.ResponseF body)
 
 makeSem ''Service
 
+bodyReaderToStreamT :: Monad m => m ByteString -> SourceT m ByteString
+bodyReaderToStreamT action = fromStepT go
+  where
+    go = Effect $ do
+      chunk <- action
+      pure $
+        if BS.null chunk
+          then Stop
+          else Yield chunk go
+
 -- FUTUREWORK(federation): Do we want to use servant client here? May make
 -- everything typed and safe
 --
@@ -52,19 +74,36 @@ makeSem ''Service
 --
 -- FUTUREWORK: unify this interpretation with similar ones in Galley
 --
--- FUTUREWORK: does it make sense to use a lower level abstraction instead of bilge here?
-interpretService ::
-  Members '[Embed IO, Input Env] r =>
-  Sem (Service ': r) a ->
+interpretServiceHTTP ::
+  Members '[Embed (Codensity IO), Input Env, TinyLog] r =>
+  Sem (ServiceStreaming ': r) a ->
   Sem r a
-interpretService = interpret $ \case
-  ServiceCall component path body domain -> embedApp @IO $ do
-    serviceReq <- view service <$> ask
-    res <-
-      rpc' (LText.pack (show component)) (serviceReq component) $
-        RPC.method HTTP.POST
-          . RPC.path path
-          . RPC.body (RPC.RequestBodyLBS body)
-          . RPC.contentJson
-          . RPC.header originDomainHeaderName (cs (domainText domain))
-    pure (RPC.responseStatus res, RPC.responseBody res)
+interpretServiceHTTP = interpret $ \case
+  ServiceCall component rpcPath body domain -> do
+    Endpoint serviceHost servicePort <- inputs (view service) <*> pure component
+    manager <- inputs (view httpManager)
+    reqId <- inputs (view requestId)
+    let req =
+          defaultRequest
+            { method = HTTP.methodPost,
+              host = Text.encodeUtf8 serviceHost,
+              port = fromIntegral servicePort,
+              requestBody = RequestBodyLBS body,
+              path = rpcPath,
+              requestHeaders =
+                [ ("Content-Type", "application/json"),
+                  (originDomainHeaderName, cs (domainText domain)),
+                  (RPC.requestIdName, RPC.unRequestId reqId)
+                ]
+            }
+
+    embed $
+      Codensity $ \k ->
+        bracket (responseOpen req manager) responseClose $ \resp ->
+          k $
+            Servant.Response
+              { Servant.responseStatusCode = responseStatus resp,
+                Servant.responseHeaders = Seq.fromList (responseHeaders resp),
+                Servant.responseHttpVersion = HTTP.http11,
+                Servant.responseBody = bodyReaderToStreamT (responseBody resp)
+              }
diff --git a/services/federator/test/integration/Test/Federator/IngressSpec.hs b/services/federator/test/integration/Test/Federator/IngressSpec.hs
index 04d80bb147d..08d989b647a 100644
--- a/services/federator/test/integration/Test/Federator/IngressSpec.hs
+++ b/services/federator/test/integration/Test/Federator/IngressSpec.hs
@@ -18,6 +18,7 @@
 module Test.Federator.IngressSpec where
 
 import Control.Lens (view)
+import Control.Monad.Codensity
 import qualified Data.Aeson as Aeson
 import Data.Binary.Builder
 import Data.Domain
@@ -32,11 +33,14 @@ import Federator.Remote
 import Imports
 import qualified Network.HTTP.Types as HTTP
 import Polysemy
+import Polysemy.Embed
 import Polysemy.Error
 import Polysemy.Input
+import Servant.Client.Core
 import Test.Federator.Util
 import Test.Hspec
 import Util.Options (Endpoint (Endpoint))
+import Wire.API.Federation.Client
 import Wire.API.Federation.Component
 import Wire.API.Federation.Domain
 import Wire.API.User
@@ -53,14 +57,15 @@ spec env = do
         _ <- putHandle brig (userId user) hdl
 
         let expectedProfile = (publicProfile user UserLegalHoldNoConsent) {profileHandle = Just (Handle hdl)}
-        (status, resp) <-
+        resp <-
           runTestSem
             . assertNoError @RemoteError
             $ inwardBrigCallViaIngress "get-user-by-handle" $
               (Aeson.fromEncoding (Aeson.toEncoding hdl))
-        let actualProfile = Aeson.decode (toLazyByteString resp)
         liftIO $ do
-          status `shouldBe` HTTP.status200
+          bdy <- streamingResponseStrictBody resp
+          let actualProfile = Aeson.decode (toLazyByteString bdy)
+          responseStatusCode resp `shouldBe` HTTP.status200
           actualProfile `shouldBe` (Just expectedProfile)
 
   it "should not be accessible without a client certificate" $
@@ -102,7 +107,7 @@ inwardBrigCallViaIngress ::
   Members [Input TestEnv, Embed IO, Error RemoteError] r =>
   Text ->
   Builder ->
-  Sem r (HTTP.Status, Builder)
+  Sem r StreamingResponse
 inwardBrigCallViaIngress path payload = do
   tlsSettings <- inputs (view teTLSSettings)
   inwardBrigCallViaIngressWithSettings tlsSettings path payload
@@ -112,7 +117,7 @@ inwardBrigCallViaIngressWithSettings ::
   TLSSettings ->
   Text ->
   Builder ->
-  Sem r (HTTP.Status, Builder)
+  Sem r StreamingResponse
 inwardBrigCallViaIngressWithSettings tlsSettings requestPath payload =
   do
     Endpoint ingressHost ingressPort <- cfgNginxIngress . view teTstOpts <$> input
@@ -122,5 +127,6 @@ inwardBrigCallViaIngressWithSettings tlsSettings requestPath payload =
     runInputConst tlsSettings
       . assertNoError @DiscoveryFailure
       . discoverConst target
+      . runEmbedded @(Codensity IO) @IO lowerCodensity
       . interpretRemote
       $ discoverAndCall (Domain "example.com") Brig requestPath headers payload
diff --git a/services/federator/test/unit/Test/Federator/Client.hs b/services/federator/test/unit/Test/Federator/Client.hs
index a0d172050f9..854ac570874 100644
--- a/services/federator/test/unit/Test/Federator/Client.hs
+++ b/services/federator/test/unit/Test/Federator/Client.hs
@@ -18,14 +18,26 @@
 module Test.Federator.Client (tests) where
 
 import Control.Exception hiding (handle)
+import Control.Monad.Codensity
+import Control.Monad.Except
 import qualified Data.Aeson as Aeson
 import Data.Bifunctor (first)
+import qualified Data.ByteString as BS
+import Data.ByteString.Builder (Builder, byteString, toLazyByteString)
+import qualified Data.ByteString.Lazy as LBS
 import Data.Domain
+import Data.Proxy
+import qualified Data.Text.Encoding as Text
 import Federator.MockServer
 import Imports
 import Network.HTTP.Types as HTTP
 import qualified Network.HTTP2.Client as HTTP2
-import Network.Wai.Utilities.Error as Wai
+import qualified Network.Wai as Wai
+import qualified Network.Wai.Utilities.Error as Wai
+import Servant.API
+import Servant.Client
+import Servant.Client.Core
+import Servant.Types.SourceT
 import Test.QuickCheck (arbitrary, generate)
 import Test.Tasty
 import Test.Tasty.HUnit
@@ -53,6 +65,7 @@ tests =
     [ testGroup
         "Servant"
         [ testCase "testClientSuccess" testClientSuccess,
+          testCase "testClientStreaming" testClientStreaming,
           testCase "testClientFailure" testClientFailure,
           testCase "testFederatorFailure" testFederatorFailure,
           testCase "testClientException" testClientExceptions,
@@ -60,7 +73,8 @@ tests =
         ],
       testGroup
         "HTTP2 client"
-        [ testCase "testResponseHeaders" testResponseHeaders
+        [ testCase "testResponseHeaders" testResponseHeaders,
+          testCase "testStreaming" testStreaming
         ]
     ]
 
@@ -106,6 +120,25 @@ testClientSuccess = do
         ]
   first (const ()) actualResponse @?= Right (Just expectedResponse)
 
+type StreamingAPI = StreamGet NewlineFraming PlainText (SourceIO Text)
+
+testClientStreaming :: IO ()
+testClientStreaming = withInfiniteMockServer $ \port -> do
+  let env =
+        FederatorClientEnv
+          { ceOriginDomain = originDomain,
+            ceTargetDomain = targetDomain,
+            ceFederator = Endpoint "127.0.0.1" (fromIntegral port)
+          }
+  let c = clientIn (Proxy @StreamingAPI) (Proxy @(FederatorClient 'Brig))
+  runCodensity (runFederatorClientToCodensity env c) $ \eout ->
+    case eout of
+      Left err -> assertFailure $ "Unexpected error: " <> displayException err
+      Right out -> do
+        let expected = mconcat (replicate 500 "Hello")
+        actual <- takeSourceT (fromIntegral (LBS.length expected)) (fmap Text.encodeUtf8 out)
+        actual @?= expected
+
 testClientFailure :: IO ()
 testClientFailure = do
   handle <- generate arbitrary
@@ -181,6 +214,40 @@ testResponseHeaders = do
     Left err ->
       assertFailure $
         "Unexpected error while connecting to mock federator: " <> show err
-    Right (status, headers, _) -> do
-      status @?= HTTP.status200
-      lookup "X-Foo" headers @?= Just "bar"
+    Right resp -> do
+      responseStatusCode resp @?= HTTP.status200
+      lookup "X-Foo" (toList (responseHeaders resp)) @?= Just "bar"
+
+testStreaming :: IO ()
+testStreaming = withInfiniteMockServer $ \port -> do
+  let req = HTTP2.requestBuilder HTTP.methodPost "test" [] mempty
+  withHTTP2Request Nothing req "127.0.0.1" port $ \resp -> do
+    let expected = mconcat (replicate 512 "Hello\n")
+    actual <- takeSourceT (fromIntegral (LBS.length expected)) (responseBody resp)
+    actual @?= expected
+
+withInfiniteMockServer :: (Int -> IO a) -> IO a
+withInfiniteMockServer k = bracket (startMockServer Nothing app) fst (k . snd)
+  where
+    app _ respond = respond $
+      Wai.responseStream HTTP.ok200 mempty $ \write flush ->
+        let go n = do
+              when (n == 0) $ flush
+              write (byteString "Hello\n") *> go (if n == 0 then 100 else n - 1)
+         in go (1000 :: Int)
+
+-- SourceT utilities
+
+takeStepT :: Builder -> Int -> StepT IO ByteString -> IO LByteString
+takeStepT acc _ Stop = pure (toLazyByteString acc)
+takeStepT acc _ (Error _) = pure (toLazyByteString acc)
+takeStepT acc s (Skip next) = takeStepT acc s next
+takeStepT acc s (Yield chunk next)
+  | BS.length chunk >= s =
+    pure $ toLazyByteString (acc <> byteString (BS.take s chunk))
+  | otherwise = do
+    takeStepT (acc <> byteString chunk) (s - BS.length chunk) next
+takeStepT acc s (Effect m) = m >>= takeStepT acc s
+
+takeSourceT :: Int -> SourceT IO ByteString -> IO LByteString
+takeSourceT s m = unSourceT m (takeStepT mempty s)
diff --git a/services/federator/test/unit/Test/Federator/ExternalServer.hs b/services/federator/test/unit/Test/Federator/ExternalServer.hs
index a1c749cec4a..a70934f8dac 100644
--- a/services/federator/test/unit/Test/Federator/ExternalServer.hs
+++ b/services/federator/test/unit/Test/Federator/ExternalServer.hs
@@ -26,7 +26,7 @@ import qualified Data.Text.Encoding as Text
 import Federator.Discovery
 import Federator.Error.ServerError (ServerError (..))
 import Federator.ExternalServer
-import Federator.Service (Service)
+import Federator.Service (Service (..), ServiceStreaming)
 import Federator.Validation
 import Imports
 import qualified Network.HTTP.Types as HTTP
@@ -35,18 +35,17 @@ import qualified Network.Wai.Utilities.Server as Wai
 import Polysemy
 import Polysemy.Error
 import Polysemy.Input
-import qualified Polysemy.TinyLog as TinyLog
+import Polysemy.Output
+import Polysemy.TinyLog
+import qualified Servant.Client.Core as Servant
+import Servant.Types.SourceT
 import Test.Federator.Options (noClientCertSettings)
 import Test.Federator.Util
 import Test.Federator.Validation (mockDiscoveryTrivial)
-import Test.Polysemy.Mock (Mock (mock), evalMock)
-import Test.Polysemy.Mock.TH (genMock)
 import Test.Tasty
 import Test.Tasty.HUnit
 import Wire.API.Federation.Component
 
-genMock ''Service
-
 tests :: TestTree
 tests =
   testGroup
@@ -72,59 +71,79 @@ exampleRequest certFile path = do
         trBody = "\"foo\""
       }
 
+data Call = Call
+  { cComponent :: Component,
+    cPath :: ByteString,
+    cBody :: LByteString,
+    cDomain :: Domain
+  }
+  deriving (Eq, Show)
+
+mockService ::
+  Members [Output Call, Embed IO] r =>
+  HTTP.Status ->
+  Sem (ServiceStreaming ': r) a ->
+  Sem r a
+mockService status = interpret $ \case
+  ServiceCall comp path body domain -> do
+    output (Call comp path body domain)
+    pure
+      Servant.Response
+        { Servant.responseStatusCode = status,
+          Servant.responseHeaders = mempty,
+          Servant.responseHttpVersion = HTTP.http11,
+          Servant.responseBody = source ["\"bar\""]
+        }
+
 requestBrigSuccess :: TestTree
 requestBrigSuccess =
-  testCase "should translate response from brig to 'InwardResponseBody' when response has status 200" $ do
+  testCase "should forward response from brig when status is 200" $ do
     request <-
       exampleRequest
         "test/resources/unit/localhost.example.com.pem"
         "/federation/brig/get-user-by-handle"
-    runM . evalMock @Service @IO $ do
-      mockServiceCallReturns @IO (\_ _ _ _ -> pure (HTTP.ok200, Just "\"bar\""))
-
-      res <-
-        mock @Service @IO
-          . assertNoError @ValidationError
-          . assertNoError @DiscoveryFailure
-          . assertNoError @ServerError
-          . TinyLog.discardLogs
-          . mockDiscoveryTrivial
-          . runInputConst noClientCertSettings
-          $ callInward request
-      actualCalls <- mockServiceCallCalls @IO
-      let expectedCall = (Brig, "/federation/get-user-by-handle", "\"foo\"", aValidDomain)
-      embed $ assertEqual "one call to brig should be made" [expectedCall] actualCalls
-      embed $ Wai.responseStatus res @?= HTTP.status200
-      body <- embed $ Wai.lazyResponseBody res
-      embed $ body @?= "\"bar\""
+    (actualCalls, res) <-
+      runM
+        . runOutputList
+        . mockService HTTP.ok200
+        . assertNoError @ValidationError
+        . assertNoError @DiscoveryFailure
+        . assertNoError @ServerError
+        . discardLogs
+        . mockDiscoveryTrivial
+        . runInputConst noClientCertSettings
+        $ callInward request
+    let expectedCall = Call Brig "/federation/get-user-by-handle" "\"foo\"" aValidDomain
+    assertEqual "one call to brig should be made" [expectedCall] actualCalls
+    Wai.responseStatus res @?= HTTP.status200
+    body <- Wai.lazyResponseBody res
+    body @?= "\"bar\""
 
 requestBrigFailure :: TestTree
 requestBrigFailure =
-  testCase "should translate response from brig to 'InwardResponseError' when response has status 404" $ do
+  testCase "should preserve the status code returned by the service" $ do
     request <-
       exampleRequest
         "test/resources/unit/localhost.example.com.pem"
         "/federation/brig/get-user-by-handle"
 
-    runM . evalMock @Service @IO $ do
-      let brigResponseBody = "response body"
-      mockServiceCallReturns @IO (\_ _ _ _ -> pure (HTTP.notFound404, Just brigResponseBody))
-      res <-
-        mock @Service @IO
-          . assertNoError @ValidationError
-          . assertNoError @DiscoveryFailure
-          . assertNoError @ServerError
-          . TinyLog.discardLogs
-          . mockDiscoveryTrivial
-          . runInputConst noClientCertSettings
-          $ callInward request
-
-      actualCalls <- mockServiceCallCalls @IO
-      let expectedCall = (Brig, "/federation/get-user-by-handle", "\"foo\"", aValidDomain)
-      embed $ assertEqual "one call to brig should be made" [expectedCall] actualCalls
-      embed $ Wai.responseStatus res @?= HTTP.notFound404
-      body <- embed $ Wai.lazyResponseBody res
-      embed $ body @?= brigResponseBody
+    (actualCalls, res) <-
+      runM
+        . runOutputList
+        . mockService HTTP.notFound404
+        . assertNoError @ValidationError
+        . assertNoError @DiscoveryFailure
+        . assertNoError @ServerError
+        . discardLogs
+        . mockDiscoveryTrivial
+        . runInputConst noClientCertSettings
+        $ callInward request
+
+    let expectedCall = Call Brig "/federation/get-user-by-handle" "\"foo\"" aValidDomain
+    assertEqual "one call to brig should be made" [expectedCall] actualCalls
+    Wai.responseStatus res @?= HTTP.notFound404
+    body <- Wai.lazyResponseBody res
+    body @?= "\"bar\""
 
 requestGalleySuccess :: TestTree
 requestGalleySuccess =
@@ -134,20 +153,18 @@ requestGalleySuccess =
         "test/resources/unit/localhost.example.com.pem"
         "/federation/galley/get-conversations"
 
-    runM . evalMock @Service @IO $ do
-      mockServiceCallReturns @IO (\_ _ _ _ -> pure (HTTP.ok200, Just "\"bar\""))
-
-      res <-
-        mock @Service @IO
+    runM $ do
+      (actualCalls, res) <-
+        runOutputList
+          . mockService HTTP.ok200
           . assertNoError @ValidationError
           . assertNoError @DiscoveryFailure
           . assertNoError @ServerError
-          . TinyLog.discardLogs
+          . discardLogs
           . mockDiscoveryTrivial
           . runInputConst noClientCertSettings
           $ callInward request
-      actualCalls <- mockServiceCallCalls @IO
-      let expectedCall = (Galley, "/federation/get-conversations", "\"foo\"", aValidDomain)
+      let expectedCall = Call Galley "/federation/get-conversations" "\"foo\"" aValidDomain
       embed $ assertEqual "one call to galley should be made" [expectedCall] actualCalls
       embed $ Wai.responseStatus res @?= HTTP.status200
       body <- embed $ Wai.lazyResponseBody res
@@ -164,20 +181,18 @@ requestNoDomain =
             trPath = "/federation/brig/get-users"
           }
 
-    runM . evalMock @Service @IO $ do
-      mockServiceCallReturns @IO (\_ _ _ _ -> pure (HTTP.ok200, Just "\"bar\""))
-
-      res <-
-        runError
-          . mock @Service @IO
+    runM $ do
+      (actualCalls, res) <-
+        runOutputList @Call
+          . mockService HTTP.ok200
+          . runError
           . assertNoError @ValidationError
           . assertNoError @DiscoveryFailure
-          . TinyLog.discardLogs
+          . discardLogs
           . mockDiscoveryTrivial
           . runInputConst noClientCertSettings
           $ callInward request
 
-      actualCalls <- mockServiceCallCalls @IO
       embed $ assertEqual "no calls to services should be made" [] actualCalls
       embed $ void res @?= Left NoOriginDomain
 
@@ -191,22 +206,20 @@ requestNoCertificate =
             trPath = "/federation/brig/get-users"
           }
 
-    runM . evalMock @Service @IO $ do
-      mockServiceCallReturns @IO (\_ _ _ _ -> pure (HTTP.ok200, Just "\"bar\""))
-
-      res <-
-        runError
-          . mock @Service @IO
-          . assertNoError @ServerError
-          . assertNoError @DiscoveryFailure
-          . TinyLog.discardLogs
-          . mockDiscoveryTrivial
-          . runInputConst noClientCertSettings
-          $ callInward request
-
-      actualCalls <- mockServiceCallCalls @IO
-      embed $ assertEqual "no calls to services should be made" [] actualCalls
-      embed $ void res @?= Left NoClientCertificate
+    (actualCalls, res) <-
+      runM
+        . runOutputList @Call
+        . mockService HTTP.ok200
+        . runError
+        . assertNoError @ServerError
+        . assertNoError @DiscoveryFailure
+        . discardLogs
+        . mockDiscoveryTrivial
+        . runInputConst noClientCertSettings
+        $ callInward request
+
+    assertEqual "no calls to services should be made" [] actualCalls
+    void res @?= Left NoClientCertificate
 
 testInvalidPaths :: TestTree
 testInvalidPaths = do
@@ -244,23 +257,20 @@ testInvalidPaths = do
           "test/resources/unit/localhost.example.com.pem"
           invalidPath
 
-      runM . evalMock @Service @IO $ do
-        mockServiceCallReturns @IO (\_ _ _ _ -> pure (HTTP.ok200, Just "\"bar\""))
-
-        res <-
-          runError @ServerError
-            . mock @Service @IO
-            . assertNoError @ValidationError
-            . assertNoError @DiscoveryFailure
-            . TinyLog.discardLogs
-            . mockDiscoveryTrivial
-            . runInputConst noClientCertSettings
-            $ callInward request
-
-        embed $ assertEqual ("Expected request with path \"" <> cs invalidPath <> "\" to fail") (Left InvalidRoute) (void res)
+      (actualCalls, res) <-
+        runM
+          . runOutputList @Call
+          . mockService HTTP.ok200
+          . runError @ServerError
+          . assertNoError @ValidationError
+          . assertNoError @DiscoveryFailure
+          . discardLogs
+          . mockDiscoveryTrivial
+          . runInputConst noClientCertSettings
+          $ callInward request
 
-        actualCalls <- mockServiceCallCalls @IO
-        embed $ assertEqual "no calls to any service should be made" [] actualCalls
+      assertEqual ("Expected request with path \"" <> cs invalidPath <> "\" to fail") (Left InvalidRoute) (void res)
+      assertEqual "no calls to any service should be made" [] actualCalls
 
 testInvalidComponent :: TestTree
 testInvalidComponent =
@@ -270,22 +280,20 @@ testInvalidComponent =
         "test/resources/unit/localhost.example.com.pem"
         "/federation/mast/get-users"
 
-    runM . evalMock @Service @IO $ do
-      mockServiceCallReturns @IO (\_ _ _ _ -> pure (HTTP.ok200, Just "\"bar\""))
-
-      res <-
-        runError @ServerError
-          . mock @Service @IO
-          . assertNoError @ValidationError
-          . assertNoError @DiscoveryFailure
-          . TinyLog.discardLogs
-          . mockDiscoveryTrivial
-          . runInputConst noClientCertSettings
-          $ callInward request
-
-      embed $ void res @?= Left (UnknownComponent "mast")
-      actualCalls <- mockServiceCallCalls @IO
-      embed $ assertEqual "no calls to any service should be made" [] actualCalls
+    (actualCalls, res) <-
+      runM
+        . runOutputList @Call
+        . mockService HTTP.ok200
+        . runError @ServerError
+        . assertNoError @ValidationError
+        . assertNoError @DiscoveryFailure
+        . discardLogs
+        . mockDiscoveryTrivial
+        . runInputConst noClientCertSettings
+        $ callInward request
+
+    void res @?= Left (UnknownComponent "mast")
+    assertEqual "no calls to any service should be made" [] actualCalls
 
 testMethod :: TestTree
 testMethod =
@@ -304,10 +312,10 @@ testMethod =
       res <-
         runM
           . runError @ServerError
-          . interpret @Service (\_ -> embed $ assertFailure "unexpected call to service")
+          . interpret @ServiceStreaming (\_ -> embed $ assertFailure "unexpected call to service")
           . assertNoError @ValidationError
           . assertNoError @DiscoveryFailure
-          . TinyLog.discardLogs
+          . discardLogs
           . mockDiscoveryTrivial
           . runInputConst noClientCertSettings
           $ callInward request
diff --git a/services/federator/test/unit/Test/Federator/InternalServer.hs b/services/federator/test/unit/Test/Federator/InternalServer.hs
index 3def6a2c2a9..db3393c5290 100644
--- a/services/federator/test/unit/Test/Federator/InternalServer.hs
+++ b/services/federator/test/unit/Test/Federator/InternalServer.hs
@@ -19,7 +19,7 @@
 
 module Test.Federator.InternalServer (tests) where
 
-import Data.Binary.Builder
+import Data.ByteString.Builder
 import Data.ByteString.Conversion
 import Data.Default
 import Data.Domain
@@ -36,6 +36,8 @@ import Polysemy
 import Polysemy.Error
 import Polysemy.Input
 import Polysemy.TinyLog
+import Servant.Client.Core
+import Servant.Types.SourceT
 import Test.Federator.Options (noClientCertSettings)
 import Test.Federator.Util
 import Test.Tasty
@@ -78,7 +80,13 @@ federatedRequestSuccess =
             rpc @?= "get-user-by-handle"
             headers @?= requestHeaders
             toLazyByteString body @?= "\"foo\""
-            pure (HTTP.status200, fromLazyByteString "\"bar\"")
+            pure
+              Response
+                { responseStatusCode = HTTP.ok200,
+                  responseHeaders = mempty,
+                  responseHttpVersion = HTTP.http20,
+                  responseBody = source ["\"bar\""]
+                }
     res <-
       runM
         . interpretCall
@@ -107,7 +115,14 @@ federatedRequestFailureAllowList =
 
     let checkRequest :: Sem (Remote ': r) a -> Sem r a
         checkRequest = interpret $ \case
-          DiscoverAndCall {} -> pure (HTTP.status200, fromLazyByteString "\"bar\"")
+          DiscoverAndCall {} ->
+            pure
+              Response
+                { responseStatusCode = HTTP.ok200,
+                  responseHeaders = mempty,
+                  responseHttpVersion = HTTP.http20,
+                  responseBody = source ["\"bar\""]
+                }
 
     eith <-
       runM
diff --git a/services/federator/test/unit/Test/Federator/Remote.hs b/services/federator/test/unit/Test/Federator/Remote.hs
index 66689a26291..ce13842fb9c 100644
--- a/services/federator/test/unit/Test/Federator/Remote.hs
+++ b/services/federator/test/unit/Test/Federator/Remote.hs
@@ -18,6 +18,7 @@
 module Test.Federator.Remote where
 
 import Control.Exception (bracket)
+import Control.Monad.Codensity
 import Data.Domain
 import Federator.Discovery
 import Federator.Env (TLSSettings)
@@ -31,6 +32,7 @@ import Network.Wai
 import qualified Network.Wai.Handler.Warp as Warp
 import qualified Network.Wai.Handler.WarpTLS as Warp
 import Polysemy
+import Polysemy.Embed
 import Polysemy.Error
 import Polysemy.Input
 import Test.Federator.Options (defRunSettings)
@@ -83,6 +85,7 @@ mkTestCall tlsSettings port =
     . runInputConst tlsSettings
     . discoverLocalhost port
     . assertNoError @DiscoveryFailure
+    . runEmbedded @(Codensity IO) @IO lowerCodensity
     . interpretRemote
     $ discoverAndCall (Domain "localhost") Brig "test" [] mempty
 
diff --git a/stack.yaml b/stack.yaml
index 12671354d5b..6081f77af12 100644
--- a/stack.yaml
+++ b/stack.yaml
@@ -161,7 +161,6 @@ extra-deps:
 - markov-chain-usage-model-0.0.0
 - wai-predicates-1.0.0
 - redis-io-1.1.0
-- polysemy-mocks-0.2.0.0
 - warp-3.3.17
 
 # Not latest as last one breaks wai-routing
@@ -208,10 +207,9 @@ extra-deps:
 - git: https://github.com/dpwright/HaskellNet-SSL
   commit: ca84ef29a93eaef7673fa58056cdd8dae1568d2d # master (Sep 14, 2020)
 
-# Fix for connection preface race condition
-# https://github.com/kazu-yamamoto/http2/pull/33
+# Fix for server sending too many empty data frames
 - git: https://github.com/wireapp/http2
-  commit: 1ee1ce432d923839dab6782410e91dc17df2a880 # preface-race branch
+  commit: aa3501ad58e1abbd196781fac25a84f41ec2a787 # avoid-empty-data branch
 
 # Fix in PR: https://github.com/bos/snappy/pull/7
 - git: https://github.com/wireapp/snappy
diff --git a/stack.yaml.lock b/stack.yaml.lock
index 6da7fa2060c..c9b4d4ccfc9 100644
--- a/stack.yaml.lock
+++ b/stack.yaml.lock
@@ -447,13 +447,6 @@ packages:
       sha256: db61f70aa7387090c26ccca0545ffdeea0adfcf93b76d5eaf6a954c0e5a34064
   original:
     hackage: redis-io-1.1.0
-- completed:
-    hackage: polysemy-mocks-0.2.0.0@sha256:ed7b4aa8ee29995d0b840ac0c131a141636ca46493b82706b7e5ec5e33b9ffa7,1441
-    pantry-tree:
-      size: 695
-      sha256: 8218e3dde278ca1f01d19009fad40f603e1b17993a519d15fe6319e3a827cc01
-  original:
-    hackage: polysemy-mocks-0.2.0.0
 - completed:
     hackage: warp-3.3.17@sha256:3a3ea203141d00d2244b511ee99174b8ed58fc862552755d470a25a44ce5275b,10910
     pantry-tree:
@@ -646,11 +639,11 @@ packages:
     git: https://github.com/wireapp/http2
     pantry-tree:
       size: 52771
-      sha256: dc6d3868a049d2ed38ef16ca6dd6aeb6b8e8a1e730c664ecdd243ffdb45ee750
-    commit: 1ee1ce432d923839dab6782410e91dc17df2a880
+      sha256: 71040c20c8e6a766b6b309c03dbc970062b15e450a63e05f8d095a87cdb5082f
+    commit: aa3501ad58e1abbd196781fac25a84f41ec2a787
   original:
     git: https://github.com/wireapp/http2
-    commit: 1ee1ce432d923839dab6782410e91dc17df2a880
+    commit: aa3501ad58e1abbd196781fac25a84f41ec2a787
 - completed:
     name: snappy
     version: 0.2.0.2

From 1e5cb90b24a61e39cc39696b9dda9336c5554b99 Mon Sep 17 00:00:00 2001
From: Stefan Matting <smatting@users.noreply.github.com>
Date: Tue, 14 Dec 2021 17:30:44 +0100
Subject: [PATCH 06/74] SFT chart: Add multiSFT option, remove additionalArgs
 option (#1992)

---
 changelog.d/5-internal/sftd-multi-sft  |  1 +
 charts/sftd/templates/statefulset.yaml | 57 +++++++++++++++++++++++++-
 charts/sftd/values.yaml                | 10 +++--
 3 files changed, 64 insertions(+), 4 deletions(-)
 create mode 100644 changelog.d/5-internal/sftd-multi-sft

diff --git a/changelog.d/5-internal/sftd-multi-sft b/changelog.d/5-internal/sftd-multi-sft
new file mode 100644
index 00000000000..a0324fe7496
--- /dev/null
+++ b/changelog.d/5-internal/sftd-multi-sft
@@ -0,0 +1 @@
+sftd chart: Add multiSFT option, remove additionalArgs option
diff --git a/charts/sftd/templates/statefulset.yaml b/charts/sftd/templates/statefulset.yaml
index 2c5d52fce40..8345b6bc1c1 100644
--- a/charts/sftd/templates/statefulset.yaml
+++ b/charts/sftd/templates/statefulset.yaml
@@ -30,10 +30,13 @@ spec:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
       terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
       hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
       serviceAccountName: {{ include "sftd.fullname" . }}
       volumes:
         - name: external-ip
           emptyDir: {}
+        - name: multi-sft-config
+          emptyDir: {}
       initContainers:
         - name: get-external-ip
           image: bitnami/kubectl:1.19.7
@@ -54,6 +57,47 @@ spec:
                 addr=$(kubectl get node $HOSTNAME -ojsonpath='{.metadata.annotations.wire\.com/external-ip}')
               fi
               echo -n "$addr" | tee /dev/stderr > /external-ip/ip
+        - name: get-multi-sft-config
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+
+          volumeMounts:
+            - name: multi-sft-config
+              mountPath: /multi-sft-config
+
+          command:
+            - /bin/sh
+            - -c
+            - |
+              set -e
+
+              {{- if .Values.multiSFT.enabled }}
+
+              response=$(curl "{{ .Values.multiSFT.turnDiscoveryURL }}")
+              if [ -z "$response" ]; then
+                 echo "No response from restund server."
+                 exit 1
+              fi
+
+              echo "$response" | jq -r '.username' > /multi-sft-config/username
+              if [ ! -s /multi-sft-config/username ]; then
+                echo "Response does not contain a username"
+                exit 1
+              fi
+
+              echo "$response" | jq -r '.password' > /multi-sft-config/password
+              if [ ! -s /multi-sft-config/password ]; then
+                echo "Response does not contain a password"
+                exit 1
+              fi
+
+              echo "$response" | jq -r '.uris[0]' > /multi-sft-config/turn_server
+              if [ ! -s /multi-sft-config/turn_server ]; then
+                echo "Response does not contain a turn server"
+                exit 1
+              fi
+
+              {{- end }}
+
       containers:
         - name: {{ .Chart.Name }}
           securityContext:
@@ -72,6 +116,8 @@ spec:
           volumeMounts:
             - name: external-ip
               mountPath: /external-ip
+            - name: multi-sft-config
+              mountPath: /multi-sft-config
           command:
             - /bin/sh
             - -c
@@ -83,11 +129,20 @@ spec:
               else
                 ACCESS_ARGS="-A ${EXTERNAL_IP}"
               fi
+
+              {{- if .Values.multiSFT.enabled }}
+              MULTI_SFT_ARGS="-t \"$(cat /multi-sft-config/turn_server)\" \
+              -x \"$(cat /multi-sft-config/username)\" \
+              -c \"$(cat /multi-sft-config/password)\""
+              {{- else }}
+              MULTI_SFT_ARGS=""
+              {{- end }}
+
               exec sftd \
                       -I "${POD_IP}" \
                       -M "${POD_IP}" \
                       ${ACCESS_ARGS} \
-                      {{ .Values.additionalArgs }} \
+                      ${MULTI_SFT_ARGS} \
                       {{ if .Values.turnDiscoveryEnabled }}-T{{ end }} \
                       -u "https://{{ required "must specify host" .Values.host }}/sfts/${POD_NAME}"
           ports:
diff --git a/charts/sftd/values.yaml b/charts/sftd/values.yaml
index a34ae175892..5e90388b66d 100644
--- a/charts/sftd/values.yaml
+++ b/charts/sftd/values.yaml
@@ -86,6 +86,10 @@ joinCall:
 # DOCS: https://docs.wire.com/understand/sft.html#prerequisites
 turnDiscoveryEnabled: false
 
-# Additional arguments to be passed to `sftd`
-# Note: this might be removed in the future.
-additionalArgs: ""
+# Allow establishing calls involving remote SFT servers (e.g. for Federation)
+# Requires appVersion 3.0.9 or later
+multiSFT:
+  enabled: False
+  # Required. URL that provides TURN connection configuration. These configured
+  # TURN servers will be used to connect to remote SFT servers.
+  turnDiscoveryURL: ""

From 7329d41726cee1b91ec1023ea98b972c6ca4c66b Mon Sep 17 00:00:00 2001
From: Sven Tennie <sven.tennie@wire.com>
Date: Tue, 14 Dec 2021 18:37:27 +0100
Subject: [PATCH 07/74] Add a paragraph about using VSCode in a direnv env

---
 docs/developer/editor-setup.md | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/docs/developer/editor-setup.md b/docs/developer/editor-setup.md
index 249529677d9..4e030f88b08 100644
--- a/docs/developer/editor-setup.md
+++ b/docs/developer/editor-setup.md
@@ -110,4 +110,8 @@ Setup steps:
 - Install the plugins `Haskell` (Haskell Language Server support), `Haskell Syntax` and `Nix Environment Selector`
 - Generate the `hie.yaml` file: `make hie.yaml`
 - Select the nix environment from `shell.nix` with the command `Nix-Env: Select environment`.
-- Reload the window as proposed by the `Nix Environment Selector` plugin
\ No newline at end of file
+- Reload the window as proposed by the `Nix Environment Selector` plugin
+
+An alternative way to make these dependencies accessible to VSCode is to start it in the `direnv` environment.
+I.e. from a shell that's current working directory is in the project. The drawbacks of this approach are 
+that it only works locally (not on a remote connection) and one VSCode process needs to be started per project.
\ No newline at end of file

From 70316ac5b3f3535a68c81773feaf0fb98308961b Mon Sep 17 00:00:00 2001
From: Paolo Capriotti <paolo@capriotti.io>
Date: Wed, 15 Dec 2021 13:29:30 +0100
Subject: [PATCH 08/74] Split cannon benchmarks and tests (#1986)

* Split cannon benchmarks and tests
---
 .../5-internal/split-cannon-benchmarks        |  1 +
 services/cannon/{test => bench}/Bench.hs      |  0
 services/cannon/bench/Main.hs                 | 24 ++++++++++++++
 services/cannon/cannon.cabal                  | 32 +++++++++++++++++--
 services/cannon/package.yaml                  | 22 +++++++++++++
 services/cannon/test/Main.hs                  |  4 +--
 6 files changed, 78 insertions(+), 5 deletions(-)
 create mode 100644 changelog.d/5-internal/split-cannon-benchmarks
 rename services/cannon/{test => bench}/Bench.hs (100%)
 create mode 100644 services/cannon/bench/Main.hs

diff --git a/changelog.d/5-internal/split-cannon-benchmarks b/changelog.d/5-internal/split-cannon-benchmarks
new file mode 100644
index 00000000000..2122a84d6b9
--- /dev/null
+++ b/changelog.d/5-internal/split-cannon-benchmarks
@@ -0,0 +1 @@
+Split cannon benchmarks and tests
diff --git a/services/cannon/test/Bench.hs b/services/cannon/bench/Bench.hs
similarity index 100%
rename from services/cannon/test/Bench.hs
rename to services/cannon/bench/Bench.hs
diff --git a/services/cannon/bench/Main.hs b/services/cannon/bench/Main.hs
new file mode 100644
index 00000000000..d019b98000f
--- /dev/null
+++ b/services/cannon/bench/Main.hs
@@ -0,0 +1,24 @@
+-- This file is part of the Wire Server implementation.
+--
+-- Copyright (C) 2021 Wire Swiss GmbH <opensource@wire.com>
+--
+-- This program is free software: you can redistribute it and/or modify it under
+-- the terms of the GNU Affero General Public License as published by the Free
+-- Software Foundation, either version 3 of the License, or (at your option) any
+-- later version.
+--
+-- This program is distributed in the hope that it will be useful, but WITHOUT
+-- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+-- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+-- details.
+--
+-- You should have received a copy of the GNU Affero General Public License along
+-- with this program. If not, see <https://www.gnu.org/licenses/>.
+
+module Main where
+
+import Bench
+import Imports
+
+main :: IO ()
+main = benchmark
diff --git a/services/cannon/cannon.cabal b/services/cannon/cannon.cabal
index 56f3ef1f40f..e91a0617087 100644
--- a/services/cannon/cannon.cabal
+++ b/services/cannon/cannon.cabal
@@ -4,7 +4,7 @@ cabal-version: 1.12
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 6c53d0a25079c3947f669ee6cf4a32b3e9a9472db9050997e478fc8fdb7b3858
+-- hash: 87d683d193f2ad916c72f4c84d0816911f7d894cfbffed36f361436005571339
 
 name:           cannon
 version:        0.31.0
@@ -100,7 +100,6 @@ test-suite cannon-tests
   type: exitcode-stdio-1.0
   main-is: Main.hs
   other-modules:
-      Bench
       Test.Cannon.Dict
       Paths_cannon
   hs-source-dirs:
@@ -125,3 +124,32 @@ test-suite cannon-tests
     , uuid
     , wai-utilities
   default-language: Haskell2010
+
+benchmark cannon-bench
+  type: exitcode-stdio-1.0
+  main-is: Main.hs
+  other-modules:
+      Bench
+      Paths_cannon
+  hs-source-dirs:
+      bench
+  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded -with-rtsopts=-N
+  build-depends:
+      QuickCheck >=2.7
+    , async
+    , base
+    , bytestring
+    , cannon
+    , criterion >=1.0
+    , extended
+    , imports
+    , metrics-wai
+    , random >=1.0
+    , tasty >=0.8
+    , tasty-hunit >=0.8
+    , tasty-quickcheck >=0.8
+    , types-common
+    , uuid
+    , wai-utilities
+  default-language: Haskell2010
diff --git a/services/cannon/package.yaml b/services/cannon/package.yaml
index 91148258420..c71d26a72b1 100644
--- a/services/cannon/package.yaml
+++ b/services/cannon/package.yaml
@@ -88,6 +88,28 @@ tests:
     - types-common
     - uuid
     - wai-utilities
+benchmarks:
+  cannon-bench:
+    main: Main.hs
+    source-dirs: bench
+    ghc-options:
+    - -threaded
+    - -with-rtsopts=-N
+    dependencies:
+    - async
+    - base
+    - bytestring
+    - cannon
+    - criterion >=1.0
+    - metrics-wai
+    - QuickCheck >=2.7
+    - random >=1.0
+    - tasty >=0.8
+    - tasty-hunit >=0.8
+    - tasty-quickcheck >=0.8
+    - types-common
+    - uuid
+    - wai-utilities
 flags:
   static:
     description: Enable static linking
diff --git a/services/cannon/test/Main.hs b/services/cannon/test/Main.hs
index eb09db312c9..75517337702 100644
--- a/services/cannon/test/Main.hs
+++ b/services/cannon/test/Main.hs
@@ -17,7 +17,6 @@
 
 module Main where
 
-import qualified Bench as B
 import qualified Cannon.API
 import Data.Metrics.Test (pathsConsistencyCheck)
 import Data.Metrics.WaiRoute (treeToPaths)
@@ -28,8 +27,7 @@ import Test.Tasty
 import Test.Tasty.HUnit
 
 main :: IO ()
-main = do
-  B.benchmark
+main =
   defaultMain $
     testGroup
       "Tests"

From 215d34d9cd3174df5571684fc72438561b05de1d Mon Sep 17 00:00:00 2001
From: Leif Battermann <leif.battermann@gmail.com>
Date: Wed, 15 Dec 2021 15:36:23 +0100
Subject: [PATCH 09/74] Move Integration Test BSI Tags to Top (#1996)

* Moved integration test BSI tags to top
* More descriptive test names
---
 services/galley/test/integration/API.hs | 58 ++++++++++++-------------
 1 file changed, 29 insertions(+), 29 deletions(-)

diff --git a/services/galley/test/integration/API.hs b/services/galley/test/integration/API.hs
index 801d020109d..0186f3448d8 100644
--- a/services/galley/test/integration/API.hs
+++ b/services/galley/test/integration/API.hs
@@ -199,11 +199,11 @@ tests s =
           test s "conversation receipt mode update with remote members" putReceiptModeWithRemotesOk,
           test s "send typing indicators" postTypingIndicators,
           test s "leave connect conversation" leaveConnectConversation,
-          test s "post conversations/:cnv/otr/message: message delivery and missing clients" postCryptoMessage1,
-          test s "post conversations/:cnv/otr/message: mismatch and prekey fetching" postCryptoMessage2,
-          test s "post conversations/:cnv/otr/message: mismatch with protobuf" postCryptoMessage3,
-          test s "post conversations/:cnv/otr/message: unknown sender client" postCryptoMessage4,
-          test s "post conversations/:cnv/otr/message: ignore_missing and report_missing" postCryptoMessage5,
+          test s "post conversations/:cnv/otr/message: message delivery and missing clients" postCryptoMessageVerifyMsgSentAndRejectIfMissingClient,
+          test s "post conversations/:cnv/otr/message: mismatch and prekey fetching" postCryptoMessageVerifyRejectMissingClientAndRepondMissingPrekeysJson,
+          test s "post conversations/:cnv/otr/message: mismatch with protobuf" postCryptoMessageVerifyRejectMissingClientAndRepondMissingPrekeysProto,
+          test s "post conversations/:cnv/otr/message: unknown sender client" postCryptoMessageNotAuthorizeUnknownClient,
+          test s "post conversations/:cnv/otr/message: ignore_missing and report_missing" postCryptoMessageVerifyCorrectResponseIfIgnoreAndReportMissingQueryParam,
           test s "post message qualified - local owning backend - success" postMessageQualifiedLocalOwningBackendSuccess,
           test s "post message qualified - local owning backend - missing clients" postMessageQualifiedLocalOwningBackendMissingClients,
           test s "post message qualified - local owning backend - redundant and deleted clients" postMessageQualifiedLocalOwningBackendRedundantAndDeletedClients,
@@ -366,11 +366,11 @@ postConvWithRemoteUsersOk = do
         EdConversation c' -> assertConvEquals cnv c'
         _ -> assertFailure "Unexpected event data"
 
--- | This test verifies whether a message actually gets sent all the way to
--- cannon.
 -- @SF.Separation @TSFI.RESTfulAPI @S2
-postCryptoMessage1 :: TestM ()
-postCryptoMessage1 = do
+-- This test verifies whether a message actually gets sent all the way to
+-- cannon.
+postCryptoMessageVerifyMsgSentAndRejectIfMissingClient :: TestM ()
+postCryptoMessageVerifyMsgSentAndRejectIfMissingClient = do
   localDomain <- viewFederationDomain
   c <- view tsCannon
   (alice, ac) <- randomUserWithClient (someLastPrekeys !! 0)
@@ -452,10 +452,10 @@ postCryptoMessage1 = do
       liftIO $ assertBool "unexpected equal clients" (bc /= bc2)
       assertNoMsg wsB2 (wsAssertOtr qconv qalice ac bc cipher)
 
--- | This test verifies basic mismatch behaviour of the the JSON endpoint.
 -- @SF.Separation @TSFI.RESTfulAPI @S2
-postCryptoMessage2 :: TestM ()
-postCryptoMessage2 = do
+-- This test verifies basic mismatch behavior of the the JSON endpoint.
+postCryptoMessageVerifyRejectMissingClientAndRepondMissingPrekeysJson :: TestM ()
+postCryptoMessageVerifyRejectMissingClientAndRepondMissingPrekeysJson = do
   b <- view tsBrig
   (alice, ac) <- randomUserWithClient (someLastPrekeys !! 0)
   (bob, bc) <- randomUserWithClient (someLastPrekeys !! 1)
@@ -478,10 +478,10 @@ postCryptoMessage2 = do
     Map.keys (userClientMap (getUserClientPrekeyMap p)) @=? [eve]
     Map.keys <$> Map.lookup eve (userClientMap (getUserClientPrekeyMap p)) @=? Just [ec]
 
--- | This test verifies basic mismatch behaviour of the protobuf endpoint.
 -- @SF.Separation @TSFI.RESTfulAPI @S2
-postCryptoMessage3 :: TestM ()
-postCryptoMessage3 = do
+-- This test verifies basic mismatch behaviour of the protobuf endpoint.
+postCryptoMessageVerifyRejectMissingClientAndRepondMissingPrekeysProto :: TestM ()
+postCryptoMessageVerifyRejectMissingClientAndRepondMissingPrekeysProto = do
   b <- view tsBrig
   (alice, ac) <- randomUserWithClient (someLastPrekeys !! 0)
   (bob, bc) <- randomUserWithClient (someLastPrekeys !! 1)
@@ -508,8 +508,8 @@ postCryptoMessage3 = do
 
 -- | This test verifies behaviour when an unknown client posts the message. Only
 -- tests the Protobuf endpoint.
-postCryptoMessage4 :: TestM ()
-postCryptoMessage4 = do
+postCryptoMessageNotAuthorizeUnknownClient :: TestM ()
+postCryptoMessageNotAuthorizeUnknownClient = do
   alice <- randomUser
   bob <- randomUser
   bc <- randomClient bob (someLastPrekeys !! 0)
@@ -521,10 +521,10 @@ postCryptoMessage4 = do
   postProtoOtrMessage alice (ClientId "172618352518396") conv m
     !!! const 403 === statusCode
 
--- | This test verifies the following scenario.
+-- @SF.Separation @TSFI.RESTfulAPI @S2
+-- This test verifies the following scenario.
 -- A client sends a message to all clients of a group and one more who is not part of the group.
 -- The server must not send this message to client ids not part of the group.
--- @SF.Separation @TSFI.RESTfulAPI @S2
 postMessageClientNotInGroupDoesNotReceiveMsg :: TestM ()
 postMessageClientNotInGroupDoesNotReceiveMsg = do
   localDomain <- viewFederationDomain
@@ -547,9 +547,9 @@ postMessageClientNotInGroupDoesNotReceiveMsg = do
     checkEveGetsMsg
     checkChadDoesNotGetMsg
 
--- | This test verifies that when a client sends a message not to all clients of a group then the server should reject the message and sent a notification to the sender (412 Missing clients).
--- The test is somewhat redundant because this is already tested as part of other tests already. This is a stand alone test that solely tests the behavior described above.
 -- @SF.Separation @TSFI.RESTfulAPI @S2
+-- This test verifies that when a client sends a message not to all clients of a group then the server should reject the message and sent a notification to the sender (412 Missing clients).
+-- The test is somewhat redundant because this is already tested as part of other tests already. This is a stand alone test that solely tests the behavior described above.
 postMessageRejectIfMissingClients :: TestM ()
 postMessageRejectIfMissingClients = do
   (sender, senderClient) : allReceivers <- randomUserWithClient `traverse` someLastPrekeys
@@ -575,11 +575,11 @@ postMessageRejectIfMissingClients = do
     mkMsg :: ByteString -> (UserId, ClientId) -> (UserId, ClientId, Text)
     mkMsg text (userId, clientId) = (userId, clientId, toBase64Text text)
 
--- | This test verifies behaviour under various values of ignore_missing and
--- report_missing. Only tests the JSON endpoint.
 -- @SF.Separation @TSFI.RESTfulAPI @S2
-postCryptoMessage5 :: TestM ()
-postCryptoMessage5 = do
+-- This test verifies behaviour under various values of ignore_missing and
+-- report_missing. Only tests the JSON endpoint.
+postCryptoMessageVerifyCorrectResponseIfIgnoreAndReportMissingQueryParam :: TestM ()
+postCryptoMessageVerifyCorrectResponseIfIgnoreAndReportMissingQueryParam = do
   (alice, ac) <- randomUserWithClient (someLastPrekeys !! 0)
   (bob, bc) <- randomUserWithClient (someLastPrekeys !! 1)
   (chad, cc) <- randomUserWithClient (someLastPrekeys !! 2)
@@ -766,10 +766,10 @@ postMessageQualifiedLocalOwningBackendSuccess = do
       WS.assertMatch_ t wsAlex2 (wsAssertOtr' encodedData convId alice aliceClient alexClient2 encodedTextForAlex2)
       WS.assertMatch_ t wsAmy (wsAssertOtr' encodedData convId alice aliceClient amyClient encodedTextForAmy)
 
--- | Sets up a conversation on Backend A known as "owning backend". One of the
+-- @SF.Separation @TSFI.RESTfulAPI @S2
+-- Sets up a conversation on Backend A known as "owning backend". One of the
 -- users from Backend A will send the message but have a missing client. It is
 -- expected that the message will not be sent.
--- @SF.Separation @TSFI.RESTfulAPI @S2
 postMessageQualifiedLocalOwningBackendMissingClients :: TestM ()
 postMessageQualifiedLocalOwningBackendMissingClients = do
   -- Cannon for local users
@@ -925,11 +925,11 @@ postMessageQualifiedLocalOwningBackendRedundantAndDeletedClients = do
       -- Wait less for no message
       WS.assertNoEvent (1 # Second) [wsNonMember]
 
--- | Sets up a conversation on Backend A known as "owning backend". One of the
+-- @SF.Separation @TSFI.RESTfulAPI @S2
+-- Sets up a conversation on Backend A known as "owning backend". One of the
 -- users from Backend A will send the message but have a missing client. It is
 -- expected that the message will be sent except when it is specifically
 -- requested to report on missing clients of a user.
--- @SF.Separation @TSFI.RESTfulAPI @S2
 postMessageQualifiedLocalOwningBackendIgnoreMissingClients :: TestM ()
 postMessageQualifiedLocalOwningBackendIgnoreMissingClients = do
   -- WS receive timeout

From f15892e44b2a0e06dbad9e585abb59b72a6ffc57 Mon Sep 17 00:00:00 2001
From: Paolo Capriotti <paolo@capriotti.io>
Date: Wed, 15 Dec 2021 15:42:01 +0100
Subject: [PATCH 10/74] Remove resumable upload API (#1998)

---
 .../1-api-changes/remove-resumable-uploads    |   1 +
 libs/cargohold-types/cargohold-types.cabal    |   3 +-
 .../src/CargoHold/Types/V3/Resumable.hs       |  36 --
 libs/wire-api/src/Wire/API/Asset.hs           |   1 -
 .../src/Wire/API/Asset/V3/Resumable.hs        | 141 ------
 .../golden/Test/Wire/API/Golden/Generated.hs  |  29 --
 .../API/Golden/Generated/ChunkSize_user.hs    |  24 -
 .../Wire/API/Golden/Generated/Offset_user.hs  |  22 -
 .../Golden/Generated/ResumableAsset_user.hs   |  46 --
 .../Generated/ResumableSettings_user.hs       |  54 ---
 .../API/Golden/Generated/TotalSize_user.hs    |  24 -
 .../golden/Test/Wire/API/Golden/Generator.hs  |   6 -
 .../golden/testObject_ChunkSize_user_1.json   |   1 -
 .../test/golden/testObject_Offset_user_1.json |   1 -
 .../testObject_ResumableAsset_user_1.json     |   9 -
 .../testObject_ResumableSettings_user_1.json  |   5 -
 .../testObject_ResumableSettings_user_17.json |   5 -
 .../testObject_ResumableSettings_user_2.json  |   5 -
 .../testObject_ResumableSettings_user_4.json  |   5 -
 .../testObject_ResumableSettings_user_5.json  |   5 -
 .../golden/testObject_TotalSize_user_1.json   |   1 -
 .../unit/Test/Wire/API/Roundtrip/Aeson.hs     |   6 -
 .../Test/Wire/API/Roundtrip/ByteString.hs     |   4 -
 libs/wire-api/wire-api.cabal                  |   8 +-
 services/cargohold/cargohold.cabal            |   4 +-
 services/cargohold/src/CargoHold/API/Error.hs |  27 --
 .../cargohold/src/CargoHold/API/Public.hs     |  64 +--
 .../src/CargoHold/API/V3/Resumable.hs         | 149 ------
 services/cargohold/src/CargoHold/S3.hs        | 459 ------------------
 services/cargohold/src/CargoHold/TUS.hs       |  89 ----
 services/cargohold/test/integration/API/V3.hs | 171 +------
 31 files changed, 10 insertions(+), 1395 deletions(-)
 create mode 100644 changelog.d/1-api-changes/remove-resumable-uploads
 delete mode 100644 libs/cargohold-types/src/CargoHold/Types/V3/Resumable.hs
 delete mode 100644 libs/wire-api/src/Wire/API/Asset/V3/Resumable.hs
 delete mode 100644 libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/ChunkSize_user.hs
 delete mode 100644 libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/Offset_user.hs
 delete mode 100644 libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/ResumableAsset_user.hs
 delete mode 100644 libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/ResumableSettings_user.hs
 delete mode 100644 libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/TotalSize_user.hs
 delete mode 100644 libs/wire-api/test/golden/testObject_ChunkSize_user_1.json
 delete mode 100644 libs/wire-api/test/golden/testObject_Offset_user_1.json
 delete mode 100644 libs/wire-api/test/golden/testObject_ResumableAsset_user_1.json
 delete mode 100644 libs/wire-api/test/golden/testObject_ResumableSettings_user_1.json
 delete mode 100644 libs/wire-api/test/golden/testObject_ResumableSettings_user_17.json
 delete mode 100644 libs/wire-api/test/golden/testObject_ResumableSettings_user_2.json
 delete mode 100644 libs/wire-api/test/golden/testObject_ResumableSettings_user_4.json
 delete mode 100644 libs/wire-api/test/golden/testObject_ResumableSettings_user_5.json
 delete mode 100644 libs/wire-api/test/golden/testObject_TotalSize_user_1.json
 delete mode 100644 services/cargohold/src/CargoHold/API/V3/Resumable.hs
 delete mode 100644 services/cargohold/src/CargoHold/TUS.hs

diff --git a/changelog.d/1-api-changes/remove-resumable-uploads b/changelog.d/1-api-changes/remove-resumable-uploads
new file mode 100644
index 00000000000..a73bc51b5bc
--- /dev/null
+++ b/changelog.d/1-api-changes/remove-resumable-uploads
@@ -0,0 +1 @@
+Remove resumable upload API
diff --git a/libs/cargohold-types/cargohold-types.cabal b/libs/cargohold-types/cargohold-types.cabal
index 6626e3dd6f5..05263ea04d9 100644
--- a/libs/cargohold-types/cargohold-types.cabal
+++ b/libs/cargohold-types/cargohold-types.cabal
@@ -4,7 +4,7 @@ cabal-version: 1.12
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 6e7a4ce0ec22392573f2b2764073d89b1096322eff38e0af765761e6bb2257a2
+-- hash: 33860dd6b7263a9496b0ffc60303472a71fc9da43168c9cd017f6c2eb626faa3
 
 name:           cargohold-types
 version:        1.5.0
@@ -21,7 +21,6 @@ library
   exposed-modules:
       CargoHold.Types
       CargoHold.Types.V3
-      CargoHold.Types.V3.Resumable
   other-modules:
       Paths_cargohold_types
   hs-source-dirs:
diff --git a/libs/cargohold-types/src/CargoHold/Types/V3/Resumable.hs b/libs/cargohold-types/src/CargoHold/Types/V3/Resumable.hs
deleted file mode 100644
index f84ac4bdf08..00000000000
--- a/libs/cargohold-types/src/CargoHold/Types/V3/Resumable.hs
+++ /dev/null
@@ -1,36 +0,0 @@
--- This file is part of the Wire Server implementation.
---
--- Copyright (C) 2020 Wire Swiss GmbH <opensource@wire.com>
---
--- This program is free software: you can redistribute it and/or modify it under
--- the terms of the GNU Affero General Public License as published by the Free
--- Software Foundation, either version 3 of the License, or (at your option) any
--- later version.
---
--- This program is distributed in the hope that it will be useful, but WITHOUT
--- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
--- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
--- details.
---
--- You should have received a copy of the GNU Affero General Public License along
--- with this program. If not, see <https://www.gnu.org/licenses/>.
-
-module CargoHold.Types.V3.Resumable
-  ( -- * re-exports
-    ResumableSettings,
-    mkResumableSettings,
-    setResumableType,
-    setResumablePublic,
-    setResumableRetention,
-    ResumableAsset,
-    TotalSize (..),
-    ChunkSize (..),
-    Offset (..),
-    mkResumableAsset,
-    resumableAsset,
-    resumableExpires,
-    resumableChunkSize,
-  )
-where
-
-import Wire.API.Asset.V3.Resumable
diff --git a/libs/wire-api/src/Wire/API/Asset.hs b/libs/wire-api/src/Wire/API/Asset.hs
index 544dca0df52..94522eba44e 100644
--- a/libs/wire-api/src/Wire/API/Asset.hs
+++ b/libs/wire-api/src/Wire/API/Asset.hs
@@ -21,4 +21,3 @@ module Wire.API.Asset
 where
 
 import Wire.API.Asset.V3 as V3
-import Wire.API.Asset.V3.Resumable as V3
diff --git a/libs/wire-api/src/Wire/API/Asset/V3/Resumable.hs b/libs/wire-api/src/Wire/API/Asset/V3/Resumable.hs
deleted file mode 100644
index 60e23ed9a32..00000000000
--- a/libs/wire-api/src/Wire/API/Asset/V3/Resumable.hs
+++ /dev/null
@@ -1,141 +0,0 @@
-{-# LANGUAGE GeneralizedNewtypeDeriving #-}
-{-# LANGUAGE StrictData #-}
-{-# LANGUAGE TemplateHaskell #-}
-
--- This file is part of the Wire Server implementation.
---
--- Copyright (C) 2020 Wire Swiss GmbH <opensource@wire.com>
---
--- This program is free software: you can redistribute it and/or modify it under
--- the terms of the GNU Affero General Public License as published by the Free
--- Software Foundation, either version 3 of the License, or (at your option) any
--- later version.
---
--- This program is distributed in the hope that it will be useful, but WITHOUT
--- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
--- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
--- details.
---
--- You should have received a copy of the GNU Affero General Public License along
--- with this program. If not, see <https://www.gnu.org/licenses/>.
-
-module Wire.API.Asset.V3.Resumable
-  ( -- * ResumableSettings
-    ResumableSettings,
-    mkResumableSettings,
-    setResumableType,
-    setResumablePublic,
-    setResumableRetention,
-
-    -- * ResumableAsset
-    ResumableAsset,
-    mkResumableAsset,
-    TotalSize (..),
-    ChunkSize (..),
-    Offset (..),
-    resumableAsset,
-    resumableExpires,
-    resumableChunkSize,
-  )
-where
-
-import qualified Codec.MIME.Parse as MIME
-import qualified Codec.MIME.Type as MIME
-import Control.Lens (makeLenses)
-import Data.Aeson
-import Data.Aeson.Types
-import Data.ByteString.Conversion
-import Data.Json.Util (UTCTimeMillis (fromUTCTimeMillis), toUTCTimeMillis, (#))
-import Data.Time.Clock
-import Imports
-import Wire.API.Arbitrary (Arbitrary (..), GenericUniform (..))
-import Wire.API.Asset.V3
-
---------------------------------------------------------------------------------
--- ResumableSettings
-
--- | Settings for initiating a resumable upload.
-data ResumableSettings = ResumableSettings
-  { _setResumableRetention :: AssetRetention,
-    _setResumablePublic :: Bool,
-    _setResumableType :: MIME.Type
-  }
-  deriving stock (Eq, Show, Generic)
-  deriving (Arbitrary) via (GenericUniform ResumableSettings)
-
-makeLenses ''ResumableSettings
-
-mkResumableSettings :: AssetRetention -> Bool -> MIME.Type -> ResumableSettings
-mkResumableSettings = ResumableSettings
-
-instance ToJSON ResumableSettings where
-  toJSON (ResumableSettings ret pub typ) =
-    object $
-      "retention" .= ret
-        # "type" .= MIME.showType typ
-        # "public" .= pub
-        # []
-
-instance FromJSON ResumableSettings where
-  parseJSON = withObject "ResumableSettings" $ \o ->
-    ResumableSettings
-      <$> o .:? "retention" .!= AssetPersistent
-      <*> o .:? "public" .!= False
-      <*> (parseMime =<< o .: "type")
-
-parseMime :: Text -> Parser MIME.Type
-parseMime v =
-  maybe
-    (fail "Invalid MIME type")
-    return
-    (MIME.parseMIMEType v)
-
---------------------------------------------------------------------------------
--- ResumableAsset
-
-newtype TotalSize = TotalSize
-  {totalSizeBytes :: Word}
-  deriving stock (Eq, Ord, Show)
-  deriving newtype (Enum, Num, Real, Integral, FromJSON, ToJSON, FromByteString, ToByteString, Arbitrary)
-
-newtype ChunkSize = ChunkSize
-  {chunkSizeBytes :: Word}
-  deriving stock (Eq, Ord, Show)
-  deriving newtype (Enum, Num, Real, Integral, FromJSON, ToJSON, FromByteString, ToByteString, Arbitrary)
-
-newtype Offset = Offset
-  {offsetBytes :: Word}
-  deriving stock (Eq, Ord, Show)
-  deriving newtype (Enum, Num, Real, Integral, FromJSON, ToJSON, FromByteString, ToByteString, Arbitrary)
-
-data ResumableAsset = ResumableAsset
-  { _resumableAsset :: Asset,
-    _resumableExpires :: UTCTime,
-    _resumableChunkSize :: ChunkSize
-  }
-  deriving stock (Eq, Show, Generic)
-
-instance Arbitrary ResumableAsset where
-  arbitrary = ResumableAsset <$> arbitrary <*> (milli <$> arbitrary) <*> arbitrary
-    where
-      milli = fromUTCTimeMillis . toUTCTimeMillis
-
-makeLenses ''ResumableAsset
-
-mkResumableAsset :: Asset -> UTCTime -> ChunkSize -> ResumableAsset
-mkResumableAsset = ResumableAsset
-
-instance ToJSON ResumableAsset where
-  toJSON r =
-    object $
-      "asset" .= _resumableAsset r
-        # "expires" .= toUTCTimeMillis (_resumableExpires r)
-        # "chunk_size" .= _resumableChunkSize r
-        # []
-
-instance FromJSON ResumableAsset where
-  parseJSON = withObject "ResumableAsset" $ \o ->
-    ResumableAsset
-      <$> o .: "asset"
-      <*> o .: "expires"
-      <*> o .: "chunk_size"
diff --git a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated.hs b/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated.hs
index 7eacbb74d24..f4a5dff0652 100644
--- a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated.hs
+++ b/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated.hs
@@ -42,7 +42,6 @@ import qualified Test.Wire.API.Golden.Generated.BindingNewTeam_team
 import qualified Test.Wire.API.Golden.Generated.BotConvView_provider
 import qualified Test.Wire.API.Golden.Generated.BotUserView_provider
 import qualified Test.Wire.API.Golden.Generated.CheckHandles_user
-import qualified Test.Wire.API.Golden.Generated.ChunkSize_user
 import qualified Test.Wire.API.Golden.Generated.ClientClass_user
 import qualified Test.Wire.API.Golden.Generated.ClientMismatch_user
 import qualified Test.Wire.API.Golden.Generated.ClientPrekey_user
@@ -127,7 +126,6 @@ import qualified Test.Wire.API.Golden.Generated.NewService_provider
 import qualified Test.Wire.API.Golden.Generated.NewTeamMember_team
 import qualified Test.Wire.API.Golden.Generated.NewUserPublic_user
 import qualified Test.Wire.API.Golden.Generated.NewUser_user
-import qualified Test.Wire.API.Golden.Generated.Offset_user
 import qualified Test.Wire.API.Golden.Generated.OtherMemberUpdate_user
 import qualified Test.Wire.API.Golden.Generated.OtherMember_user
 import qualified Test.Wire.API.Golden.Generated.OtrMessage_user
@@ -166,8 +164,6 @@ import qualified Test.Wire.API.Golden.Generated.RemoveBotResponse_user
 import qualified Test.Wire.API.Golden.Generated.RemoveCookies_user
 import qualified Test.Wire.API.Golden.Generated.RemoveLegalHoldSettingsRequest_team
 import qualified Test.Wire.API.Golden.Generated.RequestNewLegalHoldClient_team
-import qualified Test.Wire.API.Golden.Generated.ResumableAsset_user
-import qualified Test.Wire.API.Golden.Generated.ResumableSettings_user
 import qualified Test.Wire.API.Golden.Generated.RichField_user
 import qualified Test.Wire.API.Golden.Generated.RichInfoAssocList_user
 import qualified Test.Wire.API.Golden.Generated.RichInfoMapAndList_user
@@ -212,7 +208,6 @@ import qualified Test.Wire.API.Golden.Generated.TeamUpdateData_team
 import qualified Test.Wire.API.Golden.Generated.Team_team
 import qualified Test.Wire.API.Golden.Generated.TokenType_user
 import qualified Test.Wire.API.Golden.Generated.Token_user
-import qualified Test.Wire.API.Golden.Generated.TotalSize_user
 import qualified Test.Wire.API.Golden.Generated.Transport_user
 import qualified Test.Wire.API.Golden.Generated.TurnHost_user
 import qualified Test.Wire.API.Golden.Generated.TurnURI_user
@@ -293,30 +288,6 @@ tests =
             (Test.Wire.API.Golden.Generated.AssetKey_user.testObject_AssetKey_user_4, "testObject_AssetKey_user_4.json"),
             (Test.Wire.API.Golden.Generated.AssetKey_user.testObject_AssetKey_user_5, "testObject_AssetKey_user_5.json")
           ],
-      testGroup "Golden: ResumableSettings_user" $
-        testObjects
-          [ (Test.Wire.API.Golden.Generated.ResumableSettings_user.testObject_ResumableSettings_user_1, "testObject_ResumableSettings_user_1.json"),
-            (Test.Wire.API.Golden.Generated.ResumableSettings_user.testObject_ResumableSettings_user_2, "testObject_ResumableSettings_user_2.json"),
-            (Test.Wire.API.Golden.Generated.ResumableSettings_user.testObject_ResumableSettings_user_4, "testObject_ResumableSettings_user_4.json"),
-            (Test.Wire.API.Golden.Generated.ResumableSettings_user.testObject_ResumableSettings_user_5, "testObject_ResumableSettings_user_5.json"),
-            (Test.Wire.API.Golden.Generated.ResumableSettings_user.testObject_ResumableSettings_user_17, "testObject_ResumableSettings_user_17.json")
-          ],
-      testGroup "Golden: TotalSize_user" $
-        testObjects
-          [ (Test.Wire.API.Golden.Generated.TotalSize_user.testObject_TotalSize_user_1, "testObject_TotalSize_user_1.json")
-          ],
-      testGroup "Golden: ChunkSize_user" $
-        testObjects
-          [ (Test.Wire.API.Golden.Generated.ChunkSize_user.testObject_ChunkSize_user_1, "testObject_ChunkSize_user_1.json")
-          ],
-      testGroup "Golden: Offset_user" $
-        testObjects
-          [ (Test.Wire.API.Golden.Generated.Offset_user.testObject_Offset_user_1, "testObject_Offset_user_1.json")
-          ],
-      testGroup "Golden: ResumableAsset_user" $
-        testObjects
-          [ (Test.Wire.API.Golden.Generated.ResumableAsset_user.testObject_ResumableAsset_user_1, "testObject_ResumableAsset_user_1.json")
-          ],
       testGroup "Golden: TurnHost_user" $
         testObjects
           [ (Test.Wire.API.Golden.Generated.TurnHost_user.testObject_TurnHost_user_1, "testObject_TurnHost_user_1.json"),
diff --git a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/ChunkSize_user.hs b/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/ChunkSize_user.hs
deleted file mode 100644
index c12c6163d29..00000000000
--- a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/ChunkSize_user.hs
+++ /dev/null
@@ -1,24 +0,0 @@
-{-# LANGUAGE OverloadedLists #-}
-
--- This file is part of the Wire Server implementation.
---
--- Copyright (C) 2021 Wire Swiss GmbH <opensource@wire.com>
---
--- This program is free software: you can redistribute it and/or modify it under
--- the terms of the GNU Affero General Public License as published by the Free
--- Software Foundation, either version 3 of the License, or (at your option) any
--- later version.
---
--- This program is distributed in the hope that it will be useful, but WITHOUT
--- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
--- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
--- details.
---
--- You should have received a copy of the GNU Affero General Public License along
--- with this program. If not, see <https://www.gnu.org/licenses/>.
-module Test.Wire.API.Golden.Generated.ChunkSize_user where
-
-import Wire.API.Asset (ChunkSize (..))
-
-testObject_ChunkSize_user_1 :: ChunkSize
-testObject_ChunkSize_user_1 = ChunkSize {chunkSizeBytes = 17}
diff --git a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/Offset_user.hs b/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/Offset_user.hs
deleted file mode 100644
index b6aa293045a..00000000000
--- a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/Offset_user.hs
+++ /dev/null
@@ -1,22 +0,0 @@
--- This file is part of the Wire Server implementation.
---
--- Copyright (C) 2021 Wire Swiss GmbH <opensource@wire.com>
---
--- This program is free software: you can redistribute it and/or modify it under
--- the terms of the GNU Affero General Public License as published by the Free
--- Software Foundation, either version 3 of the License, or (at your option) any
--- later version.
---
--- This program is distributed in the hope that it will be useful, but WITHOUT
--- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
--- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
--- details.
---
--- You should have received a copy of the GNU Affero General Public License along
--- with this program. If not, see <https://www.gnu.org/licenses/>.
-module Test.Wire.API.Golden.Generated.Offset_user where
-
-import Wire.API.Asset (Offset (..))
-
-testObject_Offset_user_1 :: Offset
-testObject_Offset_user_1 = Offset {offsetBytes = 1}
diff --git a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/ResumableAsset_user.hs b/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/ResumableAsset_user.hs
deleted file mode 100644
index 98798a95470..00000000000
--- a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/ResumableAsset_user.hs
+++ /dev/null
@@ -1,46 +0,0 @@
--- This file is part of the Wire Server implementation.
---
--- Copyright (C) 2021 Wire Swiss GmbH <opensource@wire.com>
---
--- This program is free software: you can redistribute it and/or modify it under
--- the terms of the GNU Affero General Public License as published by the Free
--- Software Foundation, either version 3 of the License, or (at your option) any
--- later version.
---
--- This program is distributed in the hope that it will be useful, but WITHOUT
--- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
--- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
--- details.
---
--- You should have received a copy of the GNU Affero General Public License along
--- with this program. If not, see <https://www.gnu.org/licenses/>.
-module Test.Wire.API.Golden.Generated.ResumableAsset_user where
-
-import Control.Lens ((.~), (?~))
-import Data.Id (Id (Id))
-import Data.Text.Ascii (AsciiChars (validate))
-import qualified Data.UUID as UUID (fromString)
-import Imports (Functor (fmap), Maybe (Just), fromJust, fromRight, read, undefined, (&))
-import Wire.API.Asset
-  ( AssetKey (AssetKeyV3),
-    AssetRetention
-      ( AssetExpiring
-      ),
-    AssetToken (AssetToken, assetTokenAscii),
-    ChunkSize (ChunkSize, chunkSizeBytes),
-    ResumableAsset,
-    assetExpires,
-    assetToken,
-    mkAsset,
-    mkResumableAsset,
-  )
-
-testObject_ResumableAsset_user_1 :: ResumableAsset
-testObject_ResumableAsset_user_1 =
-  mkResumableAsset
-    ( mkAsset (AssetKeyV3 (Id (fromJust (UUID.fromString "00000010-0000-0008-0000-004300000006"))) AssetExpiring)
-        & assetExpires .~ fmap read (Just "1864-04-13 11:37:47.393 UTC")
-        & assetToken ?~ (AssetToken {assetTokenAscii = fromRight undefined (validate "5A==")})
-    )
-    (read "1864-04-09 06:01:25.576 UTC")
-    (ChunkSize {chunkSizeBytes = 17})
diff --git a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/ResumableSettings_user.hs b/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/ResumableSettings_user.hs
deleted file mode 100644
index 3c82024710f..00000000000
--- a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/ResumableSettings_user.hs
+++ /dev/null
@@ -1,54 +0,0 @@
-{-# LANGUAGE OverloadedLists #-}
-
--- This file is part of the Wire Server implementation.
---
--- Copyright (C) 2021 Wire Swiss GmbH <opensource@wire.com>
---
--- This program is free software: you can redistribute it and/or modify it under
--- the terms of the GNU Affero General Public License as published by the Free
--- Software Foundation, either version 3 of the License, or (at your option) any
--- later version.
---
--- This program is distributed in the hope that it will be useful, but WITHOUT
--- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
--- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
--- details.
---
--- You should have received a copy of the GNU Affero General Public License along
--- with this program. If not, see <https://www.gnu.org/licenses/>.
-module Test.Wire.API.Golden.Generated.ResumableSettings_user where
-
-import Codec.MIME.Type (Type (..))
-import qualified Codec.MIME.Type as MIME (MIMEType (Image))
-import Imports (Bool (False, True))
-import Wire.API.Asset
-  ( AssetRetention
-      ( AssetEternal,
-        AssetEternalInfrequentAccess,
-        AssetExpiring,
-        AssetPersistent,
-        AssetVolatile
-      ),
-    ResumableSettings,
-    mkResumableSettings,
-  )
-
-testObject_ResumableSettings_user_1 :: ResumableSettings
-testObject_ResumableSettings_user_1 =
-  mkResumableSettings AssetExpiring False (Type {mimeType = MIME.Image "png", mimeParams = []})
-
-testObject_ResumableSettings_user_2 :: ResumableSettings
-testObject_ResumableSettings_user_2 =
-  mkResumableSettings AssetEternal True (Type {mimeType = MIME.Image "png", mimeParams = []})
-
-testObject_ResumableSettings_user_4 :: ResumableSettings
-testObject_ResumableSettings_user_4 =
-  mkResumableSettings AssetEternalInfrequentAccess True (Type {mimeType = MIME.Image "png", mimeParams = []})
-
-testObject_ResumableSettings_user_5 :: ResumableSettings
-testObject_ResumableSettings_user_5 =
-  mkResumableSettings AssetPersistent False (Type {mimeType = MIME.Image "png", mimeParams = []})
-
-testObject_ResumableSettings_user_17 :: ResumableSettings
-testObject_ResumableSettings_user_17 =
-  mkResumableSettings AssetVolatile True (Type {mimeType = MIME.Image "png", mimeParams = []})
diff --git a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/TotalSize_user.hs b/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/TotalSize_user.hs
deleted file mode 100644
index d60539a5593..00000000000
--- a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/TotalSize_user.hs
+++ /dev/null
@@ -1,24 +0,0 @@
-{-# LANGUAGE OverloadedLists #-}
-
--- This file is part of the Wire Server implementation.
---
--- Copyright (C) 2021 Wire Swiss GmbH <opensource@wire.com>
---
--- This program is free software: you can redistribute it and/or modify it under
--- the terms of the GNU Affero General Public License as published by the Free
--- Software Foundation, either version 3 of the License, or (at your option) any
--- later version.
---
--- This program is distributed in the hope that it will be useful, but WITHOUT
--- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
--- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
--- details.
---
--- You should have received a copy of the GNU Affero General Public License along
--- with this program. If not, see <https://www.gnu.org/licenses/>.
-module Test.Wire.API.Golden.Generated.TotalSize_user where
-
-import Wire.API.Asset (TotalSize (..))
-
-testObject_TotalSize_user_1 :: TotalSize
-testObject_TotalSize_user_1 = TotalSize {totalSizeBytes = 9}
diff --git a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generator.hs b/libs/wire-api/test/golden/Test/Wire/API/Golden/Generator.hs
index e4daf3da24b..db70e032203 100644
--- a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generator.hs
+++ b/libs/wire-api/test/golden/Test/Wire/API/Golden/Generator.hs
@@ -23,7 +23,6 @@ import System.IO (Handle, hPutStr, hPutStrLn, openFile)
 import Test.Tasty.QuickCheck (Arbitrary (..), generate)
 import Type.Reflection (typeRep)
 import qualified Wire.API.Asset as Asset
-import qualified Wire.API.Asset.V3.Resumable as Asset.Resumable
 import qualified Wire.API.Call.Config as Call.Config
 import qualified Wire.API.Connection as Connection
 import qualified Wire.API.Conversation as Conversation
@@ -136,11 +135,6 @@ generateTestModule = do
   generateBindingModule @Asset.AssetRetention "user" ref
   generateBindingModule @Asset.AssetSettings "user" ref
   generateBindingModule @Asset.AssetKey "user" ref
-  generateBindingModule @Asset.Resumable.ResumableSettings "user" ref
-  generateBindingModule @Asset.Resumable.TotalSize "user" ref
-  generateBindingModule @Asset.Resumable.ChunkSize "user" ref
-  generateBindingModule @Asset.Resumable.Offset "user" ref
-  generateBindingModule @Asset.Resumable.ResumableAsset "user" ref
   generateBindingModule @Call.Config.TurnHost "user" ref
   generateBindingModule @Call.Config.Scheme "user" ref
   generateBindingModule @Call.Config.Transport "user" ref
diff --git a/libs/wire-api/test/golden/testObject_ChunkSize_user_1.json b/libs/wire-api/test/golden/testObject_ChunkSize_user_1.json
deleted file mode 100644
index 98d9bcb75a6..00000000000
--- a/libs/wire-api/test/golden/testObject_ChunkSize_user_1.json
+++ /dev/null
@@ -1 +0,0 @@
-17
diff --git a/libs/wire-api/test/golden/testObject_Offset_user_1.json b/libs/wire-api/test/golden/testObject_Offset_user_1.json
deleted file mode 100644
index d00491fd7e5..00000000000
--- a/libs/wire-api/test/golden/testObject_Offset_user_1.json
+++ /dev/null
@@ -1 +0,0 @@
-1
diff --git a/libs/wire-api/test/golden/testObject_ResumableAsset_user_1.json b/libs/wire-api/test/golden/testObject_ResumableAsset_user_1.json
deleted file mode 100644
index b31ce6ad354..00000000000
--- a/libs/wire-api/test/golden/testObject_ResumableAsset_user_1.json
+++ /dev/null
@@ -1,9 +0,0 @@
-{
-    "asset": {
-        "expires": "1864-04-13T11:37:47.393Z",
-        "key": "3-5-00000010-0000-0008-0000-004300000006",
-        "token": "5A=="
-    },
-    "chunk_size": 17,
-    "expires": "1864-04-09T06:01:25.576Z"
-}
diff --git a/libs/wire-api/test/golden/testObject_ResumableSettings_user_1.json b/libs/wire-api/test/golden/testObject_ResumableSettings_user_1.json
deleted file mode 100644
index 6fe2dd17d1f..00000000000
--- a/libs/wire-api/test/golden/testObject_ResumableSettings_user_1.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-    "public": false,
-    "retention": "expiring",
-    "type": "image/png"
-}
diff --git a/libs/wire-api/test/golden/testObject_ResumableSettings_user_17.json b/libs/wire-api/test/golden/testObject_ResumableSettings_user_17.json
deleted file mode 100644
index 462ed70e3eb..00000000000
--- a/libs/wire-api/test/golden/testObject_ResumableSettings_user_17.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-    "public": true,
-    "retention": "volatile",
-    "type": "image/png"
-}
diff --git a/libs/wire-api/test/golden/testObject_ResumableSettings_user_2.json b/libs/wire-api/test/golden/testObject_ResumableSettings_user_2.json
deleted file mode 100644
index 8223d85e2dd..00000000000
--- a/libs/wire-api/test/golden/testObject_ResumableSettings_user_2.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-    "public": true,
-    "retention": "eternal",
-    "type": "image/png"
-}
diff --git a/libs/wire-api/test/golden/testObject_ResumableSettings_user_4.json b/libs/wire-api/test/golden/testObject_ResumableSettings_user_4.json
deleted file mode 100644
index 7b059d3d67e..00000000000
--- a/libs/wire-api/test/golden/testObject_ResumableSettings_user_4.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-    "public": true,
-    "retention": "eternal-infrequent_access",
-    "type": "image/png"
-}
diff --git a/libs/wire-api/test/golden/testObject_ResumableSettings_user_5.json b/libs/wire-api/test/golden/testObject_ResumableSettings_user_5.json
deleted file mode 100644
index 13648db881b..00000000000
--- a/libs/wire-api/test/golden/testObject_ResumableSettings_user_5.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-    "public": false,
-    "retention": "persistent",
-    "type": "image/png"
-}
diff --git a/libs/wire-api/test/golden/testObject_TotalSize_user_1.json b/libs/wire-api/test/golden/testObject_TotalSize_user_1.json
deleted file mode 100644
index ec635144f60..00000000000
--- a/libs/wire-api/test/golden/testObject_TotalSize_user_1.json
+++ /dev/null
@@ -1 +0,0 @@
-9
diff --git a/libs/wire-api/test/unit/Test/Wire/API/Roundtrip/Aeson.hs b/libs/wire-api/test/unit/Test/Wire/API/Roundtrip/Aeson.hs
index 2b10b608d54..a3d5e85f7e8 100644
--- a/libs/wire-api/test/unit/Test/Wire/API/Roundtrip/Aeson.hs
+++ b/libs/wire-api/test/unit/Test/Wire/API/Roundtrip/Aeson.hs
@@ -26,7 +26,6 @@ import qualified Test.Tasty as T
 import Test.Tasty.QuickCheck (Arbitrary, counterexample, testProperty, (.&&.), (===))
 import Type.Reflection (typeRep)
 import qualified Wire.API.Asset as Asset
-import qualified Wire.API.Asset.V3.Resumable as Asset.Resumable
 import qualified Wire.API.Call.Config as Call.Config
 import qualified Wire.API.Connection as Connection
 import qualified Wire.API.Conversation as Conversation
@@ -81,11 +80,6 @@ tests =
       testRoundTrip @Asset.AssetSettings,
       testRoundTrip @Asset.AssetKey,
       testRoundTrip @Asset.Asset,
-      testRoundTrip @Asset.Resumable.ResumableSettings,
-      testRoundTrip @Asset.Resumable.TotalSize,
-      testRoundTrip @Asset.Resumable.ChunkSize,
-      testRoundTrip @Asset.Resumable.Offset,
-      testRoundTrip @Asset.Resumable.ResumableAsset,
       testRoundTrip @Call.Config.TurnHost,
       testRoundTrip @Call.Config.Scheme,
       testRoundTrip @Call.Config.Transport,
diff --git a/libs/wire-api/test/unit/Test/Wire/API/Roundtrip/ByteString.hs b/libs/wire-api/test/unit/Test/Wire/API/Roundtrip/ByteString.hs
index 58a2e1c27b5..05cb4d975d0 100644
--- a/libs/wire-api/test/unit/Test/Wire/API/Roundtrip/ByteString.hs
+++ b/libs/wire-api/test/unit/Test/Wire/API/Roundtrip/ByteString.hs
@@ -24,7 +24,6 @@ import Test.Tasty.QuickCheck (Arbitrary, counterexample, testProperty, (===))
 import Type.Reflection (typeRep)
 import qualified Wire.API.Arbitrary as Arbitrary ()
 import qualified Wire.API.Asset.V3 as Asset.V3
-import qualified Wire.API.Asset.V3.Resumable as Asset.V3.Resumable
 import qualified Wire.API.Call.Config as Call.Config
 import qualified Wire.API.Conversation.Code as Conversation.Code
 import qualified Wire.API.Conversation.Role as Conversation.Role
@@ -50,9 +49,6 @@ tests =
     [ testRoundTrip @Asset.V3.AssetKey,
       testRoundTrip @Asset.V3.AssetRetention,
       testRoundTrip @Asset.V3.AssetToken,
-      testRoundTrip @Asset.V3.Resumable.ChunkSize,
-      testRoundTrip @Asset.V3.Resumable.Offset,
-      testRoundTrip @Asset.V3.Resumable.TotalSize,
       testRoundTrip @Call.Config.Scheme,
       testRoundTrip @Call.Config.Transport,
       testRoundTrip @Call.Config.TurnHost,
diff --git a/libs/wire-api/wire-api.cabal b/libs/wire-api/wire-api.cabal
index ccb35be4219..6d643e1c4d8 100644
--- a/libs/wire-api/wire-api.cabal
+++ b/libs/wire-api/wire-api.cabal
@@ -4,7 +4,7 @@ cabal-version: 1.12
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: fff87c53181cb0f2cd21a3da254e2a9a5dbae2ee00ea67ac124be1593a640e5e
+-- hash: bcda0d57293162140cc50d149ad068df7975f9526cf1621c7aa4f753b45e36a6
 
 name:           wire-api
 version:        0.1.0
@@ -22,7 +22,6 @@ library
       Wire.API.Arbitrary
       Wire.API.Asset
       Wire.API.Asset.V3
-      Wire.API.Asset.V3.Resumable
       Wire.API.Call.Config
       Wire.API.Connection
       Wire.API.Conversation
@@ -204,7 +203,6 @@ test-suite wire-api-golden-tests
       Test.Wire.API.Golden.Generated.BotConvView_provider
       Test.Wire.API.Golden.Generated.BotUserView_provider
       Test.Wire.API.Golden.Generated.CheckHandles_user
-      Test.Wire.API.Golden.Generated.ChunkSize_user
       Test.Wire.API.Golden.Generated.Client_user
       Test.Wire.API.Golden.Generated.ClientClass_user
       Test.Wire.API.Golden.Generated.ClientMismatch_user
@@ -289,7 +287,6 @@ test-suite wire-api-golden-tests
       Test.Wire.API.Golden.Generated.NewTeamMember_team
       Test.Wire.API.Golden.Generated.NewUser_user
       Test.Wire.API.Golden.Generated.NewUserPublic_user
-      Test.Wire.API.Golden.Generated.Offset_user
       Test.Wire.API.Golden.Generated.OtherMember_user
       Test.Wire.API.Golden.Generated.OtherMemberUpdate_user
       Test.Wire.API.Golden.Generated.OtrMessage_user
@@ -327,8 +324,6 @@ test-suite wire-api-golden-tests
       Test.Wire.API.Golden.Generated.RemoveCookies_user
       Test.Wire.API.Golden.Generated.RemoveLegalHoldSettingsRequest_team
       Test.Wire.API.Golden.Generated.RequestNewLegalHoldClient_team
-      Test.Wire.API.Golden.Generated.ResumableAsset_user
-      Test.Wire.API.Golden.Generated.ResumableSettings_user
       Test.Wire.API.Golden.Generated.RichField_user
       Test.Wire.API.Golden.Generated.RichInfo_user
       Test.Wire.API.Golden.Generated.RichInfoAssocList_user
@@ -375,7 +370,6 @@ test-suite wire-api-golden-tests
       Test.Wire.API.Golden.Generated.TeamUpdateData_team
       Test.Wire.API.Golden.Generated.Token_user
       Test.Wire.API.Golden.Generated.TokenType_user
-      Test.Wire.API.Golden.Generated.TotalSize_user
       Test.Wire.API.Golden.Generated.Transport_user
       Test.Wire.API.Golden.Generated.TurnHost_user
       Test.Wire.API.Golden.Generated.TurnURI_user
diff --git a/services/cargohold/cargohold.cabal b/services/cargohold/cargohold.cabal
index dd689436f55..94c6b8635f6 100644
--- a/services/cargohold/cargohold.cabal
+++ b/services/cargohold/cargohold.cabal
@@ -4,7 +4,7 @@ cabal-version: 1.12
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 43240dbac626b3b23a6c7631367cc8c708e417b55fa7b007b4a58885878f8911
+-- hash: e1d35804687900338efb4ea42019d902f778d6b03ea61e3e8a1d3e0fcba0115e
 
 name:           cargohold
 version:        1.5.0
@@ -31,7 +31,6 @@ library
       CargoHold.API.Legacy
       CargoHold.API.Public
       CargoHold.API.V3
-      CargoHold.API.V3.Resumable
       CargoHold.App
       CargoHold.AWS
       CargoHold.CloudFront
@@ -39,7 +38,6 @@ library
       CargoHold.Options
       CargoHold.Run
       CargoHold.S3
-      CargoHold.TUS
       CargoHold.Util
       Main
   other-modules:
diff --git a/services/cargohold/src/CargoHold/API/Error.hs b/services/cargohold/src/CargoHold/API/Error.hs
index d8be728e837..bffd8ba433c 100644
--- a/services/cargohold/src/CargoHold/API/Error.hs
+++ b/services/cargohold/src/CargoHold/API/Error.hs
@@ -17,9 +17,6 @@
 
 module CargoHold.API.Error where
 
-import CargoHold.Types.V3.Resumable (Offset, TotalSize)
-import Data.Text.Lazy.Builder
-import Data.Text.Lazy.Builder.Int
 import Imports
 import Network.HTTP.Types.Status
 import Network.Wai.Utilities.Error
@@ -48,18 +45,6 @@ requestTimeout =
     \but none was sent over an extended period of time. Idle connections \
     \will be closed."
 
-invalidOffset :: Offset -> Offset -> Error
-invalidOffset expected given =
-  mkError status409 "invalid-offset" $
-    toLazyText $
-      "Invalid offset: "
-        <> "expected: "
-        <> decimal expected
-        <> ", "
-        <> "given: "
-        <> decimal given
-        <> "."
-
 uploadTooSmall :: Error
 uploadTooSmall =
   mkError
@@ -76,18 +61,6 @@ uploadTooLarge =
     "The current chunk size + offset \
     \is larger than the full upload size."
 
-uploadIncomplete :: TotalSize -> TotalSize -> Error
-uploadIncomplete expected actual =
-  mkError status403 "client-error" $
-    toLazyText $
-      "The upload is incomplete: "
-        <> "expected size: "
-        <> decimal expected
-        <> ", "
-        <> "current size: "
-        <> decimal actual
-        <> "."
-
 clientError :: LText -> Error
 clientError = mkError status400 "client-error"
 
diff --git a/services/cargohold/src/CargoHold/API/Public.hs b/services/cargohold/src/CargoHold/API/Public.hs
index 0d141ad808c..b2b4660e5be 100644
--- a/services/cargohold/src/CargoHold/API/Public.hs
+++ b/services/cargohold/src/CargoHold/API/Public.hs
@@ -24,13 +24,10 @@ where
 import qualified CargoHold.API.Error as Error
 import qualified CargoHold.API.Legacy as LegacyAPI
 import qualified CargoHold.API.V3 as V3
-import qualified CargoHold.API.V3.Resumable as Resumable
 import CargoHold.App
-import CargoHold.Options
-import qualified CargoHold.TUS as TUS
 import qualified CargoHold.Types.V3 as V3 (Principal (..))
 import Control.Error
-import Control.Lens (view, (^.))
+import Control.Lens ((^.))
 import Data.ByteString.Conversion
 import Data.Id
 import Data.Predicate
@@ -49,6 +46,9 @@ import Network.Wai.Utilities.ZAuth
 import URI.ByteString
 import qualified Wire.API.Asset as Public
 
+-- FUTUREWORK: restore (and servantify) resumable upload functionality, removed
+-- in https://github.com/wireapp/wire-server/pull/1998
+
 sitemap :: Routes Doc.ApiBuilder Handler ()
 sitemap = do
   ---------------------------------------------------------------------------
@@ -67,35 +67,6 @@ sitemap = do
     Doc.errorResponse Error.invalidLength
     Doc.response 201 "Asset posted" Doc.end
 
-  --- Resumable (multi-step) Upload
-
-  -- TODO: swagger doc
-  options "/assets/v3/resumable" (continue resumableOptionsV3) $
-    header "Z-User"
-
-  -- TODO (Compliance): Require and check Tus-Resumable header
-  -- against supported version(s).
-  post "/assets/v3/resumable" (continue createResumableV3) $
-    header "Z-User"
-      .&. header "Upload-Length"
-      .&. jsonRequest @Public.ResumableSettings
-
-  -- TODO (Compliance): Require and check Tus-Resumable header
-  -- against supported version(s).
-  head "/assets/v3/resumable/:key" (continue statusResumableV3) $
-    header "Z-User"
-      .&. capture "key"
-
-  -- TODO (Compliance): Require and check Tus-Resumable header
-  -- against supported version(s).
-  patch "/assets/v3/resumable/:key" (continue uploadResumableV3) $
-    header "Z-User"
-      .&. header "Upload-Offset"
-      .&. header "Content-Length"
-      .&. contentType "application" "offset+octet-stream"
-      .&. capture "key"
-      .&. request
-
   --- Download
 
   get "/assets/v3/:key" (continue downloadAssetV3) $
@@ -245,33 +216,6 @@ deleteTokenV3 (usr ::: key) = do
   V3.deleteToken (V3.UserPrincipal usr) key
   return empty
 
-resumableOptionsV3 :: UserId -> Handler Response
-resumableOptionsV3 _ = do
-  maxTotal <- view (settings . setMaxTotalBytes)
-  return $ TUS.optionsResponse (fromIntegral maxTotal) empty
-
-createResumableV3 :: UserId ::: Public.TotalSize ::: JsonRequest Public.ResumableSettings -> Handler Response
-createResumableV3 (u ::: size ::: req) = do
-  sets <- parseBody req !>> Error.clientError
-  res <- Resumable.create (V3.UserPrincipal u) sets size
-  let key = res ^. Public.resumableAsset . Public.assetKey
-  let expiry = res ^. Public.resumableExpires
-  let loc = "/assets/v3/resumable/" <> toByteString' key
-  return . TUS.createdResponse loc expiry $ json (res :: Public.ResumableAsset)
-
-statusResumableV3 :: UserId ::: Public.AssetKey -> Handler Response
-statusResumableV3 (u ::: a) = do
-  stat <- Resumable.status (V3.UserPrincipal u) a
-  return $ case stat of
-    Nothing -> setStatus status404 empty
-    Just st -> TUS.headResponse st empty
-
--- Request = raw bytestring
-uploadResumableV3 :: UserId ::: Public.Offset ::: Word ::: Media "application" "offset+octet-stream" ::: Public.AssetKey ::: Request -> Handler Response
-uploadResumableV3 (usr ::: offset ::: size ::: _ ::: aid ::: req) = do
-  (offset', expiry) <- Resumable.upload (V3.UserPrincipal usr) aid offset size (sourceRequestBody req)
-  return $ TUS.patchResponse offset' expiry empty
-
 --------------------------------------------------------------------------------
 -- Provider API Handlers
 
diff --git a/services/cargohold/src/CargoHold/API/V3/Resumable.hs b/services/cargohold/src/CargoHold/API/V3/Resumable.hs
deleted file mode 100644
index 878842375b4..00000000000
--- a/services/cargohold/src/CargoHold/API/V3/Resumable.hs
+++ /dev/null
@@ -1,149 +0,0 @@
--- This file is part of the Wire Server implementation.
---
--- Copyright (C) 2020 Wire Swiss GmbH <opensource@wire.com>
---
--- This program is free software: you can redistribute it and/or modify it under
--- the terms of the GNU Affero General Public License as published by the Free
--- Software Foundation, either version 3 of the License, or (at your option) any
--- later version.
---
--- This program is distributed in the hope that it will be useful, but WITHOUT
--- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
--- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
--- details.
---
--- You should have received a copy of the GNU Affero General Public License along
--- with this program. If not, see <https://www.gnu.org/licenses/>.
-
-module CargoHold.API.V3.Resumable
-  ( create,
-    status,
-    upload,
-  )
-where
-
-import qualified CargoHold.API.Error as Error
-import CargoHold.API.V3 (randToken)
-import CargoHold.App
-import CargoHold.Options
-import qualified CargoHold.S3 as S3
-import CargoHold.Types.V3 as V3
-import CargoHold.Types.V3.Resumable as V3
-import Control.Error (throwE)
-import Control.Lens (set, view)
-import Data.ByteString.Conversion
-import Data.Coerce
-import Data.Conduit
-import Data.Id
-import Data.Time.Clock
-import Data.UUID.V4 (nextRandom)
-import Imports
-import System.Logger.Class (field, msg, val, (~~))
-import qualified System.Logger.Class as Log
-
-create :: V3.Principal -> V3.ResumableSettings -> V3.TotalSize -> Handler V3.ResumableAsset
-create own sets size = do
-  let cl = fromIntegral size
-  when (cl <= 0) $
-    throwE Error.invalidLength
-  maxTotalBytes <- view (settings . setMaxTotalBytes)
-  when (cl > maxTotalBytes) $
-    throwE Error.assetTooLarge
-  aid <- liftIO $ Id <$> nextRandom
-  tok <-
-    if view setResumablePublic sets
-      then return Nothing
-      else Just <$> randToken
-  let ret = view setResumableRetention sets
-  let typ = view setResumableType sets
-  let key = V3.AssetKeyV3 aid ret
-  astExpire <- case V3.assetRetentionSeconds ret of
-    Just n -> Just . addUTCTime n <$> liftIO getCurrentTime
-    Nothing -> return Nothing
-  Log.debug $
-    field "asset" (toByteString aid)
-      ~~ field "asset.size" (toByteString size)
-      ~~ msg (val "Initialising resumable upload")
-  r <- S3.createResumable key own typ size tok
-  let chunkSize = S3.resumableChunkSize r
-  let uplExpire = S3.resumableExpires r
-  let ast =
-        V3.mkAsset key
-          & set V3.assetExpires astExpire
-          & set V3.assetToken tok
-  return $! mkResumableAsset ast uplExpire chunkSize
-
-status :: V3.Principal -> AssetKey -> Handler (Maybe (V3.Offset, V3.TotalSize))
-status own key = do
-  Log.debug $
-    field "asset" (toByteString key)
-      ~~ msg (val "Getting status of resumable upload")
-  r <- getResumable key
-  return $
-    if own /= S3.resumableOwner r
-      then Nothing
-      else
-        let total = S3.resumableTotalSize r
-            offset = S3.resumableOffset r
-         in Just (offset, total)
-
-upload :: V3.Principal -> AssetKey -> Offset -> Word -> ConduitM () ByteString IO () -> Handler (Offset, UTCTime)
-upload own key off len src = do
-  r <- getResumable key
-  let offset = S3.resumableOffset r
-  validate r offset
-  if off == Offset (totalSize r)
-    then complete r
-    else resume r offset
-  where
-    complete r = do
-      fin <- S3.getMetadataV3 key
-      unless (isJust fin) $
-        S3.completeResumable r
-      return (off, S3.resumableExpires r)
-    resume r offset = do
-      Log.debug $
-        field "asset" (toByteString key)
-          ~~ field "asset.offset" (toByteString offset)
-          ~~ msg (val "Resuming upload")
-      (r', offset') <- consume r offset len (sealConduitT src)
-      when (offset' == Offset (totalSize r')) $
-        -- TODO: Completion might take a while, such that we may need to
-        -- keep the client connection alive by sending whitespace after the
-        -- response status line and headers but before the final response body,
-        -- just like S3 does when completing multipart uploads.
-        S3.completeResumable r'
-      return (offset', S3.resumableExpires r')
-    consume r offset 0 _ = return (r, offset)
-    consume r offset remaining rsrc = do
-      let totalBytes = V3.totalSizeBytes (S3.resumableTotalSize r)
-      let numBytes = min (chunkSize r) remaining
-      if numBytes < chunkSize r && coerce offset + remaining < totalBytes
-        then -- Remaining input that is not a full chunk size and does
-        -- not constitute the last chunk is ignored, i.e. all chunks
-        -- except the last must have the same size (the chunk size).
-          return (r, offset)
-        else do
-          (r', rsrc') <- S3.uploadChunk r offset rsrc
-          let offset' = offset + Offset numBytes
-          let remaining' = remaining - numBytes
-          consume r' offset' remaining' rsrc'
-    validate r o
-      | invalidOwner r = throwE Error.assetNotFound
-      | invalidOffset o = throwE (Error.invalidOffset o off)
-      | tooSmall r o = throwE Error.uploadTooSmall
-      | tooLarge r = throwE Error.uploadTooLarge
-      | otherwise = return ()
-    invalidOwner r = own /= S3.resumableOwner r
-    invalidOffset o = o /= off
-    tooSmall r o = len < chunkSize r && missingBytes r o > chunkSize r
-    tooLarge r = proposedBytes > S3.resumableTotalSize r
-    chunkSize = chunkSizeBytes . S3.resumableChunkSize
-    totalSize = totalSizeBytes . S3.resumableTotalSize
-    missingBytes r o = totalSize r - V3.offsetBytes o
-    proposedBytes = V3.TotalSize (V3.offsetBytes off + len)
-
-getResumable :: AssetKey -> Handler S3.S3Resumable
-getResumable key = do
-  rs <- S3.getResumable key
-  maybe (throwE Error.assetNotFound) return rs
diff --git a/services/cargohold/src/CargoHold/S3.hs b/services/cargohold/src/CargoHold/S3.hs
index c71220e9beb..7ad9c43a038 100644
--- a/services/cargohold/src/CargoHold/S3.hs
+++ b/services/cargohold/src/CargoHold/S3.hs
@@ -28,19 +28,6 @@ module CargoHold.S3
     deleteV3,
     mkKey,
     signedURL,
-
-    -- * Resumable Uploads
-    S3Resumable,
-    resumableOwner,
-    resumableTotalSize,
-    resumableExpires,
-    resumableChunkSize,
-    resumableOffset,
-    createResumable,
-    getResumable,
-    completeResumable,
-    S3Chunk,
-    uploadChunk,
     -- Legacy
     plainKey,
     otrKey,
@@ -54,23 +41,18 @@ import qualified CargoHold.AWS as AWS
 import CargoHold.App hiding (Env, Handler)
 import CargoHold.Options
 import qualified CargoHold.Types.V3 as V3
-import qualified CargoHold.Types.V3.Resumable as V3
 import qualified Codec.MIME.Parse as MIME
 import qualified Codec.MIME.Type as MIME
 import Conduit
 import Control.Error (ExceptT, throwE)
 import Control.Lens hiding (parts, (.=), (:<), (:>))
 import Data.ByteString.Builder (toLazyByteString)
-import qualified Data.ByteString.Char8 as C8
 import Data.ByteString.Conversion
 import qualified Data.ByteString.Lazy as LBS
 import qualified Data.CaseInsensitive as CI
 import qualified Data.Conduit.Binary as Conduit
 import qualified Data.HashMap.Lazy as HML
 import Data.Id
-import qualified Data.List.NonEmpty as NE
-import Data.Sequence (Seq, ViewL (..), ViewR (..))
-import qualified Data.Sequence as Seq
 import qualified Data.Text as Text
 import qualified Data.Text.Ascii as Ascii
 import Data.Text.Encoding (decodeLatin1, encodeUtf8)
@@ -82,7 +64,6 @@ import Network.AWS hiding (Error)
 import Network.AWS.Data.Body
 import Network.AWS.S3
 import Network.Wai.Utilities.Error (Error (..))
-import Safe (readMay)
 import qualified System.Logger.Class as Log
 import System.Logger.Message (msg, val, (.=), (~~))
 import URI.ByteString
@@ -237,408 +218,6 @@ metaHeaders tok prc =
         Just (setAmzMetaPrincipal prc)
       ]
 
--------------------------------------------------------------------------------
--- Resumable Uploads
-
-newtype S3ResumableKey = S3ResumableKey {s3ResumableKey :: Text}
-  deriving (Eq, Show, ToByteString)
-
-newtype S3ChunkKey = S3ChunkKey {s3ChunkKey :: Text}
-  deriving (Eq, Show, ToByteString)
-
-newtype S3ChunkNr = S3ChunkNr Word
-  deriving (Eq, Ord, Show, ToByteString, FromByteString, Num, Integral, Enum, Real)
-
-newtype S3ETag = S3ETag {s3ETag :: Text}
-  deriving (Eq, Show, ToByteString, FromByteString)
-
-data S3Resumable = S3Resumable
-  { -- | The resumable asset key.
-    resumableKey :: S3ResumableKey,
-    -- | The final asset key.
-    resumableAsset :: V3.AssetKey,
-    -- | The creator (i.e. owner).
-    resumableOwner :: V3.Principal,
-    -- | Size of each chunk.
-    resumableChunkSize :: V3.ChunkSize,
-    -- | Size of the final asset.
-    resumableTotalSize :: V3.TotalSize,
-    -- | MIME type of the final asset.
-    resumableType :: MIME.Type,
-    -- | Token of the final asset.
-    resumableToken :: Maybe V3.AssetToken,
-    -- | Expiry of the resumable upload.
-    resumableExpires :: UTCTime,
-    -- | S3 multipart upload ID, if any.
-    resumableUploadId :: Maybe Text,
-    resumableChunks :: Seq S3Chunk
-  }
-  deriving (Show)
-
-data S3Chunk = S3Chunk
-  { -- | Sequence nr.
-    chunkNr :: S3ChunkNr,
-    -- | Offset of the first byte.
-    chunkOffset :: V3.Offset,
-    -- | (Actual) Size of the chunk.
-    chunkSize :: Word,
-    -- | S3 ETag.
-    chunkETag :: S3ETag
-  }
-  deriving (Show)
-
-mkChunkNr :: S3Resumable -> V3.Offset -> S3ChunkNr
-mkChunkNr r o = S3ChunkNr ((offBytes `quot` chunkBytes) + 1)
-  where
-    offBytes = V3.offsetBytes o
-    chunkBytes = V3.chunkSizeBytes (resumableChunkSize r)
-
-mkOffset :: S3Resumable -> S3ChunkNr -> V3.Offset
-mkOffset r n = V3.Offset ((fromIntegral n - 1) * chunkBytes)
-  where
-    chunkBytes = V3.chunkSizeBytes (resumableChunkSize r)
-
-resumableOffset :: S3Resumable -> V3.Offset
-resumableOffset r = case Seq.viewr (resumableChunks r) of
-  Seq.EmptyR -> V3.Offset 0
-  _ :> c -> chunkOffset c + V3.Offset (chunkSize c)
-
--- | Given a total size for an upload, calculates the desired
--- size of individual chunks. Semantically, the calculation grows
--- the number of chunks and the chunk size in an alternating fashion
--- until the number of chunks multiplied by the chunk size is equal
--- or greater than the given total size:
---
--- [0. If the total size is less than 'minSmallSize', then 'minSmallSize'
---    is the chunk size and we are done.]
--- 1. Starting with a chunk size of 'minSmallSize', the number
---    of chunks is increased up to 'maxSmallChunks'.
--- 2. Staying at 'maxSmallChunks', the chunk size is increased
---    up to 'maxSmallSize'.
--- 3. Starting with a chunk size of 'minBigSize' and 1 chunk, the number
---    of chunks is increased up to 'maxTotalChunks'.
--- 4. Staying at 'maxTotalChunks', the chunk size is increased
---    until the total size is accommodated.
-calculateChunkSize :: V3.TotalSize -> V3.ChunkSize
-calculateChunkSize (fromIntegral -> total) =
-  let smallChunks = max 1 (min maxSmallChunks (total `quot` minSmallSize))
-      bigChunks = max 1 (min maxTotalChunks (total `quot` minBigSize))
-      smallSize = total `quot` smallChunks
-      bigSize = total `quot` bigChunks
-   in V3.ChunkSize $
-        if
-            | smallChunks < maxSmallChunks -> minSmallSize
-            | smallSize <= maxSmallSize -> smallSize
-            | bigChunks < maxTotalChunks -> minBigSize
-            | otherwise -> bigSize
-
--- | The maximum number of small chunks, sized ['minSmallChunk', 'maxSmallChunk']
--- that we are willing to assemble on our side, to compensate for the 5MiB lower
--- bound on S3 multipart uploads.
-maxSmallChunks :: Word
-maxSmallChunks = 25
-
--- | The maximum number of chunks we are willing to process in total for a
--- single upload, regardless of where the final assembly is performed.
-maxTotalChunks :: Word
-maxTotalChunks = 1000
-
--- | Lower bound (inclusive) for small chunks.
-minSmallSize :: Word
-minSmallSize = 100 * 1024 -- 100 KiB
-
--- | Upper bound (inclusive) for small chunks.
-maxSmallSize :: Word
-maxSmallSize = 1 * 1024 * 1024 -- 1 MiB
-
--- | Lower bound (inclusive) for large chunks, i.e. the lower bound for S3
--- multipart upload uploads.
-minBigSize :: Word
-minBigSize = 5 * 1024 * 1024 -- 5 MiB
-
-getResumable :: V3.AssetKey -> ExceptT Error App (Maybe S3Resumable)
-getResumable k = do
-  Log.debug $
-    "remote" .= val "S3"
-      ~~ "asset" .= toByteString k
-      ~~ "asset.key" .= toByteString rk
-      ~~ "asset.key.meta" .= toByteString mk
-      ~~ msg (val "Getting resumable asset metadata")
-  maybe (return Nothing) handle =<< execCatch req
-  where
-    rk = mkResumableKey k
-    mk = mkResumableKeyMeta k
-    req b = headObject (BucketName b) (ObjectKey $ s3ResumableKey mk)
-    handle r = do
-      let ct = fromMaybe octets (MIME.parseMIMEType =<< view horsContentType r)
-      let meta = HML.toList $ view horsMetadata r
-      case parse ct meta of
-        Nothing -> return Nothing
-        Just r' -> fmap (\cs -> r' {resumableChunks = cs}) <$> listChunks r'
-    parse ct h =
-      S3Resumable rk k
-        <$> getAmzMetaPrincipal h
-        <*> getAmzMetaChunkSize h
-        <*> getAmzMetaTotalSize h
-        <*> pure ct
-        <*> Just (getAmzMetaToken h)
-        <*> getAmzMetaUploadExpires h
-        <*> Just (getAmzMetaUploadId h)
-        <*> pure Seq.empty
-
-createResumable ::
-  V3.AssetKey ->
-  V3.Principal ->
-  MIME.Type ->
-  V3.TotalSize ->
-  Maybe V3.AssetToken ->
-  ExceptT Error App S3Resumable
-createResumable k p _ size tok = do
-  let typ = octets -- see note: overrideMimeTypeAsOctetStream
-  let csize = calculateChunkSize size
-  ex <- addUTCTime V3.assetVolatileSeconds <$> liftIO getCurrentTime
-  let key = mkResumableKey k
-      mk = mkResumableKeyMeta k
-  let res = S3Resumable key k p csize size typ tok ex Nothing Seq.empty
-  up <- initMultipart res
-  let ct = resumableType res
-  void . exec $ first (s3ResumableKey mk) ct (resumableMeta csize ex up)
-  return res {resumableUploadId = up}
-  where
-    initMultipart r
-      | canUseMultipart r = do
-        let cmu b =
-              createMultipartUpload (BucketName b) (ObjectKey $ s3Key (mkKey k))
-                & cmuContentType ?~ MIME.showType (resumableType r)
-                & cmuMetadata .~ metaHeaders (resumableToken r) p
-        imur <- exec cmu
-        return $! view cmursUploadId imur
-      | otherwise = return Nothing
-    first key ct meta b =
-      putObject (BucketName b) (ObjectKey key) (toBody (mempty :: ByteString))
-        & poContentType ?~ MIME.showType ct
-        & poMetadata .~ HML.fromList meta
-    -- Determine whether a given 'S3Resumable' is eligible for the
-    -- S3 multipart upload API. That is the case if the chunk size
-    -- is >= 5 MiB or if there is only 1 chunk (<= 'minSmallSize').
-    canUseMultipart r = chunkBytes >= minBigSize || totalBytes <= minSmallSize
-      where
-        chunkBytes = V3.chunkSizeBytes (resumableChunkSize r)
-        totalBytes = V3.totalSizeBytes (resumableTotalSize r)
-    resumableMeta csize expires upl =
-      setAmzMetaPrincipal p :
-      setAmzMetaTotalSize size :
-      setAmzMetaChunkSize csize :
-      setAmzMetaUploadExpires expires :
-      catMaybes
-        [ setAmzMetaToken <$> tok,
-          setAmzMetaUploadId <$> upl
-        ]
-
-uploadChunk ::
-  S3Resumable ->
-  V3.Offset ->
-  Conduit.SealedConduitT () ByteString IO () ->
-  ExceptT Error App (S3Resumable, Conduit.SealedConduitT () ByteString IO ())
-uploadChunk r offset rsrc = do
-  let chunkSize = fromIntegral (resumableChunkSize r)
-  (rest, chunk) <- liftIO $ rsrc $$++ Conduit.take chunkSize
-  let size = fromIntegral (LBS.length chunk)
-  Log.debug $
-    "remote" .= val "S3"
-      ~~ "asset" .= toByteString (resumableAsset r)
-      ~~ "asset.owner" .= toByteString (resumableOwner r)
-      ~~ "asset.key" .= toByteString (resumableKey r)
-      ~~ "asset.chunk" .= toByteString nr
-      ~~ "asset.offset" .= toByteString offset
-      ~~ "asset.size" .= toByteString size
-      ~~ msg (val "Uploading chunk")
-  c <- case resumableUploadId r of
-    Nothing -> putChunk chunk size
-    Just up -> putPart up chunk size
-  let r' = r {resumableChunks = resumableChunks r Seq.|> c}
-  return (r', rest)
-  where
-    nr = mkChunkNr r offset
-    ct = MIME.showType octets -- see note overrideMimeTypeAsOctetStream
-    putChunk chunk size = do
-      let S3ChunkKey k = mkChunkKey (resumableKey r) nr
-      let req b =
-            putObject (BucketName b) (ObjectKey k) (toBody chunk)
-              & poContentType ?~ ct
-      void $ exec req
-      return $! S3Chunk nr offset size (S3ETag "")
-    putPart up chunk size = do
-      let S3AssetKey k = mkKey (resumableAsset r)
-      let req b =
-            uploadPart (BucketName b) (ObjectKey k) (fromIntegral nr) up (toBody chunk)
-      tg <- view uprsETag <$> exec req
-      etag <- case tg of
-        Just (ETag t) -> return $ S3ETag (Text.decodeLatin1 t)
-        Nothing -> throwE serverError
-      return $! S3Chunk nr offset size etag
-
--- | Complete a resumable upload, assembling all chunks into a final asset.
-completeResumable :: S3Resumable -> ExceptT Error App ()
-completeResumable r = do
-  Log.debug $
-    "remote" .= val "S3"
-      ~~ "asset" .= toByteString ast
-      ~~ "asset.owner" .= toByteString own
-      ~~ "asset.key" .= toByteString (resumableKey r)
-      ~~ msg (val "Completing resumable upload")
-  let chunks = resumableChunks r
-  verifyChunks chunks
-  case resumableUploadId r of
-    Nothing -> assembleLocal chunks
-    Just up -> assembleRemote up (NE.nonEmpty $ toList chunks)
-  Log.debug $
-    "remote" .= val "S3"
-      ~~ "asset" .= toByteString ast
-      ~~ "asset.owner" .= toByteString own
-      ~~ "asset.key" .= toByteString (resumableKey r)
-      ~~ msg (val "Resumable upload completed")
-  where
-    (own, ast) = (resumableOwner r, resumableAsset r)
-    -- Local assembly for small chunk sizes (< 5 MiB): Download and re-upload
-    -- the chunks in a streaming fashion one-by-one to create the final object.
-    assembleLocal :: Seq S3Chunk -> ExceptT Error App ()
-    assembleLocal chunks = do
-      e <- view aws
-      let totalSize = fromIntegral (resumableTotalSize r)
-      let chunkSize = calcChunkSize chunks
-      let reqBdy = Chunked $ ChunkedBody chunkSize totalSize (chunkSource e chunks)
-      let putRq b =
-            putObject (BucketName b) (ObjectKey (s3Key (mkKey ast))) reqBdy
-              & poContentType ?~ MIME.showType octets -- see note overrideMimeTypeAsOctetStream
-              & poMetadata .~ metaHeaders (resumableToken r) own
-      void $ exec putRq
-
-      -- For symmetry with the behavior of the S3 multipart API, where the
-      -- resumable upload and all parts are removed upon completion, we do
-      -- the same here.
-      let rk = resumableKey r
-      let keys =
-            s3ResumableKey rk :
-            map (s3ChunkKey . mkChunkKey rk . chunkNr) (toList chunks)
-      let del =
-            delete' & dObjects .~ map (objectIdentifier . ObjectKey) keys
-              & dQuiet ?~ True
-      let delRq b = deleteObjects (BucketName b) del
-      void $ exec delRq
-
-    -- All chunks except for the last should be of the same size so it makes
-    -- sense to use that as our default
-    calcChunkSize cs = case Seq.viewl cs of
-      EmptyL -> defaultChunkSize
-      c :< _ -> ChunkSize $ fromIntegral (chunkSize c)
-    -- Remote assembly for large(r) chunk sizes (>= 5 MiB) via the
-    -- S3 multipart upload API.
-    assembleRemote _ Nothing = throwE serverError
-    assembleRemote up (Just chunks) = do
-      let key = s3Key (mkKey ast)
-      let parts = fmap mkPart chunks
-      let completeRq b =
-            completeMultipartUpload (BucketName b) (ObjectKey key) up
-              & cMultipartUpload ?~ (completedMultipartUpload & cmuParts ?~ parts)
-      void $ exec completeRq
-      let S3ResumableKey rkey = resumableKey r
-      let delRq b = deleteObject (BucketName b) (ObjectKey rkey)
-      void $ exec delRq
-    mkPart c = completedPart (fromIntegral (chunkNr c)) (ETag . Text.encodeUtf8 $ s3ETag (chunkETag c))
-    -- Verify that the chunks constitute the full asset, i.e. that the
-    -- upload is complete.
-    verifyChunks cs = do
-      let !total = V3.TotalSize $ foldl' (\t v -> t + chunkSize v) 0 cs
-      unless (total == resumableTotalSize r) $
-        throwE $
-          uploadIncomplete (resumableTotalSize r) total
-    -- Construct a 'Source' by downloading the chunks.
-    -- chunkSource :: AWS.Env
-    --             -> Seq S3Chunk
-    --             -> Source (ResourceT IO) ByteString
-    chunkSource env cs = case Seq.viewl cs of
-      EmptyL -> mempty
-      c :< cc -> do
-        let S3ChunkKey ck = mkChunkKey (resumableKey r) (chunkNr c)
-        let b = view AWS.s3Bucket env
-        let req = getObject (BucketName b) (ObjectKey ck)
-        v <-
-          lift $
-            AWS.execute env $
-              AWS.send req
-                >>= flip sinkBody Conduit.sinkLbs . view gorsBody
-        Conduit.yield (LBS.toStrict v) >> chunkSource env cc
-
-listChunks :: S3Resumable -> ExceptT Error App (Maybe (Seq S3Chunk))
-listChunks r = do
-  let ast = resumableAsset r
-  let S3ResumableKey key = resumableKey r
-  Log.debug $
-    "remote" .= val "S3"
-      ~~ "asset" .= toByteString ast
-      ~~ "asset.resumable" .= key
-      ~~ msg (val "Listing chunks")
-  fmap Seq.fromList <$> case resumableUploadId r of
-    Nothing -> listBucket key
-    Just up -> listMultiParts up
-  where
-    listBucket k = do
-      let req b =
-            listObjects (BucketName b)
-              & loPrefix ?~ (k <> "/")
-              & loMaxKeys ?~ fromIntegral maxTotalChunks
-      maybe (return Nothing) parseObjects =<< execCatch req
-    parseObjects =
-      return . Just . mapMaybe chunkFromObject
-        . view lorsContents
-    listMultiParts up = do
-      let req b =
-            listParts
-              (BucketName b)
-              (ObjectKey $ s3Key (mkKey (resumableAsset r)))
-              up
-      maybe (return Nothing) parseParts =<< execCatch req
-    parseParts =
-      return . Just . mapMaybe chunkFromPart
-        . view lprsParts
-    chunkFromObject :: Object -> Maybe S3Chunk
-    chunkFromObject o = do
-      let (ObjectKey okey) = view oKey o
-      nr <- parseNr okey
-      let etag =
-            let (ETag t) = (view oETag o)
-             in S3ETag (Text.decodeLatin1 t)
-      let size = fromIntegral (view oSize o)
-      let off = mkOffset r nr
-      Just $! S3Chunk nr off size etag
-    chunkFromPart :: Part -> Maybe S3Chunk
-    chunkFromPart p = case (view pPartNumber p, view pETag p, view pSize p) of
-      (Just x, Just (ETag y), Just z) ->
-        let nr = S3ChunkNr (fromIntegral x)
-            off = mkOffset r nr
-            size = (fromIntegral z)
-            etag = S3ETag (Text.decodeLatin1 y)
-         in Just $! S3Chunk nr off size etag
-      _ -> Nothing
-    parseNr = fmap S3ChunkNr . readMay . Text.unpack . snd . Text.breakOnEnd "/"
-
-mkResumableKey :: V3.AssetKey -> S3ResumableKey
-mkResumableKey (V3.AssetKeyV3 aid _) =
-  S3ResumableKey $ "v3/resumable/" <> UUID.toText (toUUID aid)
-
-mkResumableKeyMeta :: V3.AssetKey -> S3ResumableKey
-mkResumableKeyMeta (V3.AssetKeyV3 aid _) =
-  S3ResumableKey $ "v3/resumable/" <> UUID.toText (toUUID aid) <> "/meta"
-
-mkChunkKey :: S3ResumableKey -> S3ChunkNr -> S3ChunkKey
-mkChunkKey (S3ResumableKey k) (S3ChunkNr n) =
-  S3ChunkKey $ k <> "/" <> nr
-  where
-    -- Chunk numbers must be between 1 and 10000, as per the S3
-    -- multipart upload API, hence the max. left padding of 5 digits.
-    nr = Text.justifyRight 5 '0' (Text.pack (show n))
-
 -------------------------------------------------------------------------------
 -- S3 Metadata Headers
 
@@ -651,21 +230,9 @@ hAmzMetaBot = "bot"
 hAmzMetaProvider :: Text
 hAmzMetaProvider = "provider"
 
-hAmzMetaSize :: Text
-hAmzMetaSize = "total-size"
-
 hAmzMetaToken :: Text
 hAmzMetaToken = "token"
 
-hAmzMetaChunkSize :: Text
-hAmzMetaChunkSize = "chunk-size"
-
-hAmzMetaUploadExpires :: Text
-hAmzMetaUploadExpires = "upload-expires"
-
-hAmzMetaUploadId :: Text
-hAmzMetaUploadId = "upload-id"
-
 -------------------------------------------------------------------------------
 -- S3 Metadata Setters
 
@@ -681,18 +248,6 @@ setAmzMetaProvider p = (hAmzMetaProvider, UUID.toText (toUUID p))
 setAmzMetaToken :: V3.AssetToken -> (Text, Text)
 setAmzMetaToken t = (hAmzMetaToken, Ascii.toText (V3.assetTokenAscii t))
 
-setAmzMetaTotalSize :: V3.TotalSize -> (Text, Text)
-setAmzMetaTotalSize s = (hAmzMetaSize, Text.decodeLatin1 (toByteString' s))
-
-setAmzMetaChunkSize :: V3.ChunkSize -> (Text, Text)
-setAmzMetaChunkSize s = (hAmzMetaChunkSize, Text.decodeLatin1 (toByteString' s))
-
-setAmzMetaUploadExpires :: UTCTime -> (Text, Text)
-setAmzMetaUploadExpires t = (hAmzMetaUploadExpires, Text.pack (show t))
-
-setAmzMetaUploadId :: Text -> (Text, Text)
-setAmzMetaUploadId i = (hAmzMetaUploadId, i)
-
 setAmzMetaPrincipal :: V3.Principal -> (Text, Text)
 setAmzMetaPrincipal (V3.UserPrincipal u) = setAmzMetaUser u
 setAmzMetaPrincipal (V3.BotPrincipal b) = setAmzMetaBot b
@@ -724,20 +279,6 @@ getAmzMetaToken h =
   V3.AssetToken . Ascii.unsafeFromText
     <$> lookupCI hAmzMetaToken h
 
-getAmzMetaUploadExpires :: [(Text, Text)] -> Maybe UTCTime
-getAmzMetaUploadExpires h =
-  readMay . C8.unpack . encodeUtf8
-    =<< lookupCI hAmzMetaUploadExpires h
-
-getAmzMetaTotalSize :: [(Text, Text)] -> Maybe V3.TotalSize
-getAmzMetaTotalSize = parseAmzMeta hAmzMetaSize
-
-getAmzMetaChunkSize :: [(Text, Text)] -> Maybe V3.ChunkSize
-getAmzMetaChunkSize = parseAmzMeta hAmzMetaChunkSize
-
-getAmzMetaUploadId :: [(Text, Text)] -> Maybe Text
-getAmzMetaUploadId = lookupCI hAmzMetaUploadId
-
 parseAmzMeta :: FromByteString a => Text -> [(Text, Text)] -> Maybe a
 parseAmzMeta k h = lookupCI k h >>= fromByteString . encodeUtf8
 
diff --git a/services/cargohold/src/CargoHold/TUS.hs b/services/cargohold/src/CargoHold/TUS.hs
deleted file mode 100644
index 542833ca0c7..00000000000
--- a/services/cargohold/src/CargoHold/TUS.hs
+++ /dev/null
@@ -1,89 +0,0 @@
--- This file is part of the Wire Server implementation.
---
--- Copyright (C) 2020 Wire Swiss GmbH <opensource@wire.com>
---
--- This program is free software: you can redistribute it and/or modify it under
--- the terms of the GNU Affero General Public License as published by the Free
--- Software Foundation, either version 3 of the License, or (at your option) any
--- later version.
---
--- This program is distributed in the hope that it will be useful, but WITHOUT
--- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
--- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
--- details.
---
--- You should have received a copy of the GNU Affero General Public License along
--- with this program. If not, see <https://www.gnu.org/licenses/>.
-
-module CargoHold.TUS
-  ( createdResponse,
-    headResponse,
-    patchResponse,
-    optionsResponse,
-  )
-where
-
-import CargoHold.Types.V3.Resumable (Offset, TotalSize)
-import qualified Data.ByteString.Char8 as C8
-import Data.ByteString.Conversion
-import Data.Time.Clock
-import Data.Time.Format
-import Data.Time.LocalTime
-import Imports
-import Network.HTTP.Types.Status
-import Network.Wai
-import Network.Wai.Utilities hiding (message)
-
-createdResponse :: ByteString -> UTCTime -> Response -> Response
-createdResponse loc expiry =
-  setStatus status201
-    . addHeader "Location" loc
-    . uploadExpires expiry
-
--- cf. http://tus.io/protocols/resumable-upload.html#head
-headResponse :: (Offset, TotalSize) -> Response -> Response
-headResponse (offset, total) =
-  setStatus status200
-    . addHeader "Cache-Control" "no-store"
-    . hResumable
-    . hOffset offset
-    . hLength total
-
--- cf. http://tus.io/protocols/resumable-upload.html#patch
-patchResponse :: Offset -> UTCTime -> Response -> Response
-patchResponse offset expiry =
-  setStatus status204
-    . hOffset offset
-    . hResumable
-    . uploadExpires expiry
-
--- cf. http://tus.io/protocols/resumable-upload.html#options
-optionsResponse :: Word -> Response -> Response
-optionsResponse maxSize =
-  setStatus status204
-    . addHeader "Tus-Extension" "creation,expiration"
-    . addHeader "Tus-Max-Size" (toByteString' maxSize)
-    . hVersion
-    . hResumable
-
--- Internal --------------------------------------------------------------------
-
--- cf. http://tus.io/protocols/resumable-upload.html#expiration
-uploadExpires :: UTCTime -> Response -> Response
-uploadExpires = addHeader "Upload-Expires" . C8.pack . time
-  where
-    -- Must be according to RFC 7231
-    time = formatTime defaultTimeLocale "%a, %d %B %Y %H:%M:%S %Z" . utcToZonedTime gmt
-    gmt = TimeZone 0 False "GMT"
-
-hVersion :: Response -> Response
-hVersion = addHeader "Tus-Version" "1.0.0"
-
-hResumable :: Response -> Response
-hResumable = addHeader "Tus-Resumable" "1.0.0"
-
-hOffset :: Offset -> Response -> Response
-hOffset = addHeader "Upload-Offset" . toByteString'
-
-hLength :: TotalSize -> Response -> Response
-hLength = addHeader "Upload-Length" . toByteString'
diff --git a/services/cargohold/test/integration/API/V3.hs b/services/cargohold/test/integration/API/V3.hs
index bde128d4f42..a6a34f6ef58 100644
--- a/services/cargohold/test/integration/API/V3.hs
+++ b/services/cargohold/test/integration/API/V3.hs
@@ -17,16 +17,14 @@
 -- You should have received a copy of the GNU Affero General Public License along
 -- with this program. If not, see <https://www.gnu.org/licenses/>.
 
-module API.V3 where
+module API.V3 (tests) where
 
 import Bilge hiding (body)
 import Bilge.Assert
 import qualified CargoHold.Types.V3 as V3
-import qualified CargoHold.Types.V3.Resumable as V3
 import qualified Codec.MIME.Parse as MIME
 import qualified Codec.MIME.Type as MIME
 import Control.Lens hiding (sets)
-import Data.Aeson hiding (json)
 import Data.ByteString.Builder
 import qualified Data.ByteString.Char8 as C8
 import Data.ByteString.Conversion
@@ -41,7 +39,7 @@ import Imports hiding (head)
 import Network.HTTP.Client (parseUrlThrow)
 import Network.HTTP.Types.Header
 import Network.HTTP.Types.Method
-import Network.HTTP.Types.Status (status200, status204)
+import Network.HTTP.Types.Status (status200)
 import Network.Wai.Utilities (Error (label))
 import Test.Tasty
 import Test.Tasty.HUnit
@@ -57,17 +55,6 @@ tests s =
           test s "tokens" testSimpleTokens,
           test s "s3-upstream-closed" testSimpleS3ClosedConnectionReuse,
           test s "client-compatibility" testUploadCompatibility
-        ],
-      testGroup
-        "RealAWS"
-        [ testGroup
-            "resumable"
-            [ test s "small" testResumableSmall,
-              test s "large" testResumableBig,
-              test s "last-small" testResumableLastSmall,
-              test s "stepwise-small" testResumableStepSmall,
-              test s "stepwise-big" testResumableStepBig
-            ]
         ]
     ]
 
@@ -241,68 +228,6 @@ testUploadCompatibility c = do
       \--FrontierIyj6RcVrqMcxNtMEWPsNpuPm325QsvWQ--\r\n\
       \\r\n"
 
---------------------------------------------------------------------------------
--- Resumable (multi-step) uploads
-
-testResumableSmall :: TestSignature ()
-testResumableSmall c = assertRandomResumable c totalSize chunkSize UploadFull
-  where
-    totalSize = 100 -- 100 B
-    chunkSize = 100 * 1024 -- 100 KiB
-
-testResumableBig :: TestSignature ()
-testResumableBig c = assertRandomResumable c totalSize chunkSize UploadFull
-  where
-    totalSize = 25 * 1024 * 1024 -- 25 MiB
-    chunkSize = 1 * 1024 * 1024 --  1 MiB
-
-testResumableLastSmall :: TestSignature ()
-testResumableLastSmall c = assertRandomResumable c totalSize chunkSize UploadFull
-  where
-    totalSize = 250 * 1024 + 12345 -- 250 KiB + 12345 B
-    chunkSize = 100 * 1024 -- 100 KiB
-
-testResumableStepSmall :: TestSignature ()
-testResumableStepSmall c = assertRandomResumable c totalSize chunkSize UploadStepwise
-  where
-    totalSize = 500 * 1024 + 12345 -- 500 KiB + 12345 B
-    chunkSize = 100 * 1024 -- 100 KiB
-
--- This should use the S3 multipart upload behind the scenes.
-testResumableStepBig :: TestSignature ()
-testResumableStepBig c = assertRandomResumable c totalSize chunkSize UploadStepwise
-  where
-    totalSize = 26 * 1024 * 1024 -- 26 MiB
-    chunkSize = 5 * 1024 * 1024 -- 5 MiB
-
--- Assertions -----------------------------------------------------------------
-
-data UploadType = UploadFull | UploadStepwise
-
-assertRandomResumable ::
-  HasCallStack => CargoHold -> V3.TotalSize -> V3.ChunkSize -> UploadType -> Http ()
-assertRandomResumable c totalSize chunkSize typ = do
-  (uid, dat, ast) <- randomResumable c totalSize
-  let key = ast ^. V3.resumableAsset . V3.assetKey
-  liftIO $ assertEqual "chunksize" chunkSize (ast ^. V3.resumableChunkSize)
-  case typ of
-    UploadStepwise -> uploadStepwise c uid key chunkSize dat
-    UploadFull -> void $ uploadResumable c uid key 0 dat
-  r <- downloadAsset c uid key Nothing
-  liftIO $ do
-    assertEqual "status" status200 (responseStatus r)
-    assertEqual "content-type should always be application/octet-stream" (Just applicationOctetStream) (getContentType r)
-    assertEqual "user mismatch" uid (decodeHeader "x-amz-meta-user" r)
-    assertEqual "data mismatch" (Just $ Lazy.fromStrict dat) (responseBody r)
-
-randomResumable :: CargoHold -> V3.TotalSize -> Http (UserId, ByteString, V3.ResumableAsset)
-randomResumable c size = do
-  uid <- liftIO $ Id <$> nextRandom
-  let sets = V3.mkResumableSettings V3.AssetPersistent True textPlain
-  let dat = C8.replicate (fromIntegral size) 'a'
-  ast <- createResumable c uid sets size
-  return (uid, dat, ast)
-
 -- API Calls ------------------------------------------------------------------
 
 uploadSimple ::
@@ -329,103 +254,17 @@ uploadRaw c usr bs =
       . content "multipart/mixed"
       . lbytes bs
 
-createResumable ::
-  HasCallStack =>
-  CargoHold ->
-  UserId ->
-  V3.ResumableSettings ->
-  V3.TotalSize ->
-  Http V3.ResumableAsset
-createResumable c u sets size = do
-  rsp <-
-    post
-      ( c
-          . path "/assets/v3/resumable"
-          . zUser u
-          . header "Content-Type" "application/json"
-          . header "Upload-Length" (toByteString' size)
-          . lbytes (encode sets)
-      )
-      <!! const 201
-      === statusCode
-  let Just ast = responseJsonMaybe @V3.ResumableAsset rsp
-  let Just loc = getHeader "Location" rsp
-  let loc' = "/assets/v3/resumable/" <> toByteString' (ast ^. V3.resumableAsset . V3.assetKey)
-  liftIO $ assertEqual "Location" loc' loc
-  return ast
-
-getResumableStatus :: HasCallStack => CargoHold -> UserId -> V3.AssetKey -> Http V3.Offset
-getResumableStatus c u k = do
-  r <-
-    head
-      ( c
-          . paths ["assets", "v3", "resumable", toByteString' k]
-          . zUser u
-      )
-      <!! const 200
-      === statusCode
-  return $ getOffset r
-
-uploadResumable :: CargoHold -> UserId -> V3.AssetKey -> V3.Offset -> ByteString -> Http V3.Offset
-uploadResumable c u k off bs = do
-  r <-
-    patch
-      ( c
-          . paths ["assets", "v3", "resumable", toByteString' k]
-          . header "Upload-Offset" (toByteString' off)
-          . header "Content-Type" applicationOffset
-          . zUser u
-          . bytes bs
-      )
-  liftIO $ assertEqual "status" status204 (responseStatus r)
-  return $ getOffset r
-
-uploadStepwise :: CargoHold -> UserId -> V3.AssetKey -> V3.ChunkSize -> ByteString -> Http ()
-uploadStepwise c u k s d = next 0 d
-  where
-    totalSize = fromIntegral (C8.length d)
-    chunkSize = fromIntegral s
-    next pos dat = do
-      off <- uploadResumable c u k pos (C8.take chunkSize dat)
-      unless (V3.offsetBytes off == totalSize) $ do
-        off' <- getResumableStatus c u k
-        liftIO $ assertEqual "offset" off off'
-        next off (C8.drop (fromIntegral (off - pos)) dat)
-
-getAsset :: CargoHold -> UserId -> V3.AssetKey -> Maybe V3.AssetToken -> Http (Response (Maybe Lazy.ByteString))
-getAsset c u k t =
-  get $
-    c
-      . paths ["assets", "v3", toByteString' k]
-      . zUser u
-      . maybe id (header "Asset-Token" . toByteString') t
-      . noRedirect
-
-downloadAsset :: HasCallStack => CargoHold -> UserId -> V3.AssetKey -> Maybe V3.AssetToken -> Http (Response (Maybe Lazy.ByteString))
-downloadAsset c u k t = do
-  r <-
-    getAsset c u k t <!! do
-      const 302 === statusCode
-      const Nothing === responseBody
-  l <- parseUrlThrow (C8.unpack (getHeader' "Location" r))
-  get' l id
-
 deleteAsset :: CargoHold -> UserId -> V3.AssetKey -> Http (Response (Maybe Lazy.ByteString))
 deleteAsset c u k = delete $ c . zUser u . paths ["assets", "v3", toByteString' k]
 
 -- Utilities ------------------------------------------------------------------
 
-type ContentType = ByteString
-
 decodeHeader :: FromByteString a => HeaderName -> Response b -> a
 decodeHeader h =
   fromMaybe (error $ "decodeHeader: missing or invalid header: " ++ show h)
     . fromByteString
     . getHeader' h
 
-getOffset :: Response b -> V3.Offset
-getOffset = decodeHeader "Upload-Offset"
-
 getContentType :: Response a -> Maybe MIME.Type
 getContentType = MIME.parseContentType . decodeLatin1 . getHeader' "Content-Type"
 
@@ -435,12 +274,6 @@ applicationText = MIME.Type (MIME.Application "text") []
 applicationOctetStream :: MIME.Type
 applicationOctetStream = MIME.Type (MIME.Application "octet-stream") []
 
-textPlain :: MIME.Type
-textPlain = MIME.Type (MIME.Text "plain") []
-
-applicationOffset :: ContentType
-applicationOffset = "application/offset+octet-stream"
-
 zUser :: UserId -> Request -> Request
 zUser = header "Z-User" . UUID.toASCIIBytes . toUUID
 

From 3c376f3d10544044d35b10ae03a3d4dd00f0c52a Mon Sep 17 00:00:00 2001
From: Stefan Matting <smatting@users.noreply.github.com>
Date: Thu, 16 Dec 2021 01:58:32 +0100
Subject: [PATCH 11/74] Fix bug in SFT chart: multi sft args are quoted (#1999)

* Fix bug in SFT chart: multi sft args are quoted

* Add changelog entry
---
 changelog.d/5-internal/sftd-multi-sft-fixup | 1 +
 charts/sftd/templates/statefulset.yaml      | 6 +++---
 2 files changed, 4 insertions(+), 3 deletions(-)
 create mode 100644 changelog.d/5-internal/sftd-multi-sft-fixup

diff --git a/changelog.d/5-internal/sftd-multi-sft-fixup b/changelog.d/5-internal/sftd-multi-sft-fixup
new file mode 100644
index 00000000000..78b95439e69
--- /dev/null
+++ b/changelog.d/5-internal/sftd-multi-sft-fixup
@@ -0,0 +1 @@
+sftd chart: Fix quoted args for multiSFT option
diff --git a/charts/sftd/templates/statefulset.yaml b/charts/sftd/templates/statefulset.yaml
index 8345b6bc1c1..3027ccf601d 100644
--- a/charts/sftd/templates/statefulset.yaml
+++ b/charts/sftd/templates/statefulset.yaml
@@ -131,9 +131,9 @@ spec:
               fi
 
               {{- if .Values.multiSFT.enabled }}
-              MULTI_SFT_ARGS="-t \"$(cat /multi-sft-config/turn_server)\" \
-              -x \"$(cat /multi-sft-config/username)\" \
-              -c \"$(cat /multi-sft-config/password)\""
+              MULTI_SFT_ARGS="-t $(cat /multi-sft-config/turn_server) \
+              -x $(cat /multi-sft-config/username) \
+              -c $(cat /multi-sft-config/password)"
               {{- else }}
               MULTI_SFT_ARGS=""
               {{- end }}

From 10592ddf9d66b585b1cd5c79831fa50b61c01e11 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marko=20Dimja=C5=A1evi=C4=87?= <marko.dimjasevic@wire.com>
Date: Thu, 16 Dec 2021 11:41:40 +0100
Subject: [PATCH 12/74] Improve Test Documentation for BSI (SQSERVICES-1127)
 (#1991)

* Improve documentation for tests per SQSERVICES-1127

Co-authored-by: fisx <mf@zerobuzz.net>

* Update the changelog

* Add a test: attempt to delete client via an incorrect password

* Fixup

Co-authored-by: fisx <mf@zerobuzz.net>
---
 changelog.d/4-docs/sqservices-1127            |  1 +
 .../brig/test/integration/API/User/Auth.hs    | 16 +++++-
 .../brig/test/integration/API/User/Client.hs  | 51 +++++++++++++++++++
 .../brig/test/integration/API/User/Handles.hs |  7 ++-
 4 files changed, 73 insertions(+), 2 deletions(-)
 create mode 100644 changelog.d/4-docs/sqservices-1127

diff --git a/changelog.d/4-docs/sqservices-1127 b/changelog.d/4-docs/sqservices-1127
new file mode 100644
index 00000000000..bb5629509ae
--- /dev/null
+++ b/changelog.d/4-docs/sqservices-1127
@@ -0,0 +1 @@
+Add the description to several test cases
diff --git a/services/brig/test/integration/API/User/Auth.hs b/services/brig/test/integration/API/User/Auth.hs
index c13b3b77315..22ed0ea735e 100644
--- a/services/brig/test/integration/API/User/Auth.hs
+++ b/services/brig/test/integration/API/User/Auth.hs
@@ -400,7 +400,15 @@ testThrottleLogins conf b = do
   login b (defEmailLogin e) SessionCookie !!! const 200 === statusCode
 
 -- The testLimitRetries test conforms to the following testing standards:
--- @SF.Provisioning @TSFI.RESTfulAPI @S2
+-- @SF.Channel @TSFI.RESTfulAPI @S2
+--
+-- The following test tests the login retries. It checks that a user can make
+-- only a prespecified number of attempts to log in with an invalid password,
+-- after which the user is unable to try again for a configured amount of time.
+-- After the configured amount of time has passed, the test asserts the user can
+-- successfully log in again. Furthermore, the test asserts that another
+-- unrelated user can successfully log-in in parallel to the failed attempts of
+-- the aforementioned user.
 testLimitRetries :: HasCallStack => Opts.Opts -> Brig -> Http ()
 testLimitRetries conf brig = do
   let Just opts = Opts.setLimitFailedLogins . Opts.optSettings $ conf
@@ -910,6 +918,12 @@ testRemoveCookiesByLabelAndId b = do
 
 -- The testTooManyCookies test conforms to the following testing standards:
 -- @SF.Provisioning @TSFI.RESTfulAPI @S2
+--
+-- The test asserts that there is an upper limit for the number of user cookies
+-- per cookie type. It does that by concurrently attempting to create more
+-- persistent and session cookies than the configured maximum.
+-- Creation of new cookies beyond the limit causes deletion of the
+-- oldest cookies.
 testTooManyCookies :: Opts.Opts -> Brig -> Http ()
 testTooManyCookies config b = do
   u <- randomUser b
diff --git a/services/brig/test/integration/API/User/Client.hs b/services/brig/test/integration/API/User/Client.hs
index d538c3208b9..27a20c4c3e2 100644
--- a/services/brig/test/integration/API/User/Client.hs
+++ b/services/brig/test/integration/API/User/Client.hs
@@ -89,6 +89,7 @@ tests _cl _at opts p b c g =
       test p "delete /clients/:client - 200 (pwd)" $ testRemoveClient True b c,
       test p "delete /clients/:client - 200 (no pwd)" $ testRemoveClient False b c,
       test p "delete /clients/:client - 400 (short pwd)" $ testRemoveClientShortPwd b,
+      test p "delete /clients/:client - 403 (incorrect pwd)" $ testRemoveClientIncorrectPwd b,
       test p "put /clients/:client - 200" $ testUpdateClient opts b,
       test p "get /clients/:client - 404" $ testMissingClient b,
       test p "post /clients - 200 multiple temporary" $ testAddMultipleTemporary b g,
@@ -418,6 +419,11 @@ testMultiUserGetPrekeysQualified brig opts = do
 
 -- The testTooManyClients test conforms to the following testing standards:
 -- @SF.Provisioning @TSFI.RESTfulAPI @S2
+--
+-- The test validates the upper bound on the number of permanent clients per
+-- user. It does so by trying to create one permanent client more than allowed.
+-- The expected outcome is that all the clients up to the limit are successfully
+-- created, but the one over the limit is not (error `404 too-many-clients`).
 testTooManyClients :: Opt.Opts -> Brig -> Http ()
 testTooManyClients opts brig = do
   uid <- userId <$> randomUser brig
@@ -440,6 +446,10 @@ testTooManyClients opts brig = do
 
 -- The testRemoveClient test conforms to the following testing standards:
 -- @SF.Provisioning @TSFI.RESTfulAPI @S2
+--
+-- This test validates creating and deleting a client. A client is created and
+-- consequently deleted. Deleting a second time yields response 404 not found.
+-- Prekeys and cookies are not there anymore once the client is deleted.
 testRemoveClient :: Bool -> Brig -> Cannon -> Http ()
 testRemoveClient hasPwd brig cannon = do
   u <- randomUser' hasPwd brig
@@ -481,6 +491,10 @@ testRemoveClient hasPwd brig cannon = do
 
 -- The testRemoveClientShortPwd test conforms to the following testing standards:
 -- @SF.Provisioning @TSFI.RESTfulAPI @S2
+--
+-- The test checks if a client can be deleted by providing a too short password.
+-- This is done by using a single-character password, whereas the minimum is 6
+-- characters. The client deletion attempt fails as expected.
 testRemoveClientShortPwd :: Brig -> Http ()
 testRemoveClientShortPwd brig = do
   u <- randomUser brig
@@ -507,6 +521,38 @@ testRemoveClientShortPwd brig = do
           newClientCookie = Just defCookieLabel
         }
 
+-- The testRemoveClientIncorrectPwd test conforms to the following testing standards:
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
+--
+-- The test checks if a client can be deleted by providing a syntax-valid, but
+-- incorrect password. The client deletion attempt fails with a 403 error
+-- response.
+testRemoveClientIncorrectPwd :: Brig -> Http ()
+testRemoveClientIncorrectPwd brig = do
+  u <- randomUser brig
+  let uid = userId u
+  let Just email = userEmail u
+  -- Permanent client with attached cookie
+  login brig (defEmailLogin email) PersistentCookie
+    !!! const 200 === statusCode
+  numCookies <- countCookies brig uid defCookieLabel
+  liftIO $ Just 1 @=? numCookies
+  c <- responseJsonError =<< addClient brig uid (client PermanentClientType (someLastPrekeys !! 10))
+  resp <-
+    deleteClient brig uid (clientId c) (Just "abcdef")
+      <!! const 403 === statusCode
+  err :: Object <- responseJsonError resp
+  liftIO $ do
+    (err ^. at "code") @?= Just (Number 403)
+    (err ^. at "label") @?= Just (String "invalid-credentials")
+    (err ^. at "message") @?= Just (String "Authentication failed.")
+  where
+    client ty lk =
+      (defNewClient ty [somePrekeys !! 0] lk)
+        { newClientLabel = Just "Nexus 5x",
+          newClientCookie = Just defCookieLabel
+        }
+
 testUpdateClient :: Opt.Opts -> Brig -> Http ()
 testUpdateClient opts brig = do
   uid <- userId <$> randomUser brig
@@ -670,6 +716,11 @@ testMissingClient brig = do
 -- The testAddMultipleTemporary test conforms to the following testing standards:
 -- @SF.Provisioning @TSFI.RESTfulAPI @S2
 -- Legacy (galley)
+--
+-- Add temporary client, check that all services (both galley and
+-- brig) have registered it.  Add second temporary client, check
+-- again.  (NB: temp clients replace each other, there can always be
+-- at most one per account.)
 testAddMultipleTemporary :: Brig -> Galley -> Http ()
 testAddMultipleTemporary brig galley = do
   uid <- userId <$> randomUser brig
diff --git a/services/brig/test/integration/API/User/Handles.hs b/services/brig/test/integration/API/User/Handles.hs
index a1e4cba18d4..a3391991284 100644
--- a/services/brig/test/integration/API/User/Handles.hs
+++ b/services/brig/test/integration/API/User/Handles.hs
@@ -69,7 +69,12 @@ tests _cl _at conf p b c g =
 -- The next line contains a mapping from the testHandleUpdate test to the following test standards:
 -- @SF.Provisioning @TSFI.RESTfulAPI @S2
 --
--- Test changes to the user's handle.
+-- The test validates various updates to the user's handle. First, it attempts
+-- to set invalid handles. This fails. Then it successfully sets a valid handle.
+-- The user can retry setting the valid handle. The next scenario is for another
+-- user to attempt to reuse an already used handle, which fails. Finally,
+-- several scenarios of searching users by handle are explored, where users
+-- appear by handle. A user can also free a handle and then reclaim it again.
 testHandleUpdate :: Brig -> Cannon -> Http ()
 testHandleUpdate brig cannon = do
   user <- randomUser brig

From 0f967e0579b3653b19fb9dd3033e5589a3870c4b Mon Sep 17 00:00:00 2001
From: Leif Battermann <leif.battermann@gmail.com>
Date: Thu, 16 Dec 2021 12:57:39 +0100
Subject: [PATCH 13/74] SQSERVICES-1128 Tag Integration Tests
 (PROVISIONING/CHANNEL) (#1997)

* added integration test and tag for BSI

* clean up

* More spar tests.

Co-authored-by: fisx <mf@zerobuzz.net>
---
 .../test-integration/Test/Spar/APISpec.hs     | 156 ++++++++++++------
 .../Test/Spar/Scim/AuthSpec.hs                |  23 ++-
 .../Test/Spar/Scim/UserSpec.hs                |   2 +-
 3 files changed, 119 insertions(+), 62 deletions(-)

diff --git a/services/spar/test-integration/Test/Spar/APISpec.hs b/services/spar/test-integration/Test/Spar/APISpec.hs
index 980a761aa04..272674dac7a 100644
--- a/services/spar/test-integration/Test/Spar/APISpec.hs
+++ b/services/spar/test-integration/Test/Spar/APISpec.hs
@@ -67,10 +67,12 @@ import SAML2.WebSSO
     (-/),
   )
 import qualified SAML2.WebSSO as SAML
+import SAML2.WebSSO.API.Example (SimpleSP)
 import SAML2.WebSSO.Test.Lenses
 import SAML2.WebSSO.Test.MockResponse
 import SAML2.WebSSO.Test.Util
 import qualified Spar.Intra.BrigApp as Intra
+import qualified Spar.Sem.AReqIDStore as AReqIDStore
 import qualified Spar.Sem.BrigAccess as BrigAccess
 import qualified Spar.Sem.IdP as IdPEffect
 import Text.XML.DSig (SignPrivCreds, mkSignCredsWithCert)
@@ -198,6 +200,8 @@ specInitiateLogin = do
 specFinalizeLogin :: SpecWith TestEnv
 specFinalizeLogin = do
   describe "POST /sso/finalize-login" $ do
+    -- @SF.CHANNEL@TSFI.RESTfulAPI @S2 @S3
+    -- Receiving an invalid SAML token from client should not give the user a valid access token
     context "access denied" $ do
       it "responds with a very peculiar 'forbidden' HTTP response" $ do
         (_, tid, idp, (_, privcreds)) <- registerTestIdPWithMeta
@@ -206,12 +210,6 @@ specFinalizeLogin = do
         authnresp <- runSimpleSP $ mkAuthnResponse privcreds idp spmeta authnreq False
         sparresp <- submitAuthnResponse tid authnresp
         liftIO $ do
-          -- import Text.XML
-          -- putStrLn $ unlines
-          --   [ cs . renderLBS def { rsPretty = True } . fromSignedAuthnResponse $ authnresp
-          --   , show sparresp
-          --   , maybe "Nothing" cs (responseBody sparresp)
-          --   ]
           statusCode sparresp `shouldBe` 200
           let bdy = maybe "" (cs @LBS @String) (responseBody sparresp)
           bdy `shouldContain` "<?xml version=\"1.0\" encoding=\"UTF-8\"?>"
@@ -223,9 +221,7 @@ specFinalizeLogin = do
           bdy `shouldContain` "\"label\":\"forbidden\""
           bdy `shouldContain` "}, receiverOrigin)"
           hasPersistentCookieHeader sparresp `shouldBe` Left "no set-cookie header"
-      context "user has been deleted" $ do
-        it "responds with 'forbidden'" $ do
-          pendingWith "or do we want to un-delete the user?  or create a new one?"
+
     context "access granted" $ do
       let loginSuccess :: HasCallStack => ResponseLBS -> TestSpar ()
           loginSuccess sparresp = liftIO $ do
@@ -299,6 +295,8 @@ specFinalizeLogin = do
             authnresp <- runSimpleSP $ mkAuthnResponse privcreds idp3 spmeta authnreq True
             loginSuccess =<< submitAuthnResponse tid3 authnresp
 
+      -- @SF.CHANNEL@TSFI.RESTfulAPI @S2 @S3
+      -- Receiving an invalid SAML token from client should not give the user a valid access token
       context "idp sends user to two teams with same issuer, nameid" $ do
         it "fails" $ do
           skipIdPAPIVersions
@@ -358,7 +356,7 @@ specFinalizeLogin = do
               )
             liftIO $ threadDelay 100000 -- make sure deletion is done.  if we don't want to take
             -- the time, we should find another way to robustly
-            -- confirm that deletion has compelted in the background.
+            -- confirm that deletion has completed in the background.
 
           -- second login
           do
@@ -372,8 +370,8 @@ specFinalizeLogin = do
 
       context "known user A, but client device (probably a browser?) is already authenticated as another (probably non-sso) user B" $ do
         it "logs out user B, logs in user A" $ do
+          -- TODO(arianvp): Ask Matthias what this even means
           pending
-      -- TODO(arianvp): Ask Matthias what this even means
 
       context "more than one dsig cert" $ do
         it "accepts the first of two certs for signatures" $ do
@@ -381,47 +379,101 @@ specFinalizeLogin = do
         it "accepts the second of two certs for signatures" $ do
           pending
 
-    context "unknown IdP Issuer" $ do
-      it "rejects" $ do
-        (_, teamid, idp, (_, privcreds)) <- registerTestIdPWithMeta
-        authnreq <- negotiateAuthnRequest idp
-        spmeta <- getTestSPMetadata teamid
-        authnresp <-
-          runSimpleSP $
-            mkAuthnResponse
-              privcreds
-              (idp & idpMetadata . edIssuer .~ Issuer [uri|http://unknown-issuer/|])
-              spmeta
-              authnreq
-              True
-        sparresp <- submitAuthnResponse teamid authnresp
-        let shouldContainInBase64 :: String -> String -> Expectation
-            shouldContainInBase64 hay needle = cs hay'' `shouldContain` needle
-              where
-                Right (Just hay'') = decodeBase64 <$> validateBase64 hay'
-                hay' = cs $ f hay
-                  where
-                    -- exercise to the reader: do this more idiomatically!
-                    f (splitAt 5 -> ("<pre>", s)) = g s
-                    f (_ : s) = f s
-                    f "" = ""
-                    g (splitAt 6 -> ("</pre>", _)) = ""
-                    g (c : s) = c : g s
-                    g "" = ""
-        liftIO $ do
-          statusCode sparresp `shouldBe` 404
-          -- body should contain the error label in the title, the verbatim haskell error, and the request:
-          (cs . fromJust . responseBody $ sparresp) `shouldContain` "<title>wire:sso:error:not-found</title>"
-          (cs . fromJust . responseBody $ sparresp) `shouldContainInBase64` "CustomError (SparIdPNotFound"
-          (cs . fromJust . responseBody $ sparresp) `shouldContainInBase64` "Input {iName = \"SAMLResponse\""
-    -- TODO(arianvp): Ask Matthias what this even means
-    context "AuthnResponse does not match any request" $ do
-      it "rejects" $ do
-        pending
-    -- TODO(arianvp): Ask Matthias what this even means
-    context "AuthnResponse contains assertions that have been offered before" $ do
-      it "rejects" $ do
-        pending
+    context "bad AuthnResponse" $ do
+      let check ::
+            (IdP -> TestSpar SAML.AuthnRequest) ->
+            (SignPrivCreds -> IdP -> SAML.SPMetadata -> SAML.AuthnRequest -> SimpleSP SignedAuthnResponse) ->
+            (TeamId -> SignedAuthnResponse -> TestSpar (Response (Maybe LByteString))) ->
+            (ResponseLBS -> IO ()) ->
+            TestSpar ()
+          check mkareq mkaresp submitaresp checkresp = do
+            (_, teamid, idp, (_, privcreds)) <- registerTestIdPWithMeta
+            authnreq <- mkareq idp
+            spmeta <- getTestSPMetadata teamid
+            authnresp <-
+              runSimpleSP $
+                mkaresp
+                  privcreds
+                  idp
+                  spmeta
+                  authnreq
+            sparresp <- submitaresp teamid authnresp
+            liftIO $ checkresp sparresp
+
+          shouldContainInBase64 :: String -> String -> Expectation
+          shouldContainInBase64 hay needle = cs hay'' `shouldContain` needle
+            where
+              Right (Just hay'') = decodeBase64 <$> validateBase64 hay'
+              hay' = cs $ f hay
+                where
+                  -- exercise to the reader: do this more idiomatically!
+                  f (splitAt 5 -> ("<pre>", s)) = g s
+                  f (_ : s) = f s
+                  f "" = ""
+                  g (splitAt 6 -> ("</pre>", _)) = ""
+                  g (c : s) = c : g s
+                  g "" = ""
+
+      -- @SF.CHANNEL@TSFI.RESTfulAPI @S2 @S3
+      it "rejects saml responses with invalid issuer entity id" $ do
+        let mkareq = negotiateAuthnRequest
+            mkaresp privcreds idp spmeta authnreq =
+              mkAuthnResponse
+                privcreds
+                (idp & idpMetadata . edIssuer .~ Issuer [uri|http://unknown-issuer/|])
+                spmeta
+                authnreq
+                True
+            submitaresp = submitAuthnResponse
+            checkresp sparresp = do
+              statusCode sparresp `shouldBe` 404
+              -- body should contain the error label in the title, the verbatim haskell error, and the request:
+              (cs . fromJust . responseBody $ sparresp) `shouldContain` "<title>wire:sso:error:not-found</title>"
+              (cs . fromJust . responseBody $ sparresp) `shouldContainInBase64` "CustomError (SparIdPNotFound"
+              (cs . fromJust . responseBody $ sparresp) `shouldContainInBase64` "Input {iName = \"SAMLResponse\""
+        check mkareq mkaresp submitaresp checkresp
+
+      -- @SF.CHANNEL@TSFI.RESTfulAPI @S2 @S3
+      it "rejects saml responses signed with the wrong private key" $ do
+        (_, _, _, (_, badprivcreds)) <- registerTestIdPWithMeta
+        let mkareq = negotiateAuthnRequest
+            mkaresp _ idp spmeta authnreq =
+              mkAuthnResponse
+                badprivcreds
+                idp
+                spmeta
+                authnreq
+                True
+            submitaresp = submitAuthnResponse
+            checkresp sparresp = statusCode sparresp `shouldBe` 400
+        check mkareq mkaresp submitaresp checkresp
+
+      -- @SF.CHANNEL@TSFI.RESTfulAPI @S2 @S3
+      it "rejects saml responses to requests not in cassandra:spar.authreq" $ do
+        let mkareq idp = do
+              req <- negotiateAuthnRequest idp
+              runSpar $ AReqIDStore.unStore (req ^. SAML.rqID)
+              pure req
+            mkaresp privcreds idp spmeta authnreq = mkAuthnResponse privcreds idp spmeta authnreq True
+            submitaresp = submitAuthnResponse
+            checkresp sparresp = do
+              statusCode sparresp `shouldBe` 200
+              (cs . fromJust . responseBody $ sparresp) `shouldContain` "<title>wire:sso:error:forbidden</title>"
+              (cs . fromJust . responseBody $ sparresp) `shouldContain` "bad InResponseTo attribute(s)"
+        check mkareq mkaresp submitaresp checkresp
+
+      -- @SF.CHANNEL@TSFI.RESTfulAPI @S2 @S3
+      it "rejects saml responses already seen (and recorded in cassandra:spar.authresp)" $ do
+        let mkareq = negotiateAuthnRequest
+            mkaresp privcreds idp spmeta authnreq = mkAuthnResponse privcreds idp spmeta authnreq True
+            submitaresp teamid authnresp = do
+              _ <- submitAuthnResponse teamid authnresp
+              submitAuthnResponse teamid authnresp
+            checkresp sparresp = do
+              statusCode sparresp `shouldBe` 200
+              (cs . fromJust . responseBody $ sparresp) `shouldContain` "<title>wire:sso:error:forbidden</title>"
+        check mkareq mkaresp submitaresp checkresp
+
     context "IdP changes response format" $ do
       it "treats NameId case-insensitively" $ do
         (_ownerid, tid, idp, (_, privcreds)) <- registerTestIdPWithMeta
diff --git a/services/spar/test-integration/Test/Spar/Scim/AuthSpec.hs b/services/spar/test-integration/Test/Spar/Scim/AuthSpec.hs
index 6ac1b2bbf30..8d100b15459 100644
--- a/services/spar/test-integration/Test/Spar/Scim/AuthSpec.hs
+++ b/services/spar/test-integration/Test/Spar/Scim/AuthSpec.hs
@@ -52,7 +52,7 @@ spec = do
   specDeleteToken
   specListTokens
   describe "Miscellaneous" $ do
-    it "doesn't allow SCIM operations without a SCIM token" $ testAuthIsNeeded
+    it "doesn't allow SCIM operations with invalid or missing SCIM token" testAuthIsNeeded
 
 ----------------------------------------------------------------------------
 -- Token creation
@@ -60,11 +60,11 @@ spec = do
 -- | Tests for @POST /auth-tokens@.
 specCreateToken :: SpecWith TestEnv
 specCreateToken = describe "POST /auth-tokens" $ do
-  it "works" $ testCreateToken
-  it "respects the token limit" $ testTokenLimit
-  it "requires the team to have no more than one IdP" $ testNumIdPs
-  it "authorizes only admins and owners" $ testCreateTokenAuthorizesOnlyAdmins
-  it "requires a password" $ testCreateTokenRequiresPassword
+  it "works" testCreateToken
+  it "respects the token limit" testTokenLimit
+  it "requires the team to have no more than one IdP" testNumIdPs
+  it "authorizes only admins and owners" testCreateTokenAuthorizesOnlyAdmins
+  it "requires a password" testCreateTokenRequiresPassword
 
 -- FUTUREWORK: we should also test that for a password-less user, e.g. for an SSO user,
 -- reauthentication is not required. We currently (2019-03-05) can't test that because
@@ -362,10 +362,15 @@ testDeletedTokensAreUnlistable = do
 ----------------------------------------------------------------------------
 -- Miscellaneous tests
 
--- | Test that without a token, the SCIM API can't be used.
+-- @SF.PROVISIONING @TSFI.RESTfulAPI @S2
+-- This test verifies that the SCIM API responds with an authentication error
+-- and can't be used if it receives an invalid secret token
+-- or if no token is provided at all
 testAuthIsNeeded :: TestSpar ()
 testAuthIsNeeded = do
   env <- ask
+  -- Try to do @GET /Users@ with an invalid token and check that it fails
+  let invalidToken = ScimToken "this-is-an-invalid-token"
+  listUsers_ (Just invalidToken) Nothing (env ^. teSpar) !!! checkErr 401 Nothing
   -- Try to do @GET /Users@ without a token and check that it fails
-  listUsers_ Nothing Nothing (env ^. teSpar)
-    !!! checkErr 401 Nothing
+  listUsers_ Nothing Nothing (env ^. teSpar) !!! checkErr 401 Nothing
diff --git a/services/spar/test-integration/Test/Spar/Scim/UserSpec.hs b/services/spar/test-integration/Test/Spar/Scim/UserSpec.hs
index e04cf943236..ef91c6fd2fb 100644
--- a/services/spar/test-integration/Test/Spar/Scim/UserSpec.hs
+++ b/services/spar/test-integration/Test/Spar/Scim/UserSpec.hs
@@ -203,7 +203,7 @@ specCreateUser = describe "POST /Users" $ do
   context "team has no SAML IdP" $ do
     it "creates a user with PendingInvitation, and user can follow usual invitation process" $ do
       testCreateUserNoIdP
-    it "fails if no email can be extraced from externalId" $ do
+    it "fails if no email can be extracted from externalId" $ do
       testCreateUserNoIdPNoEmail
     it "doesn't list users that exceed their invitation period, and allows recreating them" $ do
       testCreateUserTimeout

From b50e9060ea4c87f0498499f18ac5667ba357d8ec Mon Sep 17 00:00:00 2001
From: fisx <mf@zerobuzz.net>
Date: Thu, 16 Dec 2021 17:22:28 +0100
Subject: [PATCH 14/74] Add end-tags for test tag parser (BSI audit). (#2001)

* Add end-tags for test tag parser (BSI audit).

* Changelog.

* Fixup

* Make test identifiers unique-ish.

* Fixup

* Fixup
---
 changelog.d/5-internal/sqservices-1118-2      |  1 +
 libs/zauth/test/ZAuth.hs                      |  2 +
 .../brig/test/integration/API/User/Account.hs | 10 +++++
 .../brig/test/integration/API/User/Auth.hs    |  8 ++++
 .../brig/test/integration/API/User/Client.hs  | 10 +++++
 .../brig/test/integration/API/User/Handles.hs |  2 +
 services/galley/test/integration/API.hs       | 16 ++++++++
 .../test-integration/Test/Spar/APISpec.hs     | 38 ++++++++++++-------
 .../Test/Spar/Scim/AuthSpec.hs                |  6 ++-
 .../Test/Spar/Scim/UserSpec.hs                |  2 +
 10 files changed, 80 insertions(+), 15 deletions(-)
 create mode 100644 changelog.d/5-internal/sqservices-1118-2

diff --git a/changelog.d/5-internal/sqservices-1118-2 b/changelog.d/5-internal/sqservices-1118-2
new file mode 100644
index 00000000000..0d240283035
--- /dev/null
+++ b/changelog.d/5-internal/sqservices-1118-2
@@ -0,0 +1 @@
+Tag integration tests for certification.
diff --git a/libs/zauth/test/ZAuth.hs b/libs/zauth/test/ZAuth.hs
index 67729073b45..65dbd8b4c83 100644
--- a/libs/zauth/test/ZAuth.hs
+++ b/libs/zauth/test/ZAuth.hs
@@ -105,6 +105,8 @@ testExpired p = do
   x <- liftIO $ runValidate p $ check t
   liftIO $ Left Expired @=? x
 
+-- @END
+
 testSignAndVerify :: V.Env -> Create ()
 testSignAndVerify p = do
   u <- liftIO nextRandom
diff --git a/services/brig/test/integration/API/User/Account.hs b/services/brig/test/integration/API/User/Account.hs
index f09af13c4a9..7c4959d9b92 100644
--- a/services/brig/test/integration/API/User/Account.hs
+++ b/services/brig/test/integration/API/User/Account.hs
@@ -177,6 +177,8 @@ testCreateUserWithInvalidVerificationCode brig = do
           ]
   postUserRegister' regEmail brig !!! const 404 === statusCode
 
+-- @END
+
 testUpdateUserEmailByTeamOwner :: Brig -> Http ()
 testUpdateUserEmailByTeamOwner brig = do
   (_, teamOwner, emailOwner : otherTeamMember : _) <- createPopulatedBindingTeamWithNamesAndHandles brig 2
@@ -305,6 +307,8 @@ testCreateUserEmptyName brig = do
   post (brig . path "/register" . contentJson . body p)
     !!! const 400 === statusCode
 
+-- @END
+
 -- The testCreateUserLongName test conforms to the following testing standards:
 -- @SF.Provisioning @TSFI.RESTfulAPI @S2
 --
@@ -319,6 +323,8 @@ testCreateUserLongName brig = do
   post (brig . path "/register" . contentJson . body p)
     !!! const 400 === statusCode
 
+-- @END
+
 testCreateUserAnon :: Brig -> Galley -> Http ()
 testCreateUserAnon brig galley = do
   let p =
@@ -437,6 +443,8 @@ testCreateUserConflict _ brig = do
     const 409 === statusCode
     const (Just "key-exists") === fmap Error.label . responseJsonMaybe
 
+-- @END
+
 -- The testCreateUserInvalidEmailOrPhone test conforms to the following testing standards:
 -- @SF.Provisioning @TSFI.RESTfulAPI @S2
 --
@@ -468,6 +476,8 @@ testCreateUserInvalidEmailOrPhone _ brig = do
   post (brig . path "/register" . contentJson . body reqPhone)
     !!! const 400 === statusCode
 
+-- @END
+
 testCreateUserBlacklist :: Opt.Opts -> Brig -> AWS.Env -> Http ()
 testCreateUserBlacklist (Opt.setRestrictUserCreation . Opt.optSettings -> Just True) _ _ = pure ()
 testCreateUserBlacklist _ brig aws =
diff --git a/services/brig/test/integration/API/User/Auth.hs b/services/brig/test/integration/API/User/Auth.hs
index 22ed0ea735e..f4ee97ea3f5 100644
--- a/services/brig/test/integration/API/User/Auth.hs
+++ b/services/brig/test/integration/API/User/Auth.hs
@@ -377,6 +377,8 @@ testLoginFailure brig = do
   login brig (PasswordLogin (LoginByEmail badmail) defPassword Nothing) PersistentCookie
     !!! const 403 === statusCode
 
+-- @END
+
 testThrottleLogins :: Opts.Opts -> Brig -> Http ()
 testThrottleLogins conf b = do
   -- Get the maximum amount of times we are allowed to login before
@@ -455,6 +457,8 @@ testLimitRetries conf brig = do
   liftIO $ threadDelay (1000000 * 2)
   login brig (defEmailLogin email) SessionCookie !!! const 200 === statusCode
 
+-- @END
+
 -------------------------------------------------------------------------------
 -- LegalHold Login
 
@@ -599,6 +603,8 @@ testInvalidCookie z b = do
     const 403 === statusCode
     const (Just "expired") =~= responseBody
 
+-- @END
+
 testInvalidToken :: Brig -> Http ()
 testInvalidToken b = do
   -- Syntactically invalid
@@ -967,6 +973,8 @@ testTooManyCookies config b = do
             )
         xxx -> error ("Unexpected status code when logging in: " ++ show xxx)
 
+-- @END
+
 testLogout :: Brig -> Http ()
 testLogout b = do
   Just email <- userEmail <$> randomUser b
diff --git a/services/brig/test/integration/API/User/Client.hs b/services/brig/test/integration/API/User/Client.hs
index 27a20c4c3e2..0a2e1315695 100644
--- a/services/brig/test/integration/API/User/Client.hs
+++ b/services/brig/test/integration/API/User/Client.hs
@@ -444,6 +444,8 @@ testTooManyClients opts brig = do
       const (Just "too-many-clients") === fmap Error.label . responseJsonMaybe
       const (Just "application/json;charset=utf-8") === getHeader "Content-Type"
 
+-- @END
+
 -- The testRemoveClient test conforms to the following testing standards:
 -- @SF.Provisioning @TSFI.RESTfulAPI @S2
 --
@@ -489,6 +491,8 @@ testRemoveClient hasPwd brig cannon = do
           newClientCookie = Just defCookieLabel
         }
 
+-- @END
+
 -- The testRemoveClientShortPwd test conforms to the following testing standards:
 -- @SF.Provisioning @TSFI.RESTfulAPI @S2
 --
@@ -521,6 +525,8 @@ testRemoveClientShortPwd brig = do
           newClientCookie = Just defCookieLabel
         }
 
+-- @END
+
 -- The testRemoveClientIncorrectPwd test conforms to the following testing standards:
 -- @SF.Provisioning @TSFI.RESTfulAPI @S2
 --
@@ -553,6 +559,8 @@ testRemoveClientIncorrectPwd brig = do
           newClientCookie = Just defCookieLabel
         }
 
+-- @END
+
 testUpdateClient :: Opt.Opts -> Brig -> Http ()
 testUpdateClient opts brig = do
   uid <- userId <$> randomUser brig
@@ -760,6 +768,8 @@ testAddMultipleTemporary brig galley = do
             . zUser u
       return $ Vec.length <$> (preview _Array =<< responseJsonMaybe @Value r)
 
+-- @END
+
 testPreKeyRace :: Brig -> Http ()
 testPreKeyRace brig = do
   uid <- userId <$> randomUser brig
diff --git a/services/brig/test/integration/API/User/Handles.hs b/services/brig/test/integration/API/User/Handles.hs
index a3391991284..5ea8fce5b74 100644
--- a/services/brig/test/integration/API/User/Handles.hs
+++ b/services/brig/test/integration/API/User/Handles.hs
@@ -138,6 +138,8 @@ testHandleUpdate brig cannon = do
   put (brig . path "/self/handle" . contentJson . zUser uid2 . zConn "c" . body update)
     !!! const 200 === statusCode
 
+-- @END
+
 testHandleRace :: Brig -> Http ()
 testHandleRace brig = do
   us <- replicateM 10 (userId <$> randomUser brig)
diff --git a/services/galley/test/integration/API.hs b/services/galley/test/integration/API.hs
index 0186f3448d8..13d41e2b806 100644
--- a/services/galley/test/integration/API.hs
+++ b/services/galley/test/integration/API.hs
@@ -452,6 +452,8 @@ postCryptoMessageVerifyMsgSentAndRejectIfMissingClient = do
       liftIO $ assertBool "unexpected equal clients" (bc /= bc2)
       assertNoMsg wsB2 (wsAssertOtr qconv qalice ac bc cipher)
 
+-- @END
+
 -- @SF.Separation @TSFI.RESTfulAPI @S2
 -- This test verifies basic mismatch behavior of the the JSON endpoint.
 postCryptoMessageVerifyRejectMissingClientAndRepondMissingPrekeysJson :: TestM ()
@@ -478,6 +480,8 @@ postCryptoMessageVerifyRejectMissingClientAndRepondMissingPrekeysJson = do
     Map.keys (userClientMap (getUserClientPrekeyMap p)) @=? [eve]
     Map.keys <$> Map.lookup eve (userClientMap (getUserClientPrekeyMap p)) @=? Just [ec]
 
+-- @END
+
 -- @SF.Separation @TSFI.RESTfulAPI @S2
 -- This test verifies basic mismatch behaviour of the protobuf endpoint.
 postCryptoMessageVerifyRejectMissingClientAndRepondMissingPrekeysProto :: TestM ()
@@ -506,6 +510,8 @@ postCryptoMessageVerifyRejectMissingClientAndRepondMissingPrekeysProto = do
     Map.keys (userClientMap (getUserClientPrekeyMap p)) @=? [eve]
     Map.keys <$> Map.lookup eve (userClientMap (getUserClientPrekeyMap p)) @=? Just [ec]
 
+-- @END
+
 -- | This test verifies behaviour when an unknown client posts the message. Only
 -- tests the Protobuf endpoint.
 postCryptoMessageNotAuthorizeUnknownClient :: TestM ()
@@ -547,6 +553,8 @@ postMessageClientNotInGroupDoesNotReceiveMsg = do
     checkEveGetsMsg
     checkChadDoesNotGetMsg
 
+-- @END
+
 -- @SF.Separation @TSFI.RESTfulAPI @S2
 -- This test verifies that when a client sends a message not to all clients of a group then the server should reject the message and sent a notification to the sender (412 Missing clients).
 -- The test is somewhat redundant because this is already tested as part of other tests already. This is a stand alone test that solely tests the behavior described above.
@@ -575,6 +583,8 @@ postMessageRejectIfMissingClients = do
     mkMsg :: ByteString -> (UserId, ClientId) -> (UserId, ClientId, Text)
     mkMsg text (userId, clientId) = (userId, clientId, toBase64Text text)
 
+-- @END
+
 -- @SF.Separation @TSFI.RESTfulAPI @S2
 -- This test verifies behaviour under various values of ignore_missing and
 -- report_missing. Only tests the JSON endpoint.
@@ -633,6 +643,8 @@ postCryptoMessageVerifyCorrectResponseIfIgnoreAndReportMissingQueryParam = do
   where
     listToByteString = BS.intercalate "," . map toByteString'
 
+-- @END
+
 -- | Sets up a conversation on Backend A known as "owning backend". All user's
 -- on this backend have names begining with 'A'. The conversation has a couple
 -- of users from backend B and one user from backend C.
@@ -832,6 +844,8 @@ postMessageQualifiedLocalOwningBackendMissingClients = do
       assertMismatchQualified mempty expectedMissing mempty mempty
     WS.assertNoEvent (1 # Second) [wsBob, wsChad]
 
+-- @END
+
 -- | Sets up a conversation on Backend A known as "owning backend". One of the
 -- users from Backend A will send the message, it is expected that message will
 -- be sent successfully.
@@ -1056,6 +1070,8 @@ postMessageQualifiedLocalOwningBackendIgnoreMissingClients = do
       assertMismatchQualified mempty expectedMissing mempty mempty
     WS.assertNoEvent (1 # Second) [wsBob, wsChad]
 
+-- @END
+
 postMessageQualifiedLocalOwningBackendFailedToSendClients :: TestM ()
 postMessageQualifiedLocalOwningBackendFailedToSendClients = do
   -- WS receive timeout
diff --git a/services/spar/test-integration/Test/Spar/APISpec.hs b/services/spar/test-integration/Test/Spar/APISpec.hs
index 272674dac7a..af466b1650e 100644
--- a/services/spar/test-integration/Test/Spar/APISpec.hs
+++ b/services/spar/test-integration/Test/Spar/APISpec.hs
@@ -200,9 +200,8 @@ specInitiateLogin = do
 specFinalizeLogin :: SpecWith TestEnv
 specFinalizeLogin = do
   describe "POST /sso/finalize-login" $ do
-    -- @SF.CHANNEL@TSFI.RESTfulAPI @S2 @S3
-    -- Receiving an invalid SAML token from client should not give the user a valid access token
-    context "access denied" $ do
+    -- @SF.Channel @TSFI.RESTfulAPI @S2 @S3
+    context "rejectsSAMLResponseSayingAccessNotGranted" $ do
       it "responds with a very peculiar 'forbidden' HTTP response" $ do
         (_, tid, idp, (_, privcreds)) <- registerTestIdPWithMeta
         authnreq <- negotiateAuthnRequest idp
@@ -222,6 +221,8 @@ specFinalizeLogin = do
           bdy `shouldContain` "}, receiverOrigin)"
           hasPersistentCookieHeader sparresp `shouldBe` Left "no set-cookie header"
 
+    -- @END
+
     context "access granted" $ do
       let loginSuccess :: HasCallStack => ResponseLBS -> TestSpar ()
           loginSuccess sparresp = liftIO $ do
@@ -295,9 +296,8 @@ specFinalizeLogin = do
             authnresp <- runSimpleSP $ mkAuthnResponse privcreds idp3 spmeta authnreq True
             loginSuccess =<< submitAuthnResponse tid3 authnresp
 
-      -- @SF.CHANNEL@TSFI.RESTfulAPI @S2 @S3
-      -- Receiving an invalid SAML token from client should not give the user a valid access token
-      context "idp sends user to two teams with same issuer, nameid" $ do
+      -- @SF.Channel @TSFI.RESTfulAPI @S2 @S3
+      context "rejectsSAMLResponseInWrongTeam" $ do
         it "fails" $ do
           skipIdPAPIVersions
             [ WireIdPAPIV1
@@ -321,6 +321,8 @@ specFinalizeLogin = do
             authnresp <- runSimpleSP $ mkAuthnResponseWithSubj subj privcreds idp2 spmeta authnreq True
             loginFailure =<< submitAuthnResponse tid2 authnresp
 
+      -- @END
+
       context "user is created once, then deleted in team settings, then can login again." $ do
         it "responds with 'allowed'" $ do
           (ownerid, teamid, idp, (_, privcreds)) <- registerTestIdPWithMeta
@@ -414,8 +416,8 @@ specFinalizeLogin = do
                   g (c : s) = c : g s
                   g "" = ""
 
-      -- @SF.CHANNEL@TSFI.RESTfulAPI @S2 @S3
-      it "rejects saml responses with invalid issuer entity id" $ do
+      -- @SF.Channel @TSFI.RESTfulAPI @S2 @S3
+      it "rejectsSAMLResponseFromWrongIssuer" $ do
         let mkareq = negotiateAuthnRequest
             mkaresp privcreds idp spmeta authnreq =
               mkAuthnResponse
@@ -433,8 +435,10 @@ specFinalizeLogin = do
               (cs . fromJust . responseBody $ sparresp) `shouldContainInBase64` "Input {iName = \"SAMLResponse\""
         check mkareq mkaresp submitaresp checkresp
 
-      -- @SF.CHANNEL@TSFI.RESTfulAPI @S2 @S3
-      it "rejects saml responses signed with the wrong private key" $ do
+      -- @END
+
+      -- @SF.Channel @TSFI.RESTfulAPI @S2 @S3
+      it "rejectsSAMLResponseSignedWithWrongKey" $ do
         (_, _, _, (_, badprivcreds)) <- registerTestIdPWithMeta
         let mkareq = negotiateAuthnRequest
             mkaresp _ idp spmeta authnreq =
@@ -448,8 +452,10 @@ specFinalizeLogin = do
             checkresp sparresp = statusCode sparresp `shouldBe` 400
         check mkareq mkaresp submitaresp checkresp
 
-      -- @SF.CHANNEL@TSFI.RESTfulAPI @S2 @S3
-      it "rejects saml responses to requests not in cassandra:spar.authreq" $ do
+      -- @END
+
+      -- @SF.Channel @TSFI.RESTfulAPI @S2 @S3
+      it "rejectsSAMLResponseIfRequestIsStale" $ do
         let mkareq idp = do
               req <- negotiateAuthnRequest idp
               runSpar $ AReqIDStore.unStore (req ^. SAML.rqID)
@@ -462,8 +468,10 @@ specFinalizeLogin = do
               (cs . fromJust . responseBody $ sparresp) `shouldContain` "bad InResponseTo attribute(s)"
         check mkareq mkaresp submitaresp checkresp
 
-      -- @SF.CHANNEL@TSFI.RESTfulAPI @S2 @S3
-      it "rejects saml responses already seen (and recorded in cassandra:spar.authresp)" $ do
+      -- @END
+
+      -- @SF.Channel @TSFI.RESTfulAPI @S2 @S3
+      it "rejectsSAMLResponseIfResponseIsStale" $ do
         let mkareq = negotiateAuthnRequest
             mkaresp privcreds idp spmeta authnreq = mkAuthnResponse privcreds idp spmeta authnreq True
             submitaresp teamid authnresp = do
@@ -474,6 +482,8 @@ specFinalizeLogin = do
               (cs . fromJust . responseBody $ sparresp) `shouldContain` "<title>wire:sso:error:forbidden</title>"
         check mkareq mkaresp submitaresp checkresp
 
+    -- @END
+
     context "IdP changes response format" $ do
       it "treats NameId case-insensitively" $ do
         (_ownerid, tid, idp, (_, privcreds)) <- registerTestIdPWithMeta
diff --git a/services/spar/test-integration/Test/Spar/Scim/AuthSpec.hs b/services/spar/test-integration/Test/Spar/Scim/AuthSpec.hs
index 8d100b15459..bee95ef5112 100644
--- a/services/spar/test-integration/Test/Spar/Scim/AuthSpec.hs
+++ b/services/spar/test-integration/Test/Spar/Scim/AuthSpec.hs
@@ -178,6 +178,8 @@ testCreateTokenAuthorizesOnlyAdmins = do
   (mkUser Galley.RoleAdmin >>= createToken')
     !!! const 200 === statusCode
 
+-- @END
+
 -- | Test that for a user with a password, token creation requires reauthentication (i.e. the
 -- field @"password"@ should be provided).
 --
@@ -362,7 +364,7 @@ testDeletedTokensAreUnlistable = do
 ----------------------------------------------------------------------------
 -- Miscellaneous tests
 
--- @SF.PROVISIONING @TSFI.RESTfulAPI @S2
+-- @SF.Provisioning @TSFI.RESTfulAPI @S2
 -- This test verifies that the SCIM API responds with an authentication error
 -- and can't be used if it receives an invalid secret token
 -- or if no token is provided at all
@@ -374,3 +376,5 @@ testAuthIsNeeded = do
   listUsers_ (Just invalidToken) Nothing (env ^. teSpar) !!! checkErr 401 Nothing
   -- Try to do @GET /Users@ without a token and check that it fails
   listUsers_ Nothing Nothing (env ^. teSpar) !!! checkErr 401 Nothing
+
+-- @END
diff --git a/services/spar/test-integration/Test/Spar/Scim/UserSpec.hs b/services/spar/test-integration/Test/Spar/Scim/UserSpec.hs
index ef91c6fd2fb..118ecc67450 100644
--- a/services/spar/test-integration/Test/Spar/Scim/UserSpec.hs
+++ b/services/spar/test-integration/Test/Spar/Scim/UserSpec.hs
@@ -479,6 +479,8 @@ testCreateRejectsInvalidHandle = do
   createUser_ (Just tok) (user {Scim.User.userName = "#invalid name"}) (env ^. teSpar)
     !!! const 400 === statusCode
 
+-- @END
+
 -- | Test that user creation fails if handle is already in use (even on different team).
 testCreateRejectsTakenHandle :: TestSpar ()
 testCreateRejectsTakenHandle = do

From 4e1b8fbbaa079ac909d5945d971dea427ccdbbde Mon Sep 17 00:00:00 2001
From: Sandy Maguire <sandy@sandymaguire.me>
Date: Thu, 16 Dec 2021 12:11:20 -0800
Subject: [PATCH 15/74] Polysemy Spar: Laws for DefaultSsoCode, Now, IdP and
 ScimExternalIdStore (#1940)

---
 changelog.d/5-internal/in-mem-specs           |   1 +
 services/spar/package.yaml                    |   2 +-
 services/spar/spar.cabal                      |   7 +-
 services/spar/src/Spar/Sem/DefaultSsoCode.hs  |   2 +
 services/spar/src/Spar/Sem/Now.hs             |   2 +
 .../spar/src/Spar/Sem/ScimExternalIdStore.hs  |   2 +
 services/spar/test/Arbitrary.hs               |   8 +-
 .../test/Test/Spar/Sem/DefaultSsoCodeSpec.hs  | 173 ++++++++++
 .../Test/Spar/Sem/IdPRawMetadataStoreSpec.hs  | 135 +++++---
 services/spar/test/Test/Spar/Sem/IdPSpec.hs   | 320 ++++++++++++++++--
 services/spar/test/Test/Spar/Sem/NowSpec.hs   |  70 ++++
 .../Test/Spar/Sem/ScimExternalIdStoreSpec.hs  | 192 +++++++++++
 stack.yaml                                    |   2 +-
 stack.yaml.lock                               |   8 +-
 14 files changed, 825 insertions(+), 99 deletions(-)
 create mode 100644 changelog.d/5-internal/in-mem-specs
 create mode 100644 services/spar/test/Test/Spar/Sem/DefaultSsoCodeSpec.hs
 create mode 100644 services/spar/test/Test/Spar/Sem/NowSpec.hs
 create mode 100644 services/spar/test/Test/Spar/Sem/ScimExternalIdStoreSpec.hs

diff --git a/changelog.d/5-internal/in-mem-specs b/changelog.d/5-internal/in-mem-specs
new file mode 100644
index 00000000000..57fd8d6b57a
--- /dev/null
+++ b/changelog.d/5-internal/in-mem-specs
@@ -0,0 +1 @@
+Added laws for DefaultSsoCode, Now, IdP and ScimExternalIdStore
diff --git a/services/spar/package.yaml b/services/spar/package.yaml
index fc27e3fb8a1..935e8cbfe0f 100644
--- a/services/spar/package.yaml
+++ b/services/spar/package.yaml
@@ -99,7 +99,7 @@ tests:
       - QuickCheck
       - spar
       - uri-bytestring
-      - polysemy-check
+      - polysemy-check >= 0.9
 
 executables:
   spar:
diff --git a/services/spar/spar.cabal b/services/spar/spar.cabal
index a71562b0f42..cc6c8bb7890 100644
--- a/services/spar/spar.cabal
+++ b/services/spar/spar.cabal
@@ -4,7 +4,7 @@ cabal-version: 1.12
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 34138a2c7fa249191ae03bc1581a7c95c94b12080f104da084a9bc37ac54c9ad
+-- hash: 4a323def34cfdc7673cea02e13fe518d53d7b04bae552bff2d0784dfb6964162
 
 name:           spar
 version:        0.1
@@ -514,8 +514,11 @@ test-suite spec
       Test.Spar.Intra.BrigSpec
       Test.Spar.Roundtrip.ByteString
       Test.Spar.ScimSpec
+      Test.Spar.Sem.DefaultSsoCodeSpec
       Test.Spar.Sem.IdPRawMetadataStoreSpec
       Test.Spar.Sem.IdPSpec
+      Test.Spar.Sem.NowSpec
+      Test.Spar.Sem.ScimExternalIdStoreSpec
       Test.Spar.TypesSpec
       Paths_spar
   hs-source-dirs:
@@ -564,7 +567,7 @@ test-suite spec
     , network-uri
     , optparse-applicative
     , polysemy
-    , polysemy-check
+    , polysemy-check >=0.9
     , polysemy-plugin
     , raw-strings-qq
     , retry
diff --git a/services/spar/src/Spar/Sem/DefaultSsoCode.hs b/services/spar/src/Spar/Sem/DefaultSsoCode.hs
index c18f0334b15..9f594c16b4f 100644
--- a/services/spar/src/Spar/Sem/DefaultSsoCode.hs
+++ b/services/spar/src/Spar/Sem/DefaultSsoCode.hs
@@ -9,4 +9,6 @@ data DefaultSsoCode m a where
   Store :: SAML.IdPId -> DefaultSsoCode m ()
   Delete :: DefaultSsoCode m ()
 
+deriving instance Show (DefaultSsoCode m a)
+
 makeSem ''DefaultSsoCode
diff --git a/services/spar/src/Spar/Sem/Now.hs b/services/spar/src/Spar/Sem/Now.hs
index 63d8e740ad5..f5a701b1a03 100644
--- a/services/spar/src/Spar/Sem/Now.hs
+++ b/services/spar/src/Spar/Sem/Now.hs
@@ -9,6 +9,8 @@ data Now m a where
 
 makeSem ''Now
 
+deriving instance Show (Now m a)
+
 -- | Check a time against 'Now', checking if it's still alive (hasn't occurred yet.)
 boolTTL ::
   Member Now r =>
diff --git a/services/spar/src/Spar/Sem/ScimExternalIdStore.hs b/services/spar/src/Spar/Sem/ScimExternalIdStore.hs
index b2a43f6b327..3978108770c 100644
--- a/services/spar/src/Spar/Sem/ScimExternalIdStore.hs
+++ b/services/spar/src/Spar/Sem/ScimExternalIdStore.hs
@@ -10,4 +10,6 @@ data ScimExternalIdStore m a where
   Lookup :: TeamId -> Email -> ScimExternalIdStore m (Maybe UserId)
   Delete :: TeamId -> Email -> ScimExternalIdStore m ()
 
+deriving instance Show (ScimExternalIdStore m a)
+
 makeSem ''ScimExternalIdStore
diff --git a/services/spar/test/Arbitrary.hs b/services/spar/test/Arbitrary.hs
index bc7ca9fae4e..a5536460c6c 100644
--- a/services/spar/test/Arbitrary.hs
+++ b/services/spar/test/Arbitrary.hs
@@ -23,7 +23,7 @@
 module Arbitrary where
 
 import Data.Aeson
-import Data.Id (TeamId)
+import Data.Id (TeamId, UserId)
 import Data.Proxy
 import Data.String.Conversions (cs)
 import Data.Swagger hiding (Header (..))
@@ -97,6 +97,8 @@ instance Arbitrary E.Replaced where
 
 instance CoArbitrary a => CoArbitrary (E.GetIdPResult a)
 
+-- TODO(sandy): IdPIds are unlikely to collide. Does the size parameter
+-- affect them?
 instance CoArbitrary IdPId
 
 instance CoArbitrary WireIdP
@@ -105,6 +107,10 @@ instance CoArbitrary WireIdPAPIVersion
 
 instance CoArbitrary TeamId
 
+instance CoArbitrary UserId
+
+instance CoArbitrary Time
+
 instance CoArbitrary Issuer where
   coarbitrary (Issuer ur) = coarbitrary $ show ur
 
diff --git a/services/spar/test/Test/Spar/Sem/DefaultSsoCodeSpec.hs b/services/spar/test/Test/Spar/Sem/DefaultSsoCodeSpec.hs
new file mode 100644
index 00000000000..9a638ba9907
--- /dev/null
+++ b/services/spar/test/Test/Spar/Sem/DefaultSsoCodeSpec.hs
@@ -0,0 +1,173 @@
+{-# LANGUAGE QuantifiedConstraints #-}
+{-# OPTIONS_GHC -Wno-orphans #-}
+{-# OPTIONS_GHC -fplugin=Polysemy.Plugin #-}
+
+module Test.Spar.Sem.DefaultSsoCodeSpec where
+
+import Arbitrary ()
+import Imports
+import Polysemy
+import Polysemy.Check
+import SAML2.WebSSO.Types
+import qualified Spar.Sem.DefaultSsoCode as E
+import Spar.Sem.DefaultSsoCode.Mem
+import Test.Hspec
+import Test.Hspec.QuickCheck
+import Test.QuickCheck
+
+deriveGenericK ''E.DefaultSsoCode
+
+propsForInterpreter ::
+  PropConstraints r f =>
+  String ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Spec
+propsForInterpreter interpreter lower = do
+  describe interpreter $ do
+    prop "delete/delete" $ prop_deleteDelete Nothing lower
+    prop "delete/get" $ prop_deleteGet Nothing lower
+    prop "delete/store" $ prop_deleteStore Nothing lower
+    prop "get/store" $ prop_getStore Nothing lower
+    prop "store/delete" $ prop_storeStore Nothing lower
+    prop "store/get" $ prop_storeGet Nothing lower
+    prop "store/store" $ prop_storeStore Nothing lower
+
+spec :: Spec
+spec = modifyMaxSuccess (const 1000) $ do
+  propsForInterpreter "defaultSsoCodeToMem" $ pure . run . defaultSsoCodeToMem
+
+-- | All the constraints we need to generalize properties in this module.
+-- A regular type synonym doesn't work due to dreaded impredicative
+-- polymorphism.
+class
+  (Functor f, Member E.DefaultSsoCode r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
+  PropConstraints r f
+
+instance
+  (Functor f, Member E.DefaultSsoCode r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
+  PropConstraints r f
+
+prop_storeGet ::
+  PropConstraints r f =>
+  Maybe (f (Maybe IdPId) -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_storeGet =
+  prepropLaw @'[E.DefaultSsoCode] $ do
+    s <- arbitrary
+    pure $
+      simpleLaw
+        ( do
+            E.store s
+            E.get
+        )
+        ( do
+            E.store s
+            pure (Just s)
+        )
+
+prop_getStore ::
+  PropConstraints r f =>
+  Maybe (f () -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_getStore =
+  prepropLaw @'[E.DefaultSsoCode] $ do
+    pure $
+      simpleLaw
+        ( do
+            E.get >>= maybe (pure ()) E.store
+        )
+        ( do
+            pure ()
+        )
+
+prop_storeDelete ::
+  PropConstraints r f =>
+  Maybe (f () -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_storeDelete =
+  prepropLaw @'[E.DefaultSsoCode] $ do
+    s <- arbitrary
+    pure $
+      simpleLaw
+        ( do
+            E.store s
+            E.delete
+        )
+        ( do
+            E.delete
+        )
+
+prop_deleteStore ::
+  PropConstraints r f =>
+  Maybe (f () -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_deleteStore =
+  prepropLaw @'[E.DefaultSsoCode] $ do
+    s <- arbitrary
+    pure $
+      simpleLaw
+        ( do
+            E.delete
+            E.store s
+        )
+        ( do
+            E.store s
+        )
+
+prop_storeStore ::
+  PropConstraints r f =>
+  Maybe (f () -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_storeStore =
+  prepropLaw @'[E.DefaultSsoCode] $ do
+    s <- arbitrary
+    s' <- arbitrary
+    pure $
+      simpleLaw
+        ( do
+            E.store s
+            E.store s'
+        )
+        ( do
+            E.store s'
+        )
+
+prop_deleteDelete ::
+  PropConstraints r f =>
+  Maybe (f () -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_deleteDelete =
+  prepropLaw @'[E.DefaultSsoCode] $ do
+    pure $
+      simpleLaw
+        ( do
+            E.delete
+            E.delete
+        )
+        ( do
+            E.delete
+        )
+
+prop_deleteGet ::
+  PropConstraints r f =>
+  Maybe (f (Maybe IdPId) -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_deleteGet =
+  prepropLaw @'[E.DefaultSsoCode] $ do
+    pure $
+      simpleLaw
+        ( do
+            E.delete
+            E.get
+        )
+        ( do
+            E.delete
+            pure Nothing
+        )
diff --git a/services/spar/test/Test/Spar/Sem/IdPRawMetadataStoreSpec.hs b/services/spar/test/Test/Spar/Sem/IdPRawMetadataStoreSpec.hs
index c1d5f6b9b81..28aa64122dd 100644
--- a/services/spar/test/Test/Spar/Sem/IdPRawMetadataStoreSpec.hs
+++ b/services/spar/test/Test/Spar/Sem/IdPRawMetadataStoreSpec.hs
@@ -1,3 +1,4 @@
+{-# LANGUAGE QuantifiedConstraints #-}
 {-# OPTIONS_GHC -Wno-orphans #-}
 {-# OPTIONS_GHC -fplugin=Polysemy.Plugin #-}
 
@@ -15,97 +16,121 @@ import Test.QuickCheck
 
 deriveGenericK ''E.IdPRawMetadataStore
 
+class
+  (Functor f, Member E.IdPRawMetadataStore r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
+  PropConstraints r f
+
+instance
+  (Functor f, Member E.IdPRawMetadataStore r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
+  PropConstraints r f
+
 prop_storeGetRaw ::
-  Member E.IdPRawMetadataStore r =>
-  (forall a. Sem r a -> IO (RawState, a)) ->
+  PropConstraints r f =>
+  Maybe (f (Maybe Text) -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
   Property
-prop_storeGetRaw x =
+prop_storeGetRaw =
   prepropLaw @'[E.IdPRawMetadataStore]
     ( do
         idpid <- arbitrary
         t <- arbitrary
-        pure
-          ( do
-              E.store idpid t
-              E.get idpid,
-            do
-              E.store idpid t
-              pure (Just t)
-          )
+        pure $
+          simpleLaw
+            ( do
+                E.store idpid t
+                E.get idpid
+            )
+            ( do
+                E.store idpid t
+                pure (Just t)
+            )
     )
-    x
 
 prop_storeStoreRaw ::
-  Member E.IdPRawMetadataStore r =>
-  (forall a. Sem r a -> IO (RawState, a)) ->
+  PropConstraints r f =>
+  Maybe (f (Maybe Text) -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
   Property
-prop_storeStoreRaw x =
+prop_storeStoreRaw =
   prepropLaw @'[E.IdPRawMetadataStore]
     ( do
         idpid <- arbitrary
         t1 <- arbitrary
         t2 <- arbitrary
-        pure
-          ( do
-              E.store idpid t1
-              E.store idpid t2,
-            do
-              E.store idpid t2
-          )
+        pure $
+          simpleLaw
+            ( do
+                E.store idpid t1
+                E.store idpid t2
+                E.get idpid
+            )
+            ( do
+                E.store idpid t2
+                E.get idpid
+            )
     )
-    x
 
 prop_storeDeleteRaw ::
-  Member E.IdPRawMetadataStore r =>
-  (forall a. Sem r a -> IO (RawState, a)) ->
+  PropConstraints r f =>
+  Maybe (f (Maybe Text) -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
   Property
-prop_storeDeleteRaw x =
-  prepropLaw @'[E.IdPRawMetadataStore]
-    ( do
-        idpid <- arbitrary
-        t <- arbitrary
-        pure
+prop_storeDeleteRaw =
+  prepropLaw @'[E.IdPRawMetadataStore] $
+    do
+      idpid <- arbitrary
+      t <- arbitrary
+      pure $
+        simpleLaw
           ( do
               E.store idpid t
-              E.delete idpid,
-            do
               E.delete idpid
+              E.get idpid
+          )
+          ( do
+              E.delete idpid
+              E.get idpid
           )
-    )
-    x
 
 prop_deleteGetRaw ::
-  Member E.IdPRawMetadataStore r =>
-  (forall a. Sem r a -> IO (RawState, a)) ->
+  PropConstraints r f =>
+  Maybe (f (Maybe Text) -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
   Property
-prop_deleteGetRaw x =
+prop_deleteGetRaw =
   prepropLaw @'[E.IdPRawMetadataStore]
     ( do
         idpid <- arbitrary
-        pure
-          ( do
-              E.delete idpid
-              E.get idpid,
-            do
-              E.delete idpid
-              pure Nothing
-          )
+        t <- arbitrary
+        pure $
+          Law
+            { lawLhs = do
+                E.delete idpid
+                E.get idpid,
+              lawRhs = do
+                E.delete idpid
+                pure Nothing,
+              lawPrelude =
+                [ E.store idpid t
+                ],
+              lawPostlude = [] @(Sem _ ())
+            }
     )
-    x
 
 testInterpreter :: Sem '[E.IdPRawMetadataStore] a -> IO (RawState, a)
 testInterpreter = pure . run . idpRawMetadataStoreToMem
 
 propsForInterpreter ::
-  Member E.IdPRawMetadataStore r =>
-  (forall a. Sem r a -> IO (RawState, a)) ->
+  PropConstraints r f =>
+  (forall x. f x -> x) ->
+  (forall a. Sem r a -> IO (f a)) ->
   Spec
-propsForInterpreter lower = do
-  prop "store/store" $ prop_storeStoreRaw lower
-  prop "store/get" $ prop_storeGetRaw lower
-  prop "store/deleteRawMetadata" $ prop_storeDeleteRaw lower
-  prop "deleteRawMetadata/get" $ prop_deleteGetRaw lower
+propsForInterpreter extract lower = do
+  prop "store/store" $ prop_storeStoreRaw (Just $ constructorLabel . extract) lower
+  prop "store/get" $ prop_storeGetRaw (Just $ constructorLabel . extract) lower
+  prop "store/delete" $ prop_storeDeleteRaw (Just $ constructorLabel . extract) lower
+  prop "delete/get" $ prop_deleteGetRaw (Just $ constructorLabel . extract) lower
 
 spec :: Spec
 spec = modifyMaxSuccess (const 1000) $ do
-  propsForInterpreter testInterpreter
+  propsForInterpreter snd testInterpreter
diff --git a/services/spar/test/Test/Spar/Sem/IdPSpec.hs b/services/spar/test/Test/Spar/Sem/IdPSpec.hs
index 162f5b1625f..ef1eba1f471 100644
--- a/services/spar/test/Test/Spar/Sem/IdPSpec.hs
+++ b/services/spar/test/Test/Spar/Sem/IdPSpec.hs
@@ -1,72 +1,322 @@
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE QuantifiedConstraints #-}
+{-# LANGUAGE StandaloneDeriving #-}
 {-# OPTIONS_GHC -Wno-orphans #-}
 {-# OPTIONS_GHC -fplugin=Polysemy.Plugin #-}
 
 module Test.Spar.Sem.IdPSpec where
 
 import Arbitrary ()
+import Control.Arrow
 import Control.Lens
+import Data.Data (Data)
 import Imports
 import Polysemy
 import Polysemy.Check
 import SAML2.WebSSO.Types
+import qualified SAML2.WebSSO.Types as SAML
 import qualified Spar.Sem.IdP as E
 import Spar.Sem.IdP.Mem
 import Test.Hspec
 import Test.Hspec.QuickCheck
 import Test.QuickCheck
+import qualified Wire.API.User.IdentityProvider as IP
 
 deriveGenericK ''E.IdP
 
+deriving instance Data (E.GetIdPResult IdPId)
+
+deriving instance Data (IdPId)
+
+propsForInterpreter ::
+  (Member E.IdP r, PropConstraints r f) =>
+  String ->
+  (forall x. f x -> x) ->
+  (forall x. Show x => Maybe (f x -> String)) ->
+  (forall x. Sem r x -> IO (f x)) ->
+  Spec
+propsForInterpreter interpreter extract labeler lower = do
+  describe interpreter $ do
+    prop "deleteConfig/deleteConfig" $ prop_deleteDelete Nothing lower
+    prop "deleteConfig/getConfig" $ prop_deleteGet labeler lower
+    prop "getConfig/storeConfig" $ prop_getStore (Just $ show . (() <$) . extract) lower
+    prop "getConfig/getConfig" $ prop_getGet (Just $ show . ((() <$) *** (() <$)) . extract) lower
+    prop "setReplacedBy/clearReplacedBy" $ prop_setClear labeler lower
+    prop "setReplacedBy/getReplacedBy" $ prop_setGet (Just $ show . (fmap (() <$)) . extract) lower
+    prop "setReplacedBy/setReplacedBy" $ prop_setSet (Just $ show . (fmap (() <$)) . extract) lower
+    prop "storeConfig/getConfig" $ prop_storeGet (Just $ show . (() <$) . extract) lower
+    prop "storeConfig/getIdByIssuerWithoutTeam" $ prop_storeGetByIssuer (Just $ constructorLabel . extract) lower
+    prop "storeConfig/storeConfig (different keys)" $ prop_storeStoreInterleave Nothing lower
+    prop "storeConfig/storeConfig (same keys)" $ prop_storeStore Nothing lower
+
+spec :: Spec
+spec = modifyMaxSuccess (const 1000) $ do
+  propsForInterpreter "idPToMem" snd (Just $ show . snd) $ pure . run . idPToMem
+
+getReplacedBy :: Member E.IdP r => SAML.IdPId -> Sem r (Maybe (Maybe SAML.IdPId))
+getReplacedBy idpid = fmap (view $ SAML.idpExtraInfo . IP.wiReplacedBy) <$> E.getConfig idpid
+
+-- | All the constraints we need to generalize properties in this module.
+-- A regular type synonym doesn't work due to dreaded impredicative
+-- polymorphism.
+class
+  (Functor f, Member E.IdP r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
+  PropConstraints r f
+
+instance
+  (Functor f, Member E.IdP r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
+  PropConstraints r f
+
+prop_storeStore ::
+  PropConstraints r f =>
+  Maybe (f () -> String) ->
+  (forall x. Sem r x -> IO (f x)) ->
+  Property
+prop_storeStore =
+  prepropLaw @'[E.IdP] $ do
+    s <- arbitrary
+    s' <- arbitrary
+    pure $
+      Law
+        { lawLhs = do
+            E.storeConfig $ s & SAML.idpId .~ s' ^. SAML.idpId
+            E.storeConfig s',
+          lawRhs = do
+            E.storeConfig s',
+          lawPrelude = [],
+          lawPostlude = [E.getConfig $ s' ^. SAML.idpId]
+        }
+
+prop_storeStoreInterleave ::
+  PropConstraints r f =>
+  Maybe (f () -> String) ->
+  (forall x. Sem r x -> IO (f x)) ->
+  Property
+prop_storeStoreInterleave =
+  prepropLaw @'[E.IdP] $ do
+    s <- arbitrary
+    s' <- arbitrary
+    !_ <-
+      when (s ^. SAML.idpId == s' ^. SAML.idpId) discard
+    pure $
+      Law
+        { lawLhs = do
+            E.storeConfig s
+            E.storeConfig s',
+          lawRhs = do
+            E.storeConfig s'
+            E.storeConfig s,
+          lawPrelude = [],
+          lawPostlude = [E.getConfig $ s ^. SAML.idpId, E.getConfig $ s' ^. SAML.idpId]
+        }
+
 prop_storeGet ::
-  Member E.IdP r =>
-  (forall a. Sem r a -> IO (TypedState, a)) ->
+  PropConstraints r f =>
+  Maybe (f (Maybe IP.IdP) -> String) ->
+  (forall x. Sem r x -> IO (f x)) ->
   Property
-prop_storeGet x =
-  prepropLaw @'[E.IdP]
-    ( do
-        s <- arbitrary
-        pure
+prop_storeGet =
+  prepropLaw @'[E.IdP] $
+    do
+      s <- arbitrary
+      pure $
+        simpleLaw
           ( do
               E.storeConfig s
-              E.getConfig $ s ^. idpId,
-            do
+              E.getConfig $ s ^. idpId
+          )
+          ( do
               E.storeConfig s
               pure (Just s)
           )
-    )
-    x
+
+prop_deleteGet ::
+  PropConstraints r f =>
+  Maybe (f (Maybe IP.IdP) -> String) ->
+  (forall x. Sem r x -> IO (f x)) ->
+  Property
+prop_deleteGet =
+  prepropLaw @'[E.IdP] $ do
+    s <- arbitrary
+    pure $
+      Law
+        { lawLhs = do
+            E.deleteConfig s
+            E.getConfig $ s ^. SAML.idpId,
+          lawRhs = do
+            E.deleteConfig s
+            pure Nothing,
+          lawPrelude =
+            [ E.storeConfig s
+            ],
+          lawPostlude = [] :: [Sem r ()]
+        }
+
+prop_deleteDelete ::
+  PropConstraints r f =>
+  Maybe (f () -> String) ->
+  (forall x. Sem r x -> IO (f x)) ->
+  Property
+prop_deleteDelete =
+  prepropLaw @'[E.IdP] $ do
+    s <- arbitrary
+    pure $
+      simpleLaw
+        ( do
+            E.deleteConfig s
+            E.deleteConfig s
+        )
+        ( do
+            E.deleteConfig s
+        )
 
 prop_storeGetByIssuer ::
-  Member E.IdP r =>
-  (forall a. Sem r a -> IO (TypedState, a)) ->
+  PropConstraints r f =>
+  Maybe (f (E.GetIdPResult IdPId) -> String) ->
+  (forall x. Sem r x -> IO (f x)) ->
   Property
-prop_storeGetByIssuer x =
-  prepropLaw @'[E.IdP]
-    ( do
-        s <- arbitrary
-        pure
+prop_storeGetByIssuer =
+  prepropLaw @'[E.IdP] $
+    do
+      s <- arbitrary
+      pure $
+        simpleLaw
           ( do
               E.storeConfig s
-              E.getIdByIssuerWithoutTeam $ s ^. idpMetadata . edIssuer,
-            do
+              E.getIdByIssuerWithoutTeam $ s ^. idpMetadata . edIssuer
+          )
+          ( do
               E.storeConfig s
               pure $ E.GetIdPFound $ s ^. idpId
           )
-    )
-    x
 
-testInterpreter :: Sem '[E.IdP] a -> IO (TypedState, a)
-testInterpreter = pure . run . idPToMem
+prop_setClear ::
+  PropConstraints r f =>
+  Maybe (f (Maybe (Maybe IdPId)) -> String) ->
+  (forall x. Sem r x -> IO (f x)) ->
+  Property
+prop_setClear =
+  prepropLaw @'[E.IdP] $
+    do
+      idp <- arbitrary
+      replaced_id <- arbitrary
+      let replaced = E.Replaced replaced_id
+      replacing <- arbitrary
+      pure $
+        Law
+          { lawLhs = do
+              E.setReplacedBy replaced replacing
+              E.clearReplacedBy replaced
+              getReplacedBy replaced_id,
+            lawRhs = do
+              E.clearReplacedBy replaced
+              getReplacedBy replaced_id,
+            lawPrelude =
+              [ E.storeConfig $ idp & SAML.idpId .~ replaced_id
+              ],
+            lawPostlude = [] @(Sem _ ())
+          }
 
-propsForInterpreter ::
-  Member E.IdP r =>
-  (forall a. Sem r a -> IO (TypedState, a)) ->
-  Spec
-propsForInterpreter lower = do
-  describe "Config Actions" $ do
-    prop "storeConfig/getConfig" $ prop_storeGet lower
-    prop "storeConfig/getIdByIssuerWithoutTeam" $ prop_storeGetByIssuer lower
+prop_getGet ::
+  forall r f.
+  PropConstraints r f =>
+  Maybe (f (Maybe IP.IdP, Maybe IP.IdP) -> String) ->
+  (forall x. Sem r x -> IO (f x)) ->
+  Property
+prop_getGet =
+  prepropLaw @'[E.IdP] $
+    do
+      idpid <- arbitrary
+      idp <- arbitrary
+      pure $
+        Law
+          { lawLhs = do
+              liftA2 (,) (E.getConfig idpid) (E.getConfig idpid),
+            lawRhs = do
+              cfg <- E.getConfig idpid
+              pure (cfg, cfg),
+            lawPrelude =
+              [ E.storeConfig $ idp & SAML.idpId .~ idpid
+              ],
+            lawPostlude = [] :: [Sem r ()]
+          }
 
-spec :: Spec
-spec = modifyMaxSuccess (const 1000) $ do
-  propsForInterpreter testInterpreter
+prop_getStore ::
+  PropConstraints r f =>
+  Maybe (f (Maybe IP.IdP) -> String) ->
+  (forall x. Sem r x -> IO (f x)) ->
+  Property
+prop_getStore =
+  prepropLaw @'[E.IdP] $
+    do
+      idpid <- arbitrary
+      s <- arbitrary
+      let s' = s & SAML.idpId .~ idpid
+      pure $
+        Law
+          { lawLhs = do
+              r <- E.getConfig idpid
+              maybe (pure ()) E.storeConfig r
+              pure r,
+            lawRhs = do
+              E.getConfig idpid,
+            lawPrelude =
+              [E.storeConfig s'],
+            lawPostlude =
+              [E.getConfig idpid]
+          }
+
+prop_setSet ::
+  PropConstraints r f =>
+  Maybe (f (Maybe (Maybe IdPId)) -> String) ->
+  (forall x. Sem r x -> IO (f x)) ->
+  Property
+prop_setSet =
+  prepropLaw @'[E.IdP] $
+    do
+      replaced_id <- arbitrary
+      s <- arbitrary
+      let s' = s & SAML.idpId .~ replaced_id
+      let replaced = E.Replaced replaced_id
+      replacing <- arbitrary
+      replacing' <- arbitrary
+      pure $
+        Law
+          { lawLhs = do
+              E.setReplacedBy replaced replacing
+              E.setReplacedBy replaced replacing'
+              getReplacedBy replaced_id,
+            lawRhs = do
+              E.setReplacedBy replaced replacing'
+              getReplacedBy replaced_id,
+            lawPrelude =
+              [E.storeConfig s'],
+            lawPostlude = [] @(Sem _ ())
+          }
+
+prop_setGet ::
+  PropConstraints r f =>
+  Maybe (f (Maybe (Maybe IdPId)) -> String) ->
+  (forall x. Sem r x -> IO (f x)) ->
+  Property
+prop_setGet =
+  prepropLaw @'[E.IdP] $
+    do
+      idp <- arbitrary
+      replaced_id <- arbitrary
+      let replaced = E.Replaced replaced_id
+      replacing_id <- arbitrary
+      let replacing = E.Replacing replacing_id
+      pure $
+        Law
+          { lawLhs = do
+              E.setReplacedBy replaced replacing
+              getReplacedBy replaced_id,
+            lawRhs = do
+              E.setReplacedBy replaced replacing
+              (Just replacing_id <$) <$> E.getConfig replaced_id,
+            lawPrelude =
+              [ E.storeConfig $ idp & SAML.idpId .~ replaced_id
+              ],
+            lawPostlude = [] :: [Sem r ()]
+          }
diff --git a/services/spar/test/Test/Spar/Sem/NowSpec.hs b/services/spar/test/Test/Spar/Sem/NowSpec.hs
new file mode 100644
index 00000000000..0c9fdacadfb
--- /dev/null
+++ b/services/spar/test/Test/Spar/Sem/NowSpec.hs
@@ -0,0 +1,70 @@
+{-# LANGUAGE QuantifiedConstraints #-}
+{-# OPTIONS_GHC -Wno-orphans #-}
+{-# OPTIONS_GHC -fplugin=Polysemy.Plugin #-}
+
+module Test.Spar.Sem.NowSpec where
+
+import Arbitrary ()
+import Data.Time
+import Data.Time.Calendar.Julian
+import Imports
+import Polysemy
+import Polysemy.Check
+import Polysemy.Input
+import SAML2.WebSSO.Types
+import qualified Spar.Sem.Now as E
+import Spar.Sem.Now.IO
+import Spar.Sem.Now.Input
+import Test.Hspec
+import Test.Hspec.QuickCheck
+import Test.QuickCheck
+
+deriveGenericK ''E.Now
+
+propsForInterpreter ::
+  PropConstraints r f =>
+  String ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Spec
+propsForInterpreter interpreter lower = do
+  describe interpreter $ do
+    prop "now/now" $ prop_nowNow Nothing lower
+
+someTime :: Time
+someTime = Time (UTCTime (fromJulianYearAndDay 1990 209) (secondsToDiffTime 0))
+
+spec :: Spec
+spec = do
+  modifyMaxSuccess (const 1000) $ do
+    propsForInterpreter "nowToIO" $ fmap Identity . runM . nowToIO . runInputConst ()
+    propsForInterpreter "nowToInput" $ pure . Identity . run . runInputConst someTime . nowToInput . runInputConst ()
+
+-- | All the constraints we need to generalize properties in this module.
+-- A regular type synonym doesn't work due to dreaded impredicative
+-- polymorphism.
+class
+  (Functor f, Member E.Now r, Member (Input ()) r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
+  PropConstraints r f
+
+instance
+  (Functor f, Member E.Now r, Member (Input ()) r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
+  PropConstraints r f
+
+prop_nowNow ::
+  PropConstraints r f =>
+  Maybe (f Bool -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_nowNow =
+  -- NOTE: This @Input ()@ effect is a workaround to an oversight in
+  -- @polysemy-check@. 'prepropLaw' wants to synthesize some actions to run
+  -- before and after its generators, and check their results for equality. We
+  -- can't use 'Now' as this effect, because 'E.get' won't return equivalent
+  -- results! And we can't keep it empty, because that triggers a crash in
+  -- @polysemy-check@. Thus @Input ()@, which isn't beautiful, but works fine.
+  prepropLaw @'[Input ()] $ do
+    pure $
+      simpleLaw
+        (liftA2 (<=) E.get E.get)
+        ( pure True
+        )
diff --git a/services/spar/test/Test/Spar/Sem/ScimExternalIdStoreSpec.hs b/services/spar/test/Test/Spar/Sem/ScimExternalIdStoreSpec.hs
new file mode 100644
index 00000000000..e6ccad58a4a
--- /dev/null
+++ b/services/spar/test/Test/Spar/Sem/ScimExternalIdStoreSpec.hs
@@ -0,0 +1,192 @@
+{-# LANGUAGE QuantifiedConstraints #-}
+{-# OPTIONS_GHC -Wno-orphans #-}
+{-# OPTIONS_GHC -fplugin=Polysemy.Plugin #-}
+
+module Test.Spar.Sem.ScimExternalIdStoreSpec where
+
+import Arbitrary ()
+import Data.Id
+import Imports
+import Polysemy
+import Polysemy.Check
+import qualified Spar.Sem.ScimExternalIdStore as E
+import Spar.Sem.ScimExternalIdStore.Mem
+import Test.Hspec
+import Test.Hspec.QuickCheck
+import Test.QuickCheck
+
+deriveGenericK ''E.ScimExternalIdStore
+
+propsForInterpreter ::
+  PropConstraints r f =>
+  String ->
+  (forall a. f a -> a) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Spec
+propsForInterpreter interpreter extract lower = do
+  describe interpreter $ do
+    prop "delete/delete" $ prop_deleteDelete Nothing lower
+    prop "delete/lookup" $ prop_deleteLookup (Just $ show . (() <$) . extract) lower
+    prop "delete/insert" $ prop_deleteInsert Nothing lower
+    prop "lookup/insert" $ prop_lookupInsert Nothing lower
+    prop "insert/delete" $ prop_insertDelete Nothing lower
+    prop "insert/lookup" $ prop_insertLookup (Just $ show . (() <$) . extract) lower
+    prop "insert/insert" $ prop_insertInsert (Just $ show . (() <$) . extract) lower
+
+spec :: Spec
+spec = modifyMaxSuccess (const 1000) $ do
+  propsForInterpreter "scimExternalIdStoreToMem" snd $ pure . run . scimExternalIdStoreToMem
+
+-- | All the constraints we need to generalize properties in this module.
+-- A regular type synonym doesn't work due to dreaded impredicative
+-- polymorphism.
+class
+  (Functor f, Member E.ScimExternalIdStore r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
+  PropConstraints r f
+
+instance
+  (Functor f, Member E.ScimExternalIdStore r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
+  PropConstraints r f
+
+prop_insertLookup ::
+  PropConstraints r f =>
+  Maybe (f (Maybe UserId) -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_insertLookup =
+  prepropLaw @'[E.ScimExternalIdStore] $ do
+    tid <- arbitrary
+    email <- arbitrary
+    uid <- arbitrary
+    pure $
+      simpleLaw
+        ( do
+            E.insert tid email uid
+            E.lookup tid email
+        )
+        ( do
+            E.insert tid email uid
+            pure (Just uid)
+        )
+
+prop_lookupInsert ::
+  PropConstraints r f =>
+  Maybe (f () -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_lookupInsert =
+  prepropLaw @'[E.ScimExternalIdStore] $ do
+    tid <- arbitrary
+    email <- arbitrary
+    pure $
+      simpleLaw
+        ( do
+            E.lookup tid email >>= maybe (pure ()) (E.insert tid email)
+        )
+        ( do
+            pure ()
+        )
+
+prop_insertDelete ::
+  PropConstraints r f =>
+  Maybe (f () -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_insertDelete =
+  prepropLaw @'[E.ScimExternalIdStore] $ do
+    tid <- arbitrary
+    email <- arbitrary
+    uid <- arbitrary
+    pure $
+      simpleLaw
+        ( do
+            E.insert tid email uid
+            E.delete tid email
+        )
+        ( do
+            E.delete tid email
+        )
+
+prop_deleteInsert ::
+  PropConstraints r f =>
+  Maybe (f () -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_deleteInsert =
+  prepropLaw @'[E.ScimExternalIdStore] $ do
+    tid <- arbitrary
+    email <- arbitrary
+    uid <- arbitrary
+    pure $
+      simpleLaw
+        ( do
+            E.delete tid email
+            E.insert tid email uid
+        )
+        ( do
+            E.insert tid email uid
+        )
+
+prop_insertInsert ::
+  PropConstraints r f =>
+  Maybe (f (Maybe UserId) -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_insertInsert =
+  prepropLaw @'[E.ScimExternalIdStore] $ do
+    tid <- arbitrary
+    email <- arbitrary
+    uid <- arbitrary
+    uid' <- arbitrary
+    pure $
+      simpleLaw
+        ( do
+            E.insert tid email uid
+            E.insert tid email uid'
+            E.lookup tid email
+        )
+        ( do
+            E.insert tid email uid'
+            E.lookup tid email
+        )
+
+prop_deleteDelete ::
+  PropConstraints r f =>
+  Maybe (f () -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_deleteDelete =
+  prepropLaw @'[E.ScimExternalIdStore] $ do
+    tid <- arbitrary
+    email <- arbitrary
+    pure $
+      simpleLaw
+        ( do
+            E.delete tid email
+            E.delete tid email
+        )
+        ( do
+            E.delete tid email
+        )
+
+prop_deleteLookup ::
+  PropConstraints r f =>
+  Maybe (f (Maybe UserId) -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_deleteLookup =
+  prepropLaw @'[E.ScimExternalIdStore] $ do
+    tid <- arbitrary
+    email <- arbitrary
+    uid <- arbitrary
+    pure $
+      Law
+        { lawLhs = do
+            E.delete tid email
+            E.lookup tid email,
+          lawRhs = do
+            E.delete tid email
+            pure Nothing,
+          lawPrelude = [E.insert tid email uid],
+          lawPostlude = [] @(Sem _ ())
+        }
diff --git a/stack.yaml b/stack.yaml
index 6081f77af12..d5e4cb78413 100644
--- a/stack.yaml
+++ b/stack.yaml
@@ -224,7 +224,7 @@ extra-deps:
 # Not on stackage yet
 - polysemy-1.7.0.0
 - polysemy-plugin-0.4.2.0
-- polysemy-check-0.8.1.0
+- polysemy-check-0.9.0.0
 
 ############################################################
 # Development tools
diff --git a/stack.yaml.lock b/stack.yaml.lock
index c9b4d4ccfc9..1635ea076ad 100644
--- a/stack.yaml.lock
+++ b/stack.yaml.lock
@@ -683,12 +683,12 @@ packages:
   original:
     hackage: polysemy-plugin-0.4.2.0
 - completed:
-    hackage: polysemy-check-0.8.1.0@sha256:5cce3ae162d2f8d8f629397daa28ec5e425f72d357afeb4fe994e102425f2383,2648
+    hackage: polysemy-check-0.9.0.0@sha256:f28c23c5cbae246a049d11e06c51ee85212a2b13a069e93598cf8cdd13ad5a18,2665
     pantry-tree:
-      size: 1027
-      sha256: bc880fb3405307ed251c02358d604979d8014040b78c2ffe6319076431f93509
+      size: 1086
+      sha256: a473605eda27f36717e3f0cbd66651563789107daa9b8d9db59b80cc07ff60d1
   original:
-    hackage: polysemy-check-0.8.1.0
+    hackage: polysemy-check-0.9.0.0
 - completed:
     hackage: ormolu-0.1.4.1@sha256:ed404eac6e4eb64da1ca5fb749e0f99907431a9633e6ba34e44d260e7d7728ba,6499
     pantry-tree:

From e4503ff778a97624de5e77c8e0cdecc4e339c536 Mon Sep 17 00:00:00 2001
From: Paolo Capriotti <paolo@capriotti.io>
Date: Fri, 17 Dec 2021 13:42:04 +0100
Subject: [PATCH 16/74] schema-profunctor: better optional field API (#1988)

* schema-profunctor: better optional field API

* Add nullable combinator and tests
---
 .../5-internal/schema-profunctor-optional     |   1 +
 .../src/Galley/Types/Conversations/Intra.hs   |   2 +-
 libs/schema-profunctor/README.md              | 104 ++++++-----
 libs/schema-profunctor/src/Data/Schema.hs     | 162 ++++++++++--------
 .../test/unit/Test/Data/Schema.hs             |  38 ++--
 libs/types-common/src/Data/Domain.hs          |   2 +-
 libs/wire-api/src/Wire/API/Connection.hs      |  74 ++++----
 libs/wire-api/src/Wire/API/Conversation.hs    |  51 +++---
 .../src/Wire/API/Conversation/Code.hs         |   4 +-
 .../src/Wire/API/Conversation/Member.hs       |  30 ++--
 .../src/Wire/API/Event/Conversation.hs        |  28 +--
 libs/wire-api/src/Wire/API/Message.hs         |   6 +-
 .../API/Routes/Internal/Brig/Connection.hs    |   6 +-
 .../src/Wire/API/Routes/MultiTablePaging.hs   |   4 +-
 libs/wire-api/src/Wire/API/User.hs            |  14 +-
 libs/wire-api/src/Wire/API/User/Client.hs     |  89 +++++-----
 libs/wire-api/src/Wire/API/User/Profile.hs    |   2 +-
 17 files changed, 325 insertions(+), 292 deletions(-)
 create mode 100644 changelog.d/5-internal/schema-profunctor-optional

diff --git a/changelog.d/5-internal/schema-profunctor-optional b/changelog.d/5-internal/schema-profunctor-optional
new file mode 100644
index 00000000000..4e66ad936cc
--- /dev/null
+++ b/changelog.d/5-internal/schema-profunctor-optional
@@ -0,0 +1 @@
+Improve optional field API in schema-profunctor
diff --git a/libs/galley-types/src/Galley/Types/Conversations/Intra.hs b/libs/galley-types/src/Galley/Types/Conversations/Intra.hs
index 0cb0ba9afd7..e41823f3cef 100644
--- a/libs/galley-types/src/Galley/Types/Conversations/Intra.hs
+++ b/libs/galley-types/src/Galley/Types/Conversations/Intra.hs
@@ -72,7 +72,7 @@ instance ToSchema UpsertOne2OneConversationRequest where
         <*> (qUntagged . uooRemoteUser) .= field "remote_user" (qTagUnsafe <$> schema)
         <*> uooActor .= field "actor" schema
         <*> uooActorDesiredMembership .= field "actor_desired_membership" schema
-        <*> uooConvId .= field "conversation_id" (optWithDefault A.Null schema)
+        <*> uooConvId .= optField "conversation_id" (maybeWithDefault A.Null schema)
 
 newtype UpsertOne2OneConversationResponse = UpsertOne2OneConversationResponse
   { uuorConvId :: Qualified ConvId
diff --git a/libs/schema-profunctor/README.md b/libs/schema-profunctor/README.md
index 282b9fdd263..9f1421f77d4 100644
--- a/libs/schema-profunctor/README.md
+++ b/libs/schema-profunctor/README.md
@@ -45,8 +45,8 @@ structure of lists when using the `Applicative` interface of
 
 ## Tutorial
 
-To learn how to use `SchemaP` in practice, let us walk through two
-basic examples, one for a record, and one for a sum type.
+To learn how to use `SchemaP` in practice, let us walk through some
+basic examples, including records and sum types.
 
 ### Records
 
@@ -345,9 +345,8 @@ represented on the Haskell side.
 
 ### Optional fields and default values
 
-To define a schema for a JSON object, there are multiple ways to deal
-with the serialisation of optional fields, which we will illustrate
-here.
+To define a schema for a JSON object, there are multiple ways to deal with the
+serialisation of optional fields, which we will illustrate here.
 
 The simplest (and most common) scenario is an optional field represented by a
 `Maybe` type, that is simply omitted from the generated JSON if it happens to
@@ -365,42 +364,48 @@ data User = User
 userSchema = object "User" $
   User
     <$> userName .= field "name" schema
-    <*> userHandle .= opt (field "handle" schema)
-    <*> userExpire .= opt (field "expire" schema)
+    <*> userHandle .= maybe_ (optField "handle" schema)
+    <*> userExpire .= maybe_ (optField "expire" schema)
 ```
 
-Here we apply the `opt` combinator to the optional field, to turn it from a
-schema for `Text` into a schema for `Maybe Text`. The parser for `userHandle`
-will return `Nothing` when the field is missing (or is `null`), and
-correspondingly the serialiser will not produce the field at all when its value
-is `Nothing`.
+Here we use `optField` to define schemas for optional fields, and apply the
+`maybe_` combinator to the result, which has the effect of making the
+serialiser omit the field when the corresponding value is `Nothing`.
+
+In detail, `optField "handle" schema` returns a schema from `Text` to `Maybe
+Text`, i.e. a schema that is able to parse an optional text value, but does not
+know how to serialise `Nothing`. Wrapping it in `maybe_` changes the first type
+to `Maybe Text`, and gives the serialiser the ability to serialise `Nothing` as
+well.
 
 Another possibility is a field that, when missing, is assumed to have a given
 default value. Most likely, in this case we do not want the field to be omitted
-when serialising. The schema can then be defined simply by using the
-`Alternative` instance of `SchemaP` to provide the default value:
+when serialising. Such a schema can be defined simply by omitting the call to
+`maybe_`, and instead converting a `Nothing` value coming from the parser into
+the desired default value.
 
 ```haskell
 userSchemaWithDefaultName :: ValueSchema NamedSwaggerDoc User
 userSchemaWithDefaultName =
   object "User" $
     User
-      <$> userName .= (field "name" schema <|> pure "")
-      <*> userHandle .= opt (field "handle" schema)
-      <*> userExpire .= opt (field "expire" schema)
+      <$> userName .= (fromMaybe "" <$> optField "name" schema)
+      <*> userHandle .= maybe_ (optField "handle" schema)
+      <*> userExpire .= maybe_ (optField "expire" schema)
 ```
 
-Now the `name` field is optional, and it is set to the empty string when missing.
-However, the field will still be present in the generated JSON when its value
-is the empty string. If we want the field to be omitted in that case, we can
-use the previous approach, and then convert back and forth from `Maybe Text`:
+Now the `name` field is optional, and it is set to the empty string when
+missing.  However, the field will still be present in the generated JSON when
+its value is the empty string. If we want the field to be omitted in that case,
+we can instead use the first approach, and manually convert back and forth from
+`Maybe Text`.
 
 ```haskell
 userSchemaWithDefaultName' :: ValueSchema NamedSwaggerDoc User
 userSchemaWithDefaultName' =
   object "User" $
     User
-      <$> (getOptText . userName) .= (fromMaybe "" <$> opt (field "name" schema))
+      <$> (getOptText . userName) .= maybe_ (fromMaybe "" <$> field "name" schema)
       <*> userHandle .= opt (field "handle" schema)
       <*> userExpire .= opt (field "expire" schema)
   where
@@ -417,60 +422,47 @@ techniques of the previous two examples:
 userSchema' :: ValueSchema NamedSwaggerDoc User
 userSchema' = object "User" $ User
   <$> field "name" schema
-  <*> lax (field "handle" (optWithDefault Aeson.null schema))
+  <*> optField "handle" (maybeWithDefault Aeson.Null schema)
   <*> opt (field "expire" schema)
 ```
 
 Two things to note here:
 
- - the `optWithDefault` combinator is applied to the schema value *inside*
- `field`, because the value to use if the value is `Nothing` (`Aeson.null` in
- this case) applies to the value of the field, and not the containing object.
- - we have wrapped the whole field inside a call to the `lax` combinator. All
- this does is to add a `pure Nothing` alternative for the field, which ensures
- we get a `Nothing` value (as opposed to a failure) when the field is not
- present at all in the JSON object.
+ - we are now using `maybeWithDefault` instead of `maybe_`. This is a more
+ general version of `maybe_` that takes as an argument the value to use when
+ serialising `Nothing`. Not that `maybe_` is simply `maybeWithDefault mempty`.
+ - the `maybeWithDefault` combinator is applied to the schema value *inside*
+ `field`, because the value to use when serialising `Nothing` (`Aeson.null` in
+ this case) applies to the value of the field, and not the containing
+ (one-field) object, as in the previous examples.
 
-One might wonder why we are using the special combinator `optWithDefault` here
+One might wonder why we are using the special combinator `optField` here
 instead of simply using the `Alternative` instance (via `optional` or
-directly). The reason is that the `Alternative` instance only really affects
-the parser (and its return type), whereas here we also want to encode the fact
-that the serialiser should output the default when the value of the field is
-`Nothing`. That means we need to also change the input type to a `Maybe`, which
-is what `opt` and `optWithDefault` do.
+directly), on the schema returned by the `field` combinator. The reason is that
+the `Alternative` instance would result in a slightly surprising behaviour in
+case of errors in the JSON value contained in a field.
 
-There is a subtlety here related to error messages, which can sometimes result
-in surprising behaviour when parsing optional fields with default values.
-Namely, given a field of the form
+For example, given a field of the form
 
 ```haskell
-opt (field "name" schema)
+optional (field "name" schema)
 ```
 
 the corresponding parser will return `Nothing` not only in the case where the
 `"name"` field is missing, but also if it is fails to parse correctly (for
 example, if it has an unexpected type).  This behaviour is caused by the fact
-that `opt` (and the `optWithDefault` / `lax` combo described above) are
-implemented in terms of the `Alternative` instance for `Aeson.Parser`, which
-cannot distinguish between "recoverable" and "unrecoverable" failures.
+that `optional` is implemented in terms of the `Alternative` instance for
+`Aeson.Parser`, which cannot distinguish between "recoverable" and
+"unrecoverable" failures.
 
-There are plans to improve on this behaviour in the future by directly changing
-the `Alternative` instance that `SchemaP` relies on, but for the moment, if
-this behaviour is not desirable, then one can use the ad-hoc `optField`
-combinator to introduce optional fields.
-
-For example, the above schema can be implemented using `optField` as follow:
+In some cases, this behaviour can be acceptable (or even desired), but in most
+circumstances, it is better to define the above schema using the dedicated
+`optField` combinator, as in:
 
 ```haskell
-userSchema'' :: ValueSchema NamedSwaggerDoc User
-userSchema'' = object "User" $ User
-  <$> field "name" schema
-  <*> optField "handle" (Just Aeson.Null) schema
-  <*> optField "expire" Nothing schema
+optField "name" schema
 ```
 
-The argument after the field name determines how the `Nothing` case is rendered in the generated JSON. If it is itself `Nothing`, that means that the field is completely omitted in that case.
-
 ### Redundant fields
 
 Sometimes, JSON encoding of haskell types is not as straightforward as
diff --git a/libs/schema-profunctor/src/Data/Schema.hs b/libs/schema-profunctor/src/Data/Schema.hs
index 9369ed4f79f..d93ecf9c9ad 100644
--- a/libs/schema-profunctor/src/Data/Schema.hs
+++ b/libs/schema-profunctor/src/Data/Schema.hs
@@ -26,7 +26,9 @@
 module Data.Schema
   ( SchemaP,
     ValueSchema,
+    ValueSchemaP,
     ObjectSchema,
+    ObjectSchemaP,
     ToSchema (..),
     Schema (..),
     mkSchema,
@@ -34,6 +36,7 @@ module Data.Schema
     schemaIn,
     schemaOut,
     HasDoc (..),
+    HasSchemaRef (..),
     withParser,
     SwaggerDoc,
     swaggerDoc,
@@ -44,25 +47,28 @@ module Data.Schema
     objectWithDocModifier,
     objectOver,
     jsonObject,
+    FieldFunctor,
     field,
     fieldWithDocModifier,
     fieldOver,
     optField,
     optFieldWithDocModifier,
-    optFieldOver,
+    fieldF,
+    fieldOverF,
+    fieldWithDocModifierF,
     array,
     set,
     nonEmptyArray,
     map_,
     enum,
-    opt,
-    optWithDefault,
-    lax,
+    maybe_,
+    maybeWithDefault,
     bind,
     dispatch,
     text,
     parsedText,
     null_,
+    nullable,
     element,
     tag,
     unnamed,
@@ -247,11 +253,13 @@ withParser :: SchemaP doc v w a b -> (b -> A.Parser b') -> SchemaP doc v w a b'
 withParser (SchemaP (SchemaDoc d) (SchemaIn p) (SchemaOut o)) q =
   SchemaP (SchemaDoc d) (SchemaIn (p >=> q)) (SchemaOut o)
 
-type SchemaP' doc v v' a = SchemaP doc v v' a a
+type ObjectSchemaP doc = SchemaP doc A.Object [A.Pair]
 
-type ObjectSchema doc a = SchemaP' doc A.Object [A.Pair] a
+type ObjectSchema doc a = ObjectSchemaP doc a a
 
-type ValueSchema doc a = SchemaP' doc A.Value A.Value a
+type ValueSchemaP doc = SchemaP doc A.Value A.Value
+
+type ValueSchema doc a = ValueSchemaP doc a a
 
 schemaDoc :: SchemaP ss v m a b -> ss
 schemaDoc (SchemaP (SchemaDoc d) _ _) = d
@@ -262,6 +270,18 @@ schemaIn (SchemaP _ (SchemaIn i) _) = i
 schemaOut :: SchemaP ss v m a b -> a -> Maybe m
 schemaOut (SchemaP _ _ (SchemaOut o)) = o
 
+class Functor f => FieldFunctor doc f where
+  parseFieldF :: (A.Value -> A.Parser a) -> A.Object -> Text -> A.Parser (f a)
+  mkDocF :: doc -> doc
+
+instance FieldFunctor doc Identity where
+  parseFieldF f obj key = Identity <$> A.explicitParseField f obj key
+  mkDocF = id
+
+instance HasOpt doc => FieldFunctor doc Maybe where
+  parseFieldF = A.explicitParseFieldMaybe
+  mkDocF = mkOpt
+
 -- | A schema for a one-field JSON object.
 field ::
   HasField doc' doc =>
@@ -274,13 +294,19 @@ field = fieldOver id
 optField ::
   (HasOpt doc, HasField doc' doc) =>
   Text ->
-  -- | The value to use when serialising Nothing.
-  Maybe A.Value ->
   SchemaP doc' A.Value A.Value a b ->
-  SchemaP doc A.Object [A.Pair] (Maybe a) (Maybe b)
-optField = optFieldOver id
+  SchemaP doc A.Object [A.Pair] a (Maybe b)
+optField = fieldF
 
-newtype Negative x y a = Negative {runNegative :: (a -> x) -> y}
+-- | A schema for a JSON object with a single optional field.
+fieldF ::
+  (HasOpt doc, HasField doc' doc, FieldFunctor doc f) =>
+  Text ->
+  SchemaP doc' A.Value A.Value a b ->
+  SchemaP doc A.Object [A.Pair] a (f b)
+fieldF = fieldOverF id
+
+newtype Positive x y a = Positive {runPositive :: (a -> x) -> y}
   deriving (Functor)
 
 -- | A version of 'field' for more general input values.
@@ -288,52 +314,36 @@ newtype Negative x y a = Negative {runNegative :: (a -> x) -> y}
 -- This can be used when the input type 'v' of the parser is not exactly a
 -- 'A.Object', but it contains one. The first argument is a lens that can
 -- extract the 'A.Object' contained in 'v'.
-fieldOver ::
-  forall doc' doc v v' a b.
-  HasField doc' doc =>
+fieldOverF ::
+  forall f doc' doc v v' a b.
+  (HasField doc' doc, FieldFunctor doc f) =>
   Lens v v' A.Object A.Value ->
   Text ->
   SchemaP doc' v' A.Value a b ->
-  SchemaP doc v [A.Pair] a b
-fieldOver l name sch = SchemaP (SchemaDoc s) (SchemaIn r) (SchemaOut w)
+  SchemaP doc v [A.Pair] a (f b)
+fieldOverF l name sch = SchemaP (SchemaDoc s) (SchemaIn r) (SchemaOut w)
   where
-    parseField :: A.Object -> Negative (A.Parser b) (A.Parser b) A.Value
-    parseField obj = Negative $ \k -> A.explicitParseField k obj name
+    parseField :: A.Object -> Positive (A.Parser b) (A.Parser (f b)) A.Value
+    parseField obj = Positive $ \k -> parseFieldF @doc k obj name
 
-    r :: v -> A.Parser b
-    r obj = runNegative (l parseField obj) (schemaIn sch)
+    r :: v -> A.Parser (f b)
+    r obj = runPositive (l parseField obj) (schemaIn sch)
 
     w x = do
       v <- schemaOut sch x
       pure [name A..= v]
 
-    s = mkField name (schemaDoc sch)
+    s = mkDocF @doc @f (mkField name (schemaDoc sch))
 
--- | A version of 'optField' for more general input values.
---
--- See documentation of 'fieldOver' for more details.
-optFieldOver ::
+-- | Like 'fieldOver', but specialised to the identity functor.
+fieldOver ::
   forall doc' doc v v' a b.
-  (HasOpt doc, HasField doc' doc) =>
+  (HasField doc' doc) =>
   Lens v v' A.Object A.Value ->
   Text ->
-  Maybe A.Value ->
   SchemaP doc' v' A.Value a b ->
-  SchemaP doc v [A.Pair] (Maybe a) (Maybe b)
-optFieldOver l name def sch = SchemaP (SchemaDoc s) (SchemaIn r) (SchemaOut w)
-  where
-    parseField :: A.Object -> Negative (A.Parser b) (A.Parser (Maybe b)) A.Value
-    parseField obj = Negative $ \k -> A.explicitParseFieldMaybe k obj name
-
-    r :: v -> A.Parser (Maybe b)
-    r obj = runNegative (l parseField obj) (schemaIn sch)
-
-    w (Just x) = do
-      v <- schemaOut sch x
-      pure [name A..= v]
-    w Nothing = pure (maybeToList (fmap (name A..=) def))
-
-    s = mkOpt (mkField name (schemaDoc sch))
+  SchemaP doc v [A.Pair] a b
+fieldOver l name = fmap runIdentity . fieldOverF l name
 
 -- | Like 'field', but apply an arbitrary function to the
 -- documentation of the field.
@@ -350,11 +360,20 @@ fieldWithDocModifier name modify sch = field name (over doc modify sch)
 optFieldWithDocModifier ::
   (HasOpt doc, HasField doc' doc) =>
   Text ->
-  Maybe A.Value ->
   (doc' -> doc') ->
   SchemaP doc' A.Value A.Value a b ->
-  SchemaP doc A.Object [A.Pair] (Maybe a) (Maybe b)
-optFieldWithDocModifier name def modify sch = optField name def (over doc modify sch)
+  SchemaP doc A.Object [A.Pair] a (Maybe b)
+optFieldWithDocModifier name modify sch = optField name (over doc modify sch)
+
+-- | Like 'fieldF', but apply an arbitrary function to the
+-- documentation of the field.
+fieldWithDocModifierF ::
+  (HasOpt doc, HasField doc' doc, FieldFunctor doc f) =>
+  Text ->
+  (doc' -> doc') ->
+  SchemaP doc' A.Value A.Value a b ->
+  SchemaP doc A.Object [A.Pair] a (f b)
+fieldWithDocModifierF name modify sch = fieldF name (over doc modify sch)
 
 -- | Change the input type of a schema.
 (.=) :: Profunctor p => (a -> a') -> p a' b -> p a b
@@ -508,32 +527,17 @@ enum name sch = SchemaP (SchemaDoc d) (SchemaIn i) (SchemaOut o)
         <|> fail ("Unexpected value for enum " <> T.unpack name)
     o = fmap A.toJSON . (getAlt <=< schemaOut sch)
 
--- | An optional schema.
---
--- This is most commonly used for optional fields. The parser will
--- return 'Nothing' if the field is missing, and conversely the
--- serialiser will simply omit the field when its value is 'Nothing'.
-opt :: HasOpt d => Monoid w => SchemaP d v w a b -> SchemaP d v w (Maybe a) (Maybe b)
-opt = optWithDefault mempty
-
--- | An optional schema with a specified failure value
+-- | A schema for 'Maybe' that omits a field on serialisation.
 --
--- This is a more general version of 'opt' that allows a custom
--- serialisation 'Nothing' value.
-optWithDefault :: HasOpt d => w -> SchemaP d v w a b -> SchemaP d v w (Maybe a) (Maybe b)
-optWithDefault w0 sch = SchemaP (SchemaDoc d) (SchemaIn i) (SchemaOut o)
-  where
-    d = mkOpt (schemaDoc sch)
-    i = optional . schemaIn sch
-    o = maybe (pure w0) (schemaOut sch)
+-- This is most commonly used for optional fields, and it will cause the field
+-- to be omitted from the output of the serialiser.
+maybe_ :: HasOpt d => Monoid w => SchemaP d v w a b -> SchemaP d v w (Maybe a) b
+maybe_ = maybeWithDefault mempty
 
--- | A schema that ignores failure.
---
--- Given a schema @sch :: SchemaP d v w a (Maybe b)@, the parser for
--- @lax sch@ is just like the one for @sch@, except that it returns
--- 'Nothing' in case of failure.
-lax :: Alternative f => f (Maybe a) -> f (Maybe a)
-lax = (<|> pure Nothing)
+-- | A schema for 'Maybe', producing the given default value on serialisation.
+maybeWithDefault :: HasOpt d => w -> SchemaP d v w a b -> SchemaP d v w (Maybe a) b
+maybeWithDefault w0 (SchemaP (SchemaDoc d) (SchemaIn i) (SchemaOut o)) =
+  SchemaP (SchemaDoc d) (SchemaIn i) (SchemaOut (maybe (pure w0) o))
 
 -- | A schema depending on a parsed value.
 --
@@ -598,12 +602,28 @@ jsonObject =
     mkSchema mempty pure (pure . (^.. ifolded . withIndex))
 
 -- | A schema for a null value.
-null_ :: Monoid d => SchemaP d A.Value A.Value () ()
+null_ :: Monoid d => ValueSchemaP d () ()
 null_ = mkSchema mempty i o
   where
     i x = guard (x == A.Null)
     o _ = pure A.Null
 
+-- | A schema for a nullable value.
+--
+-- The parser accepts a JSON null as a valid value, and converts it to
+-- 'Nothing'. Any non-null value is parsed using the underlying schema.
+--
+-- The serialiser behaves similarly, but in the other direction.
+nullable ::
+  (Monoid d, HasOpt d) =>
+  ValueSchema d a ->
+  ValueSchema d (Maybe a)
+nullable s =
+  mconcat
+    [ tag _Nothing null_,
+      tag _Just s
+    ]
+
 data WithDeclare s = WithDeclare (Declare ()) s
   deriving (Functor)
 
diff --git a/libs/schema-profunctor/test/unit/Test/Data/Schema.hs b/libs/schema-profunctor/test/unit/Test/Data/Schema.hs
index 356729e9a4c..484f9fb413b 100644
--- a/libs/schema-profunctor/test/unit/Test/Data/Schema.hs
+++ b/libs/schema-profunctor/test/unit/Test/Data/Schema.hs
@@ -65,7 +65,8 @@ tests =
       testRefField,
       testRmClientWrong,
       testRmClient,
-      testEnumType
+      testEnumType,
+      testNullable
     ]
 
 testFooToJSON :: TestTree
@@ -338,6 +339,23 @@ testEnumType =
       (s2 ^. S.type_)
       (Just S.SwaggerInteger)
 
+testNullable :: TestTree
+testNullable =
+  let sch = nullable (unnamed schema) :: ValueSchema SwaggerDoc (Maybe Int)
+   in testGroup
+        "Nullable schemas"
+        [ testCase "Nullable schemas should parse both null and non-null values" $ do
+            A.parse (schemaIn sch) (A.Number 5) @?= Success (Just 5)
+            A.parse (schemaIn sch) A.Null @?= Success Nothing,
+          testCase "Nullable schemas should produce either a value or null" $ do
+            schemaOut sch (Just 5) @?= Just (A.Number 5)
+            schemaOut sch Nothing @?= Just (A.Null),
+          testCase "Nullable schemas should return an error when parsing invalid non-null values" $ do
+            case A.parse (schemaIn sch) (A.String "foo") of
+              Success _ -> assertFailure "fromJSON should fail"
+              Error _ -> pure ()
+        ]
+
 ---
 
 data A = A {thing :: Text, other :: Int}
@@ -445,8 +463,8 @@ instance ToSchema User where
     object "User" $
       User
         <$> userName .= field "name" schema
-        <*> userHandle .= opt (field "handle" schema)
-        <*> userExpire .= opt (field "expire" schema)
+        <*> userHandle .= maybe_ (optField "handle" schema)
+        <*> userExpire .= maybe_ (optField "expire" schema)
 
 exampleUser1 :: User
 exampleUser1 = User "Alice" (Just "alice") Nothing
@@ -554,13 +572,13 @@ rmClientSchema :: ValueSchema NamedSwaggerDoc RmClient
 rmClientSchema =
   object "RmClient" $
     RmClient
-      <$> rmPassword .= lax (field "password" (optWithDefault Null passwordSchema))
+      <$> rmPassword .= optional (field "password" (maybeWithDefault Null passwordSchema))
 
 instance ToSchema RmClient where
   schema =
     object "RmClient" $
       RmClient
-        <$> rmPassword .= optField "password" Nothing passwordSchema
+        <$> rmPassword .= maybe_ (optField "password" passwordSchema)
 
 -- examples from documentation (only type-checked)
 
@@ -601,9 +619,9 @@ userSchemaWithDefaultName' :: ValueSchema NamedSwaggerDoc User
 userSchemaWithDefaultName' =
   object "User" $
     User
-      <$> (getOptText . userName) .= (fromMaybe "" <$> opt (field "name" schema))
-      <*> userHandle .= opt (field "handle" schema)
-      <*> userExpire .= opt (field "expire" schema)
+      <$> (getOptText . userName) .= maybe_ (fromMaybe "" <$> optField "name" schema)
+      <*> userHandle .= maybe_ (optField "handle" schema)
+      <*> userExpire .= maybe_ (optField "expire" schema)
   where
     getOptText :: Text -> Maybe Text
     getOptText "" = Nothing
@@ -614,5 +632,5 @@ userSchemaWithDefaultName =
   object "User" $
     User
       <$> userName .= (field "name" schema <|> pure "")
-      <*> userHandle .= opt (field "handle" schema)
-      <*> userExpire .= opt (field "expire" schema)
+      <*> userHandle .= maybe_ (optField "handle" schema)
+      <*> userExpire .= maybe_ (optField "expire" schema)
diff --git a/libs/types-common/src/Data/Domain.hs b/libs/types-common/src/Data/Domain.hs
index 7656834b433..ecbac67e280 100644
--- a/libs/types-common/src/Data/Domain.hs
+++ b/libs/types-common/src/Data/Domain.hs
@@ -30,7 +30,7 @@ import qualified Data.ByteString as BS
 import qualified Data.ByteString.Builder as Builder
 import qualified Data.ByteString.Char8 as BS.Char8
 import Data.ByteString.Conversion
-import Data.Schema hiding (opt)
+import Data.Schema
 import Data.String.Conversions (cs)
 import qualified Data.Swagger as S
 import qualified Data.Text as Text
diff --git a/libs/wire-api/src/Wire/API/Connection.hs b/libs/wire-api/src/Wire/API/Connection.hs
index 612c867f265..53fa98758a4 100644
--- a/libs/wire-api/src/Wire/API/Connection.hs
+++ b/libs/wire-api/src/Wire/API/Connection.hs
@@ -47,13 +47,13 @@ where
 
 import Control.Applicative (optional)
 import Control.Lens ((?~))
-import Data.Aeson as Aeson
+import Data.Aeson (FromJSON (..), ToJSON (..))
 import Data.Id
 import Data.Json.Util (UTCTimeMillis)
 import Data.Qualified (Qualified (qUnqualified), deprecatedSchema)
 import Data.Range
-import qualified Data.Schema as P
-import Data.Swagger as S
+import Data.Schema
+import qualified Data.Swagger as S
 import qualified Data.Swagger.Build.Api as Doc
 import Data.Text as Text
 import Imports
@@ -85,14 +85,14 @@ data UserConnectionList = UserConnectionList
   }
   deriving stock (Eq, Show, Generic)
   deriving (Arbitrary) via (GenericUniform UserConnectionList)
-  deriving (FromJSON, ToJSON, S.ToSchema) via (P.Schema UserConnectionList)
+  deriving (FromJSON, ToJSON, S.ToSchema) via (Schema UserConnectionList)
 
-instance P.ToSchema UserConnectionList where
+instance ToSchema UserConnectionList where
   schema =
-    P.object "UserConnectionList" $
+    object "UserConnectionList" $
       UserConnectionList
-        <$> clConnections P..= P.field "connections" (P.array P.schema)
-        <*> clHasMore P..= P.fieldWithDocModifier "has_more" (P.description ?~ "Indicator that the server has more connections than returned.") P.schema
+        <$> clConnections .= field "connections" (array schema)
+        <*> clHasMore .= fieldWithDocModifier "has_more" (description ?~ "Indicator that the server has more connections than returned.") schema
 
 modelConnectionList :: Doc.Model
 modelConnectionList = Doc.defineModel "UserConnectionList" $ do
@@ -119,21 +119,21 @@ data UserConnection = UserConnection
   }
   deriving stock (Eq, Show, Generic)
   deriving (Arbitrary) via (GenericUniform UserConnection)
-  deriving (FromJSON, ToJSON, S.ToSchema) via (P.Schema UserConnection)
+  deriving (FromJSON, ToJSON, S.ToSchema) via (Schema UserConnection)
 
-instance P.ToSchema UserConnection where
+instance ToSchema UserConnection where
   schema =
-    P.object "UserConnection" $
+    object "UserConnection" $
       UserConnection
-        <$> ucFrom P..= P.field "from" P.schema
-        <*> ucTo P..= P.field "qualified_to" P.schema
+        <$> ucFrom .= field "from" schema
+        <*> ucTo .= field "qualified_to" schema
         <* (qUnqualified . ucTo)
-          P..= optional (P.field "to" (deprecatedSchema "qualified_to" P.schema))
-        <*> ucStatus P..= P.field "status" P.schema
-        <*> ucLastUpdate P..= P.field "last_update" P.schema
-        <*> ucConvId P..= P.optField "qualified_conversation" Nothing P.schema
+          .= optional (field "to" (deprecatedSchema "qualified_to" schema))
+        <*> ucStatus .= field "status" schema
+        <*> ucLastUpdate .= field "last_update" schema
+        <*> ucConvId .= maybe_ (optField "qualified_conversation" schema)
         <* (fmap qUnqualified . ucConvId)
-          P..= P.optField "conversation" Nothing (deprecatedSchema "qualified_conversation" P.schema)
+          .= maybe_ (optField "conversation" (deprecatedSchema "qualified_conversation" schema))
 
 modelConnection :: Doc.Model
 modelConnection = Doc.defineModel "Connection" $ do
@@ -170,7 +170,7 @@ data Relation
     MissingLegalholdConsent
   deriving stock (Eq, Ord, Show, Generic)
   deriving (Arbitrary) via (GenericUniform Relation)
-  deriving (FromJSON, ToJSON, S.ToSchema) via (P.Schema Relation)
+  deriving (FromJSON, ToJSON, S.ToSchema) via (Schema Relation)
 
 instance S.ToParamSchema Relation where
   toParamSchema _ = mempty & S.type_ ?~ S.SwaggerString
@@ -234,17 +234,17 @@ typeRelation =
         "missing-legalhold-consent"
       ]
 
-instance P.ToSchema Relation where
+instance ToSchema Relation where
   schema =
-    P.enum @Text "Relation" $
+    enum @Text "Relation" $
       mconcat
-        [ P.element "accepted" Accepted,
-          P.element "blocked" Blocked,
-          P.element "pending" Pending,
-          P.element "ignored" Ignored,
-          P.element "sent" Sent,
-          P.element "cancelled" Cancelled,
-          P.element "missing-legalhold-consent" MissingLegalholdConsent
+        [ element "accepted" Accepted,
+          element "blocked" Blocked,
+          element "pending" Pending,
+          element "ignored" Ignored,
+          element "sent" Sent,
+          element "cancelled" Cancelled,
+          element "missing-legalhold-consent" MissingLegalholdConsent
         ]
 
 instance FromHttpApiData Relation where
@@ -285,14 +285,14 @@ data ConnectionRequest = ConnectionRequest
   }
   deriving stock (Eq, Show, Generic)
   deriving (Arbitrary) via (GenericUniform ConnectionRequest)
-  deriving (FromJSON, ToJSON, S.ToSchema) via (P.Schema ConnectionRequest)
+  deriving (FromJSON, ToJSON, S.ToSchema) via (Schema ConnectionRequest)
 
-instance P.ToSchema ConnectionRequest where
+instance ToSchema ConnectionRequest where
   schema =
-    P.object "ConnectionRequest" $
+    object "ConnectionRequest" $
       ConnectionRequest
-        <$> crUser P..= P.fieldWithDocModifier "user" (P.description ?~ "user ID of the user to request a connection with") P.schema
-        <*> crName P..= P.fieldWithDocModifier "name" (P.description ?~ "Name of the (pending) conversation being initiated (1 - 256) characters)") P.schema
+        <$> crUser .= fieldWithDocModifier "user" (description ?~ "user ID of the user to request a connection with") schema
+        <*> crName .= fieldWithDocModifier "name" (description ?~ "Name of the (pending) conversation being initiated (1 - 256) characters)") schema
 
 -- | Payload type for "please change the status of this connection".
 newtype ConnectionUpdate = ConnectionUpdate
@@ -300,13 +300,13 @@ newtype ConnectionUpdate = ConnectionUpdate
   }
   deriving stock (Eq, Show, Generic)
   deriving (Arbitrary) via (GenericUniform ConnectionUpdate)
-  deriving (FromJSON, ToJSON, S.ToSchema) via (P.Schema ConnectionUpdate)
+  deriving (FromJSON, ToJSON, S.ToSchema) via (Schema ConnectionUpdate)
 
-instance P.ToSchema ConnectionUpdate where
+instance ToSchema ConnectionUpdate where
   schema =
-    P.object "ConnectionUpdate" $
+    object "ConnectionUpdate" $
       ConnectionUpdate
-        <$> cuStatus P..= P.fieldWithDocModifier "status" (P.description ?~ "New relation status") P.schema
+        <$> cuStatus .= fieldWithDocModifier "status" (description ?~ "New relation status") schema
 
 modelConnectionUpdate :: Doc.Model
 modelConnectionUpdate = Doc.defineModel "ConnectionUpdate" $ do
diff --git a/libs/wire-api/src/Wire/API/Conversation.hs b/libs/wire-api/src/Wire/API/Conversation.hs
index f935a206049..896ac033bf2 100644
--- a/libs/wire-api/src/Wire/API/Conversation.hs
+++ b/libs/wire-api/src/Wire/API/Conversation.hs
@@ -148,19 +148,18 @@ conversationMetadataObjectSchema =
         schema
     <*> cnvmAccess .= field "access" (array schema)
     <*> cnvmAccessRole .= field "access_role" schema
-    <*> cnvmName .= lax (field "name" (optWithDefault A.Null schema))
+    <*> cnvmName .= optField "name" (maybeWithDefault A.Null schema)
     <* const ("0.0" :: Text) .= optional (field "last_event" schema)
     <* const ("1970-01-01T00:00:00.000Z" :: Text)
       .= optional (field "last_event_time" schema)
-    <*> cnvmTeam .= lax (field "team" (optWithDefault A.Null schema))
+    <*> cnvmTeam .= optField "team" (maybeWithDefault A.Null schema)
     <*> cnvmMessageTimer
-      .= lax
-        ( fieldWithDocModifier
-            "message_timer"
-            (description ?~ "Per-conversation message timer (can be null)")
-            (optWithDefault A.Null schema)
-        )
-    <*> cnvmReceiptMode .= lax (field "receipt_mode" (optWithDefault A.Null schema))
+      .= ( optFieldWithDocModifier
+             "message_timer"
+             (description ?~ "Per-conversation message timer (can be null)")
+             (maybeWithDefault A.Null schema)
+         )
+    <*> cnvmReceiptMode .= optField "receipt_mode" (maybeWithDefault A.Null schema)
 
 instance ToSchema ConversationMetadata where
   schema = object "ConversationMetadata" conversationMetadataObjectSchema
@@ -287,7 +286,7 @@ instance ToSchema ConversationCoverView where
       (description ?~ "Limited view of Conversation.")
       $ ConversationCoverView
         <$> cnvCoverConvId .= field "id" schema
-        <*> cnvCoverName .= lax (field "name" (optWithDefault A.Null schema))
+        <*> cnvCoverName .= optField "name" (maybeWithDefault A.Null schema)
 
 data ConversationList a = ConversationList
   { convList :: [a],
@@ -618,27 +617,25 @@ newConvSchema =
                (array schema)
                <|> pure []
            )
-      <*> newConvName .= opt (field "name" schema)
+      <*> newConvName .= maybe_ (optField "name" schema)
       <*> (Set.toList . newConvAccess)
-        .= ( field "access" (Set.fromList <$> array schema)
-               <|> pure mempty
-           )
-      <*> newConvAccessRole .= opt (field "access_role" schema)
+        .= (fromMaybe mempty <$> optField "access" (Set.fromList <$> array schema))
+      <*> newConvAccessRole .= maybe_ (optField "access_role" schema)
       <*> newConvTeam
-        .= opt
-          ( fieldWithDocModifier
+        .= maybe_
+          ( optFieldWithDocModifier
               "team"
               (description ?~ "Team information of this conversation")
               schema
           )
       <*> newConvMessageTimer
-        .= opt
-          ( fieldWithDocModifier
+        .= maybe_
+          ( optFieldWithDocModifier
               "message_timer"
               (description ?~ "Per-conversation message timer")
               schema
           )
-      <*> newConvReceiptMode .= opt (field "receipt_mode" schema)
+      <*> newConvReceiptMode .= maybe_ (optField "receipt_mode" schema)
       <*> newConvUsersRole
         .= ( fieldWithDocModifier "conversation_role" (description ?~ usersRoleDesc) schema
                <|> pure roleNameWireAdmin
@@ -711,10 +708,8 @@ instance ToSchema Invite where
       Invite
         <$> (toNonEmpty . invUsers)
           .= fmap List1 (field "users" (nonEmptyArray schema))
-        <*> (Just . invRoleName)
-          .= fmap
-            (fromMaybe roleNameWireAdmin)
-            (optField "conversation_role" Nothing schema)
+        <*> invRoleName
+          .= (fromMaybe roleNameWireAdmin <$> optField "conversation_role" schema)
 
 data InviteQualified = InviteQualified
   { invQUsers :: NonEmpty (Qualified UserId),
@@ -730,10 +725,8 @@ instance ToSchema InviteQualified where
     object "InviteQualified" $
       InviteQualified
         <$> invQUsers .= field "qualified_users" (nonEmptyArray schema)
-        <*> (Just . invQRoleName)
-          .= fmap
-            (fromMaybe roleNameWireAdmin)
-            (optField "conversation_role" Nothing schema)
+        <*> invQRoleName
+          .= (fromMaybe roleNameWireAdmin <$> optField "conversation_role" schema)
 
 newInvite :: List1 UserId -> Invite
 newInvite us = Invite us roleNameWireAdmin
@@ -836,7 +829,7 @@ instance ToSchema ConversationMessageTimerUpdate where
       "ConversationMessageTimerUpdate"
       (description ?~ "Contains conversation properties to update")
       $ ConversationMessageTimerUpdate
-        <$> cupMessageTimer .= lax (field "message_timer" (optWithDefault A.Null schema))
+        <$> cupMessageTimer .= optField "message_timer" (maybeWithDefault A.Null schema)
 
 modelConversationMessageTimerUpdate :: Doc.Model
 modelConversationMessageTimerUpdate = Doc.defineModel "ConversationMessageTimerUpdate" $ do
diff --git a/libs/wire-api/src/Wire/API/Conversation/Code.hs b/libs/wire-api/src/Wire/API/Conversation/Code.hs
index 7e9cb9f74db..b30525fd7dc 100644
--- a/libs/wire-api/src/Wire/API/Conversation/Code.hs
+++ b/libs/wire-api/src/Wire/API/Conversation/Code.hs
@@ -82,8 +82,8 @@ instance ToSchema ConversationCode where
             (description ?~ "Conversation code (random)")
             schema
         <*> conversationUri
-          .= opt
-            ( fieldWithDocModifier
+          .= maybe_
+            ( optFieldWithDocModifier
                 "uri"
                 (description ?~ "Full URI (containing key/code) to join a conversation")
                 schema
diff --git a/libs/wire-api/src/Wire/API/Conversation/Member.hs b/libs/wire-api/src/Wire/API/Conversation/Member.hs
index e2abc40d069..e72ae9455d2 100644
--- a/libs/wire-api/src/Wire/API/Conversation/Member.hs
+++ b/libs/wire-api/src/Wire/API/Conversation/Member.hs
@@ -111,7 +111,7 @@ instance ToSchema Member where
         <$> memId .= field "qualified_id" schema
         <* (qUnqualified . memId)
           .= optional (field "id" (deprecatedSchema "qualified_id" schema))
-        <*> memService .= lax (field "service" (optWithDefault A.Null schema))
+        <*> memService .= optField "service" (maybeWithDefault A.Null schema)
         --  Remove ...
         <* const () .= optional (field "status" (c (0 :: Int)))
         <* const () .= optional (field "status_ref" (c ("0.0" :: Text)))
@@ -122,13 +122,13 @@ instance ToSchema Member where
                 (c ("1970-01-01T00:00:00.000Z" :: Text))
             )
         -- ... until here
-        <*> memOtrMutedStatus .= lax (field "otr_muted_status" (optWithDefault A.Null schema))
-        <*> memOtrMutedRef .= lax (field "otr_muted_ref" (optWithDefault A.Null schema))
-        <*> memOtrArchived .= (field "otr_archived" schema <|> pure False)
-        <*> memOtrArchivedRef .= lax (field "otr_archived_ref" (optWithDefault A.Null schema))
+        <*> memOtrMutedStatus .= optField "otr_muted_status" (maybeWithDefault A.Null schema)
+        <*> memOtrMutedRef .= optField "otr_muted_ref" (maybeWithDefault A.Null schema)
+        <*> memOtrArchived .= (fromMaybe False <$> optField "otr_archived" schema)
+        <*> memOtrArchivedRef .= optField "otr_archived_ref" (maybeWithDefault A.Null schema)
         <*> memHidden .= (field "hidden" schema <|> pure False)
-        <*> memHiddenRef .= lax (field "hidden_ref" (optWithDefault A.Null schema))
-        <*> memConvRoleName .= (field "conversation_role" schema <|> pure roleNameWireAdmin)
+        <*> memHiddenRef .= optField "hidden_ref" (maybeWithDefault A.Null schema)
+        <*> memConvRoleName .= (fromMaybe roleNameWireAdmin <$> optField "conversation_role" schema)
     where
       c :: ToJSON a => a -> ValueSchema SwaggerDoc ()
       c val = mkSchema mempty (const (pure ())) (const (pure (toJSON val)))
@@ -178,7 +178,7 @@ instance ToSchema OtherMember where
       OtherMember
         <$> omQualifiedId .= field "qualified_id" schema
         <* (qUnqualified . omQualifiedId) .= optional (field "id" schema)
-        <*> omService .= opt (fieldWithDocModifier "service" (description ?~ desc) schema)
+        <*> omService .= maybe_ (optFieldWithDocModifier "service" (description ?~ desc) schema)
         <*> omConvRoleName .= (field "conversation_role" schema <|> pure roleNameWireAdmin)
         <* const (0 :: Int) .= optional (fieldWithDocModifier "status" (description ?~ "deprecated") schema) -- TODO: remove
     where
@@ -238,12 +238,12 @@ instance ToSchema MemberUpdate where
     (`withParser` (either fail pure . validateMemberUpdate))
       . object "MemberUpdate"
       $ MemberUpdate
-        <$> mupOtrMuteStatus .= opt (field "otr_muted_status" schema)
-        <*> mupOtrMuteRef .= opt (field "otr_muted_ref" schema)
-        <*> mupOtrArchive .= opt (field "otr_archived" schema)
-        <*> mupOtrArchiveRef .= opt (field "otr_archived_ref" schema)
-        <*> mupHidden .= opt (field "hidden" schema)
-        <*> mupHiddenRef .= opt (field "hidden_ref" schema)
+        <$> mupOtrMuteStatus .= maybe_ (optField "otr_muted_status" schema)
+        <*> mupOtrMuteRef .= maybe_ (optField "otr_muted_ref" schema)
+        <*> mupOtrArchive .= maybe_ (optField "otr_archived" schema)
+        <*> mupOtrArchiveRef .= maybe_ (optField "otr_archived_ref" schema)
+        <*> mupHidden .= maybe_ (optField "hidden" schema)
+        <*> mupHiddenRef .= maybe_ (optField "hidden_ref" schema)
 
 instance Arbitrary MemberUpdate where
   arbitrary =
@@ -290,7 +290,7 @@ instance ToSchema OtherMemberUpdate where
         "OtherMemberUpdate"
         (description ?~ "Update user properties of other members relative to a conversation")
       $ OtherMemberUpdate
-        <$> omuConvRoleName .= optField "conversation_role" Nothing schema
+        <$> omuConvRoleName .= maybe_ (optField "conversation_role" schema)
 
 validateOtherMemberUpdate :: OtherMemberUpdate -> Either String OtherMemberUpdate
 validateOtherMemberUpdate u
diff --git a/libs/wire-api/src/Wire/API/Event/Conversation.hs b/libs/wire-api/src/Wire/API/Event/Conversation.hs
index d681659225f..de7d732d848 100644
--- a/libs/wire-api/src/Wire/API/Event/Conversation.hs
+++ b/libs/wire-api/src/Wire/API/Event/Conversation.hs
@@ -371,10 +371,10 @@ connectObjectSchema :: ObjectSchema SwaggerDoc Connect
 connectObjectSchema =
   Connect
     <$> cRecipient .= field "qualified_recipient" schema
-    <* (Just . qUnqualified . cRecipient) .= optField "recipient" Nothing schema
-    <*> cMessage .= lax (field "message" (optWithDefault A.Null schema))
-    <*> cName .= lax (field "name" (optWithDefault A.Null schema))
-    <*> cEmail .= lax (field "email" (optWithDefault A.Null schema))
+    <* (qUnqualified . cRecipient) .= optional (field "recipient" schema)
+    <*> cMessage .= optField "message" (maybeWithDefault A.Null schema)
+    <*> cName .= optField "name" (maybeWithDefault A.Null schema)
+    <*> cEmail .= optField "email" (maybeWithDefault A.Null schema)
 
 modelConnect :: Doc.Model
 modelConnect = Doc.defineModel "Connect" $ do
@@ -416,14 +416,14 @@ memberUpdateDataObjectSchema :: ObjectSchema SwaggerDoc MemberUpdateData
 memberUpdateDataObjectSchema =
   MemberUpdateData
     <$> misTarget .= field "qualified_target" schema
-    <* (Just . qUnqualified . misTarget) .= optField "target" Nothing schema
-    <*> misOtrMutedStatus .= opt (field "otr_muted_status" schema)
-    <*> misOtrMutedRef .= opt (field "otr_muted_ref" schema)
-    <*> misOtrArchived .= opt (field "otr_archived" schema)
-    <*> misOtrArchivedRef .= opt (field "otr_archived_ref" schema)
-    <*> misHidden .= opt (field "hidden" schema)
-    <*> misHiddenRef .= opt (field "hidden_ref" schema)
-    <*> misConvRoleName .= opt (field "conversation_role" schema)
+    <* (qUnqualified . misTarget) .= optional (field "target" schema)
+    <*> misOtrMutedStatus .= maybe_ (optField "otr_muted_status" schema)
+    <*> misOtrMutedRef .= maybe_ (optField "otr_muted_ref" schema)
+    <*> misOtrArchived .= maybe_ (optField "otr_archived" schema)
+    <*> misOtrArchivedRef .= maybe_ (optField "otr_archived_ref" schema)
+    <*> misHidden .= maybe_ (optField "hidden" schema)
+    <*> misHiddenRef .= maybe_ (optField "hidden_ref" schema)
+    <*> misConvRoleName .= maybe_ (optField "conversation_role" schema)
 
 modelMemberUpdateData :: Doc.Model
 modelMemberUpdateData = Doc.defineModel "MemberUpdateData" $ do
@@ -478,8 +478,8 @@ otrMessageObjectSchema =
         (description ?~ textDesc)
         schema
     <*> otrData
-      .= opt
-        ( fieldWithDocModifier
+      .= maybe_
+        ( optFieldWithDocModifier
             "data"
             (description ?~ dataDesc)
             schema
diff --git a/libs/wire-api/src/Wire/API/Message.hs b/libs/wire-api/src/Wire/API/Message.hs
index b9ee8acf812..e5b1c33cf9b 100644
--- a/libs/wire-api/src/Wire/API/Message.hs
+++ b/libs/wire-api/src/Wire/API/Message.hs
@@ -152,9 +152,9 @@ instance ToSchema NewOtrMessage where
         <*> newOtrRecipients .= field "recipients" schema
         <*> newOtrNativePush .= (field "native_push" schema <|> pure True)
         <*> newOtrTransient .= (field "transient" schema <|> pure False)
-        <*> newOtrNativePriority .= opt (field "native_priority" schema)
-        <*> newOtrData .= opt (field "data" schema)
-        <*> newOtrReportMissing .= opt (field "report_missing" (array schema))
+        <*> newOtrNativePriority .= maybe_ (optField "native_priority" schema)
+        <*> newOtrData .= maybe_ (optField "data" schema)
+        <*> newOtrReportMissing .= maybe_ (optField "report_missing" (array schema))
 
 instance FromProto NewOtrMessage where
   fromProto bs = protoToNewOtrMessage <$> runGetLazy Protobuf.decodeMessage bs
diff --git a/libs/wire-api/src/Wire/API/Routes/Internal/Brig/Connection.hs b/libs/wire-api/src/Wire/API/Routes/Internal/Brig/Connection.hs
index 1132c6f920f..cf410a00f8a 100644
--- a/libs/wire-api/src/Wire/API/Routes/Internal/Brig/Connection.hs
+++ b/libs/wire-api/src/Wire/API/Routes/Internal/Brig/Connection.hs
@@ -22,7 +22,7 @@ instance ToSchema ConnectionsStatusRequest where
     object "ConnectionsStatusRequest" $
       ConnectionsStatusRequest
         <$> csrFrom .= field "from" (array schema)
-        <*> csrTo .= optField "to" Nothing (array schema)
+        <*> csrTo .= maybe_ (optField "to" (array schema))
 
 data ConnectionsStatusRequestV2 = ConnectionsStatusRequestV2
   { csrv2From :: ![UserId],
@@ -37,8 +37,8 @@ instance ToSchema ConnectionsStatusRequestV2 where
     object "ConnectionsStatusRequestV2" $
       ConnectionsStatusRequestV2
         <$> csrv2From .= field "from" (array schema)
-        <*> csrv2To .= optField "to" Nothing (array schema)
-        <*> csrv2Relation .= optField "relation" Nothing schema
+        <*> csrv2To .= maybe_ (optField "to" (array schema))
+        <*> csrv2Relation .= maybe_ (optField "relation" schema)
 
 data ConnectionStatus = ConnectionStatus
   { csFrom :: !UserId,
diff --git a/libs/wire-api/src/Wire/API/Routes/MultiTablePaging.hs b/libs/wire-api/src/Wire/API/Routes/MultiTablePaging.hs
index e05cbf6e987..0fd21bd3a21 100644
--- a/libs/wire-api/src/Wire/API/Routes/MultiTablePaging.hs
+++ b/libs/wire-api/src/Wire/API/Routes/MultiTablePaging.hs
@@ -90,8 +90,8 @@ instance RequestSchemaConstraint name tables max def => ToSchema (GetMultiTableP
           ("GetPaginated_" <> textFromSymbol @name)
           (description ?~ "A request to list some or all of a user's " <> textFromSymbol @name <> ", including remote ones")
           $ GetMultiTablePageRequest
-            <$> gmtprSize .= (fieldWithDocModifier "size" addSizeDoc schema <|> pure (toRange (Proxy @def)))
-            <*> gmtprState .= optFieldWithDocModifier "paging_state" Nothing addPagingStateDoc schema
+            <$> gmtprSize .= (fromMaybe (toRange (Proxy @def)) <$> optFieldWithDocModifier "size" addSizeDoc schema)
+            <*> gmtprState .= maybe_ (optFieldWithDocModifier "paging_state" addPagingStateDoc schema)
 
 textFromNat :: forall n. KnownNat n => Text
 textFromNat = Text.pack . show . natVal $ Proxy @n
diff --git a/libs/wire-api/src/Wire/API/User.hs b/libs/wire-api/src/Wire/API/User.hs
index 30bbe2933e8..18464c0b185 100644
--- a/libs/wire-api/src/Wire/API/User.hs
+++ b/libs/wire-api/src/Wire/API/User.hs
@@ -234,12 +234,12 @@ instance ToSchema UserProfile where
         <*> profileAssets .= (field "assets" (array schema) <|> pure [])
         <*> profileAccentId .= field "accent_id" schema
         <*> ((\del -> if del then Just True else Nothing) . profileDeleted)
-          .= fmap (fromMaybe False) (opt (field "deleted" schema))
-        <*> profileService .= opt (field "service" schema)
-        <*> profileHandle .= opt (field "handle" schema)
-        <*> profileExpire .= opt (field "expires_at" schema)
-        <*> profileTeam .= opt (field "team" schema)
-        <*> profileEmail .= opt (field "email" schema)
+          .= maybe_ (fromMaybe False <$> optField "deleted" schema)
+        <*> profileService .= maybe_ (optField "service" schema)
+        <*> profileHandle .= maybe_ (optField "handle" schema)
+        <*> profileExpire .= maybe_ (optField "expires_at" schema)
+        <*> profileTeam .= maybe_ (optField "team" schema)
+        <*> profileEmail .= maybe_ (optField "email" schema)
         <*> profileLegalholdStatus .= field "legalhold_status" schema
 
 modelUser :: Doc.Model
@@ -986,7 +986,7 @@ instance ToSchema DeleteUser where
   schema =
     object "DeleteUser" $
       DeleteUser
-        <$> deleteUserPassword .= opt (field "password" schema)
+        <$> deleteUserPassword .= maybe_ (optField "password" schema)
 
 mkDeleteUser :: Maybe PlainTextPassword -> DeleteUser
 mkDeleteUser = DeleteUser
diff --git a/libs/wire-api/src/Wire/API/User/Client.hs b/libs/wire-api/src/Wire/API/User/Client.hs
index 6e601ecbb81..7437a6e74dd 100644
--- a/libs/wire-api/src/Wire/API/User/Client.hs
+++ b/libs/wire-api/src/Wire/API/User/Client.hs
@@ -74,7 +74,8 @@ module Wire.API.User.Client
 where
 
 import qualified Cassandra as Cql
-import Control.Lens (view, (?~), (^.))
+import Control.Applicative
+import Control.Lens (over, view, (?~), (^.))
 import Data.Aeson (FromJSON (..), ToJSON (..))
 import qualified Data.Aeson as A
 import Data.Bifunctor (second)
@@ -180,12 +181,14 @@ newtype ClientCapabilityList = ClientCapabilityList {fromClientCapabilityList ::
 instance ToSchema ClientCapabilityList where
   schema =
     object "ClientCapabilityList" $
-      ClientCapabilityList <$> fromClientCapabilityList .= capabilitiesFieldSchema
+      ClientCapabilityList <$> fromClientCapabilityList .= fmap runIdentity capabilitiesFieldSchema
 
-capabilitiesFieldSchema :: ObjectSchema SwaggerDoc (Set ClientCapability)
+capabilitiesFieldSchema ::
+  FieldFunctor SwaggerDoc f =>
+  ObjectSchemaP SwaggerDoc (Set ClientCapability) (f (Set ClientCapability))
 capabilitiesFieldSchema =
   Set.toList
-    .= fieldWithDocModifier "capabilities" mods (Set.fromList <$> array schema)
+    .= fieldWithDocModifierF "capabilities" mods (Set.fromList <$> array schema)
   where
     mods =
       description
@@ -218,14 +221,22 @@ modelOtrClientMap = Doc.defineModel "OtrClientMap" $ do
 instance ToSchema a => ToSchema (UserClientMap a) where
   schema = userClientMapSchema schema
 
+class WrapName doc where
+  wrapName :: doc -> (Text -> Text) -> SwaggerDoc -> doc
+
+instance WrapName SwaggerDoc where
+  wrapName _ _ = id
+
+instance WrapName NamedSwaggerDoc where
+  wrapName d f = fmap (Swagger.NamedSchema (Just (f (maybe "" ("_" <>) (getName d)))))
+
 userClientMapSchema ::
-  ValueSchema NamedSwaggerDoc a ->
-  ValueSchema NamedSwaggerDoc (UserClientMap a)
+  (WrapName doc, HasSchemaRef doc) =>
+  ValueSchema doc a ->
+  ValueSchema doc (UserClientMap a)
 userClientMapSchema sch =
-  named nm $
+  over doc (wrapName (schemaDoc sch) ("UserClientMap" <>)) $
     UserClientMap <$> userClientMap .= map_ (map_ sch)
-  where
-    nm = "UserClientMap" <> maybe "" (" " <>) (getName (schemaDoc sch))
 
 newtype UserClientPrekeyMap = UserClientPrekeyMap
   {getUserClientPrekeyMap :: UserClientMap (Maybe Prekey)}
@@ -240,8 +251,8 @@ instance ToSchema UserClientPrekeyMap where
   schema = UserClientPrekeyMap <$> getUserClientPrekeyMap .= addDoc sch
     where
       sch =
-        named "UserClientPrekeyMap" . unnamed $
-          userClientMapSchema (optWithDefault A.Null schema)
+        named "UserClientPrekeyMap" $
+          userClientMapSchema (nullable (unnamed schema))
       addDoc =
         Swagger.schema . Swagger.example
           ?~ toJSON
@@ -442,12 +453,12 @@ instance ToSchema Client where
         <$> clientId .= field "id" schema
         <*> clientType .= field "type" schema
         <*> clientTime .= field "time" schema
-        <*> clientClass .= opt (field "class" schema)
-        <*> clientLabel .= opt (field "label" schema)
-        <*> clientCookie .= opt (field "cookie" schema)
-        <*> clientLocation .= opt (field "location" schema)
-        <*> clientModel .= opt (field "model" schema)
-        <*> clientCapabilities .= (field "capabilities" schema <|> pure mempty)
+        <*> clientClass .= maybe_ (optField "class" schema)
+        <*> clientLabel .= maybe_ (optField "label" schema)
+        <*> clientCookie .= maybe_ (optField "cookie" schema)
+        <*> clientLocation .= maybe_ (optField "location" schema)
+        <*> clientModel .= maybe_ (optField "model" schema)
+        <*> clientCapabilities .= (fromMaybe mempty <$> optField "capabilities" schema)
 
 modelClient :: Doc.Model
 modelClient = Doc.defineModel "Client" $ do
@@ -654,10 +665,10 @@ instance ToSchema NewClient where
                    \When a temporary client already exists, it is replaced."
             )
             schema
-        <*> newClientLabel .= opt (field "label" schema)
+        <*> newClientLabel .= maybe_ (optField "label" schema)
         <*> newClientClass
-          .= opt
-            ( fieldWithDocModifier
+          .= maybe_
+            ( optFieldWithDocModifier
                 "class"
                 ( description
                     ?~ "The device class this client belongs to. \
@@ -666,15 +677,15 @@ instance ToSchema NewClient where
                 schema
             )
         <*> newClientCookie
-          .= opt
-            ( fieldWithDocModifier
+          .= maybe_
+            ( optFieldWithDocModifier
                 "cookie"
                 (description ?~ "The cookie label, i.e. the label used when logging in.")
                 schema
             )
         <*> newClientPassword
-          .= opt
-            ( fieldWithDocModifier
+          .= maybe_
+            ( optFieldWithDocModifier
                 "password"
                 ( description
                     ?~ "The password of the authenticated user for verification. \
@@ -682,8 +693,8 @@ instance ToSchema NewClient where
                 )
                 schema
             )
-        <*> newClientModel .= opt (field "model" schema)
-        <*> newClientCapabilities .= opt capabilitiesFieldSchema
+        <*> newClientModel .= maybe_ (optField "model" schema)
+        <*> newClientCapabilities .= maybe_ capabilitiesFieldSchema
 
 newClient :: ClientType -> LastPrekey -> NewClient
 newClient t k =
@@ -717,30 +728,29 @@ instance ToSchema UpdateClient where
   schema =
     object "UpdateClient" $
       UpdateClient
-        <$> (Just . updateClientPrekeys)
+        <$> updateClientPrekeys
           .= ( fromMaybe []
-                 <$> opt
-                   ( fieldWithDocModifier
-                       "prekeys"
-                       (description ?~ "New prekeys for other clients to establish OTR sessions.")
-                       (array schema)
-                   )
+                 <$> ( optFieldWithDocModifier
+                         "prekeys"
+                         (description ?~ "New prekeys for other clients to establish OTR sessions.")
+                         (array schema)
+                     )
              )
         <*> updateClientLastKey
-          .= opt
-            ( fieldWithDocModifier
+          .= maybe_
+            ( optFieldWithDocModifier
                 "lastkey"
                 (description ?~ "New last-resort prekey.")
                 schema
             )
         <*> updateClientLabel
-          .= opt
-            ( fieldWithDocModifier
+          .= maybe_
+            ( optFieldWithDocModifier
                 "label"
                 (description ?~ "A new name for this client.")
                 schema
             )
-        <*> updateClientCapabilities .= opt capabilitiesFieldSchema
+        <*> updateClientCapabilities .= maybe_ capabilitiesFieldSchema
 
 modelUpdateClient :: Doc.Model
 modelUpdateClient = Doc.defineModel "UpdateClient" $ do
@@ -781,12 +791,11 @@ instance ToSchema RmClient where
         <$> rmPassword
         .= optFieldWithDocModifier
           "password"
-          (Just A.Null)
           ( description
               ?~ "The password of the authenticated user for verification. \
                  \The password is not required for deleting temporary clients."
           )
-          schema
+          (maybeWithDefault A.Null schema)
 
 modelDeleteClient :: Doc.Model
 modelDeleteClient = Doc.defineModel "DeleteClient" $ do
diff --git a/libs/wire-api/src/Wire/API/User/Profile.hs b/libs/wire-api/src/Wire/API/User/Profile.hs
index 7bea3c03def..0c4a7a389cb 100644
--- a/libs/wire-api/src/Wire/API/User/Profile.hs
+++ b/libs/wire-api/src/Wire/API/User/Profile.hs
@@ -126,7 +126,7 @@ instance ToSchema Asset where
     object "UserAsset" $
       ImageAsset
         <$> assetKey .= field "key" schema
-        <*> assetSize .= opt (field "size" schema)
+        <*> assetSize .= maybe_ (optField "size" schema)
         <* const () .= field "type" typeSchema
     where
       typeSchema :: ValueSchema NamedSwaggerDoc ()

From 6cff0a961b7da7021f05c05f1ef5fa6969739cbd Mon Sep 17 00:00:00 2001
From: Leif Battermann <leif.battermann@gmail.com>
Date: Fri, 17 Dec 2021 17:24:13 +0100
Subject: [PATCH 17/74] SQSERVICES-1169 New internal endpoint to configure the
 guest links team feature (#1993)

Internal endpoints for:

* set guest link team feature status
* get guest link team feature status
* set guest link team feature lock status
---
 changelog.d/5-internal/sqservices-1169        |  1 +
 services/galley/galley.cabal                  |  1 +
 services/galley/schema/src/Main.hs            |  4 +-
 .../schema/src/V57_GuestLinksLockStatus.hs    | 33 +++++++++++
 services/galley/src/Galley/API/Internal.hs    | 12 ++++
 .../galley/src/Galley/API/Teams/Features.hs   | 29 ++++-----
 services/galley/src/Galley/Cassandra.hs       |  2 +-
 .../src/Galley/Cassandra/TeamFeatures.hs      |  3 -
 .../galley/src/Galley/Data/TeamFeatures.hs    |  3 +-
 .../test/integration/API/Teams/Feature.hs     | 59 +++++++++++++++----
 10 files changed, 112 insertions(+), 35 deletions(-)
 create mode 100644 changelog.d/5-internal/sqservices-1169
 create mode 100644 services/galley/schema/src/V57_GuestLinksLockStatus.hs

diff --git a/changelog.d/5-internal/sqservices-1169 b/changelog.d/5-internal/sqservices-1169
new file mode 100644
index 00000000000..cc2869e0494
--- /dev/null
+++ b/changelog.d/5-internal/sqservices-1169
@@ -0,0 +1 @@
+New internal endpoint to configure the guest links team feature.
diff --git a/services/galley/galley.cabal b/services/galley/galley.cabal
index 680261a3317..f743ae99946 100644
--- a/services/galley/galley.cabal
+++ b/services/galley/galley.cabal
@@ -438,6 +438,7 @@ executable galley-schema
       V54_TeamFeatureSelfDeletingMessages
       V55_SelfDeletingMessagesLockStatus
       V56_GuestLinksTeamFeatureStatus
+      V57_GuestLinksLockStatus
       Paths_galley
   hs-source-dirs:
       schema/src
diff --git a/services/galley/schema/src/Main.hs b/services/galley/schema/src/Main.hs
index 63cda90e089..e67775ed7a6 100644
--- a/services/galley/schema/src/Main.hs
+++ b/services/galley/schema/src/Main.hs
@@ -59,6 +59,7 @@ import qualified V53_AddRemoteConvStatus
 import qualified V54_TeamFeatureSelfDeletingMessages
 import qualified V55_SelfDeletingMessagesLockStatus
 import qualified V56_GuestLinksTeamFeatureStatus
+import qualified V57_GuestLinksLockStatus
 
 main :: IO ()
 main = do
@@ -103,7 +104,8 @@ main = do
       V53_AddRemoteConvStatus.migration,
       V54_TeamFeatureSelfDeletingMessages.migration,
       V55_SelfDeletingMessagesLockStatus.migration,
-      V56_GuestLinksTeamFeatureStatus.migration
+      V56_GuestLinksTeamFeatureStatus.migration,
+      V57_GuestLinksLockStatus.migration
       -- When adding migrations here, don't forget to update
       -- 'schemaVersion' in Galley.Cassandra
       -- (see also docs/developer/cassandra-interaction.md)
diff --git a/services/galley/schema/src/V57_GuestLinksLockStatus.hs b/services/galley/schema/src/V57_GuestLinksLockStatus.hs
new file mode 100644
index 00000000000..6afa380236e
--- /dev/null
+++ b/services/galley/schema/src/V57_GuestLinksLockStatus.hs
@@ -0,0 +1,33 @@
+-- This file is part of the Wire Server implementation.
+--
+-- Copyright (C) 2020 Wire Swiss GmbH <opensource@wire.com>
+--
+-- This program is free software: you can redistribute it and/or modify it under
+-- the terms of the GNU Affero General Public License as published by the Free
+-- Software Foundation, either version 3 of the License, or (at your option) any
+-- later version.
+--
+-- This program is distributed in the hope that it will be useful, but WITHOUT
+-- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+-- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+-- details.
+--
+-- You should have received a copy of the GNU Affero General Public License along
+-- with this program. If not, see <https://www.gnu.org/licenses/>.
+
+module V57_GuestLinksLockStatus
+  ( migration,
+  )
+where
+
+import Cassandra.Schema
+import Imports
+import Text.RawString.QQ
+
+migration :: Migration
+migration = Migration 57 "Add lock status for guest links team feature" $ do
+  schema'
+    [r| ALTER TABLE team_features ADD (
+          guest_links_lock_status int
+        )
+     |]
diff --git a/services/galley/src/Galley/API/Internal.hs b/services/galley/src/Galley/API/Internal.hs
index ff2b743f92f..85234b2efd8 100644
--- a/services/galley/src/Galley/API/Internal.hs
+++ b/services/galley/src/Galley/API/Internal.hs
@@ -198,6 +198,15 @@ data InternalApi routes = InternalApi
     iTeamFeatureLockStatusSelfDeletingMessagesPut ::
       routes
         :- IFeatureStatusLockStatusPut 'Public.TeamFeatureSelfDeletingMessages,
+    iTeamFeatureStatusGuestLinksGet ::
+      routes
+        :- IFeatureStatusGet 'Public.WithLockStatus 'Public.TeamFeatureGuestLinks,
+    iTeamFeatureStatusGuestLinksPut ::
+      routes
+        :- IFeatureStatusPut 'Public.TeamFeatureGuestLinks,
+    iTeamFeatureLockStatusGuestLinksPut ::
+      routes
+        :- IFeatureStatusLockStatusPut 'Public.TeamFeatureGuestLinks,
     -- This endpoint can lead to the following events being sent:
     -- - MemberLeave event to members for all conversations the user was in
     iDeleteUser ::
@@ -318,6 +327,9 @@ servantSitemap =
         iTeamFeatureStatusSelfDeletingMessagesPut = iPutTeamFeature @'Public.TeamFeatureSelfDeletingMessages Features.setSelfDeletingMessagesInternal,
         iTeamFeatureStatusSelfDeletingMessagesGet = iGetTeamFeature @'Public.WithLockStatus @'Public.TeamFeatureSelfDeletingMessages Features.getSelfDeletingMessagesInternal,
         iTeamFeatureLockStatusSelfDeletingMessagesPut = Features.setLockStatus @'Public.TeamFeatureSelfDeletingMessages,
+        iTeamFeatureStatusGuestLinksGet = iGetTeamFeature @'Public.WithLockStatus @'Public.TeamFeatureGuestLinks Features.getGuestLinkInternal,
+        iTeamFeatureStatusGuestLinksPut = iPutTeamFeature @'Public.TeamFeatureGuestLinks Features.setGuestLinkInternal,
+        iTeamFeatureLockStatusGuestLinksPut = Features.setLockStatus @'Public.TeamFeatureGuestLinks,
         iDeleteUser = rmUser,
         iConnect = Create.createConnectConversation,
         iUpsertOne2OneConversation = One2One.iUpsertOne2OneConversation
diff --git a/services/galley/src/Galley/API/Teams/Features.hs b/services/galley/src/Galley/API/Teams/Features.hs
index 63ef91cd19a..0eb176aee28 100644
--- a/services/galley/src/Galley/API/Teams/Features.hs
+++ b/services/galley/src/Galley/API/Teams/Features.hs
@@ -590,8 +590,8 @@ getSelfDeletingMessagesInternal = \case
   Right tid -> do
     cfgDefault <- getCfgDefault
     let defLockStatus = Public.tfwcapsLockStatus cfgDefault
-    (maybeFeatureStatus, fromMaybe defLockStatus -> lockStatus) <- TeamFeatures.getSelfDeletingMessagesStatus tid
-    pure $ case (lockStatus, maybeFeatureStatus) of
+    (mbFeatureStatus, fromMaybe defLockStatus -> lockStatus) <- TeamFeatures.getSelfDeletingMessagesStatus tid
+    pure $ case (lockStatus, mbFeatureStatus) of
       (Public.Unlocked, Just featureStatus) ->
         Public.TeamFeatureStatusWithConfigAndLockStatus
           (Public.tfwcStatus featureStatus)
@@ -616,15 +616,14 @@ setSelfDeletingMessagesInternal ::
   Public.TeamFeatureStatus 'Public.WithoutLockStatus 'Public.TeamFeatureSelfDeletingMessages ->
   Sem r (Public.TeamFeatureStatus 'Public.WithoutLockStatus 'Public.TeamFeatureSelfDeletingMessages)
 setSelfDeletingMessagesInternal tid st = do
-  dftLockStatus <- Public.tfwcapsLockStatus <$> getCfgDefault
-  guardLockStatus @'Public.TeamFeatureSelfDeletingMessages tid dftLockStatus
+  getDftLockStatus >>= guardLockStatus @'Public.TeamFeatureSelfDeletingMessages tid
   let pushEvent =
         pushFeatureConfigEvent tid $
           Event.Event Event.Update Public.TeamFeatureSelfDeletingMessages (EdFeatureSelfDeletingMessagesChanged st)
   TeamFeatures.setSelfDeletingMessagesStatus tid st <* pushEvent
   where
-    getCfgDefault :: Sem r (Public.TeamFeatureStatusWithConfigAndLockStatus Public.TeamFeatureSelfDeletingMessagesConfig)
-    getCfgDefault = input <&> view (optSettings . setFeatureFlags . flagSelfDeletingMessages . unDefaults)
+    getDftLockStatus :: Sem r Public.LockStatusValue
+    getDftLockStatus = input <&> view (optSettings . setFeatureFlags . flagSelfDeletingMessages . unDefaults . to Public.tfwcapsLockStatus)
 
 getGuestLinkInternal ::
   forall r.
@@ -635,15 +634,14 @@ getGuestLinkInternal = \case
   Left _ -> getCfgDefault
   Right tid -> do
     cfgDefault <- getCfgDefault
-    let defLockStatus = Public.tfwoapsLockStatus cfgDefault
-    maybeFeatureStatus <- TeamFeatures.getFeatureStatusNoConfig @'Public.TeamFeatureGuestLinks tid
-    pure $ case (defLockStatus, maybeFeatureStatus) of
+    (mbFeatureStatus, fromMaybe (Public.tfwoapsLockStatus cfgDefault) -> lockStatus) <- TeamFeatures.getFeatureStatusNoConfigAndLockStatus @'Public.TeamFeatureGuestLinks tid
+    pure $ case (lockStatus, mbFeatureStatus) of
       (Public.Unlocked, Just featureStatus) ->
         Public.TeamFeatureStatusNoConfigAndLockStatus
           (Public.tfwoStatus featureStatus)
-          Public.Unlocked
-      (Public.Unlocked, Nothing) -> cfgDefault {Public.tfwoapsLockStatus = Public.Unlocked}
-      (Public.Locked, _) -> cfgDefault {Public.tfwoapsLockStatus = Public.Locked}
+          lockStatus
+      (Public.Unlocked, Nothing) -> cfgDefault {Public.tfwoapsLockStatus = lockStatus}
+      (Public.Locked, _) -> cfgDefault {Public.tfwoapsLockStatus = lockStatus}
   where
     getCfgDefault :: Sem r (Public.TeamFeatureStatus 'Public.WithLockStatus 'Public.TeamFeatureGuestLinks)
     getCfgDefault = input <&> view (optSettings . setFeatureFlags . flagConversationGuestLinks . unDefaults)
@@ -661,8 +659,7 @@ setGuestLinkInternal ::
   Public.TeamFeatureStatus 'Public.WithoutLockStatus 'Public.TeamFeatureGuestLinks ->
   Sem r (Public.TeamFeatureStatus 'Public.WithoutLockStatus 'Public.TeamFeatureGuestLinks)
 setGuestLinkInternal tid status = do
-  cfgDefault <- Public.tfwoapsLockStatus <$> getCfgDefault
-  guardLockStatus @'Public.TeamFeatureGuestLinks tid cfgDefault
+  getDftLockStatus >>= guardLockStatus @'Public.TeamFeatureGuestLinks tid
   let pushEvent =
         pushFeatureConfigEvent tid $
           Event.Event
@@ -673,8 +670,8 @@ setGuestLinkInternal tid status = do
             )
   TeamFeatures.setFeatureStatusNoConfig @'Public.TeamFeatureGuestLinks tid status <* pushEvent
   where
-    getCfgDefault :: Sem r (Public.TeamFeatureStatus 'Public.WithLockStatus 'Public.TeamFeatureGuestLinks)
-    getCfgDefault = input <&> view (optSettings . setFeatureFlags . flagConversationGuestLinks . unDefaults)
+    getDftLockStatus :: Sem r Public.LockStatusValue
+    getDftLockStatus = input <&> view (optSettings . setFeatureFlags . flagConversationGuestLinks . unDefaults . to Public.tfwoapsLockStatus)
 
 -- TODO(fisx): move this function to a more suitable place / module.
 guardLockStatus ::
diff --git a/services/galley/src/Galley/Cassandra.hs b/services/galley/src/Galley/Cassandra.hs
index a5477dd16d9..2840865d44c 100644
--- a/services/galley/src/Galley/Cassandra.hs
+++ b/services/galley/src/Galley/Cassandra.hs
@@ -20,4 +20,4 @@ module Galley.Cassandra (schemaVersion) where
 import Imports
 
 schemaVersion :: Int32
-schemaVersion = 56
+schemaVersion = 57
diff --git a/services/galley/src/Galley/Cassandra/TeamFeatures.hs b/services/galley/src/Galley/Cassandra/TeamFeatures.hs
index 53a4065f874..4bd104cbe9e 100644
--- a/services/galley/src/Galley/Cassandra/TeamFeatures.hs
+++ b/services/galley/src/Galley/Cassandra/TeamFeatures.hs
@@ -29,9 +29,6 @@ import Polysemy
 import Polysemy.Input
 import Wire.API.Team.Feature
 
--- TODO(leif): according to the specs it should only be supported to read the lock status via the api
--- changes can only be made in the server configuration file
--- we can probably remove the lock status from the db?
 getFeatureStatusNoConfigAndLockStatus ::
   forall (a :: TeamFeatureName) m.
   (MonadClient m, FeatureHasNoConfig 'WithoutLockStatus a, HasStatusCol a, HasLockStatusCol a) =>
diff --git a/services/galley/src/Galley/Data/TeamFeatures.hs b/services/galley/src/Galley/Data/TeamFeatures.hs
index 12cd3dc28b6..8d694625601 100644
--- a/services/galley/src/Galley/Data/TeamFeatures.hs
+++ b/services/galley/src/Galley/Data/TeamFeatures.hs
@@ -65,7 +65,8 @@ instance {-# OVERLAPPABLE #-} HasLockStatusCol a => MaybeHasLockStatusCol a wher
 instance HasLockStatusCol 'TeamFeatureSelfDeletingMessages where
   lockStatusCol = "self_deleting_messages_lock_status"
 
-instance MaybeHasLockStatusCol 'TeamFeatureGuestLinks where maybeLockStatusCol = Nothing
+instance HasLockStatusCol 'TeamFeatureGuestLinks where
+  lockStatusCol = "guest_links_lock_status"
 
 instance MaybeHasLockStatusCol 'TeamFeatureLegalHold where maybeLockStatusCol = Nothing
 
diff --git a/services/galley/test/integration/API/Teams/Feature.hs b/services/galley/test/integration/API/Teams/Feature.hs
index f3b1989bd91..04c283203de 100644
--- a/services/galley/test/integration/API/Teams/Feature.hs
+++ b/services/galley/test/integration/API/Teams/Feature.hs
@@ -70,7 +70,8 @@ tests s =
       test s "Feature Configs / Team Features Consistency" testFeatureConfigConsistency,
       test s "ConferenceCalling" $ testSimpleFlag @'Public.TeamFeatureConferenceCalling Public.TeamFeatureEnabled,
       test s "SelfDeletingMessages" testSelfDeletingMessages,
-      test s "ConversationGuestLinks" testGuestLinks
+      test s "ConversationGuestLinks - public API" testGuestLinksPublic,
+      test s "ConversationGuestLinks - internal API" testGuestLinksInternal
     ]
 
 testSSO :: TestM ()
@@ -474,26 +475,58 @@ testSelfDeletingMessages = do
   checkSetLockStatus Public.Unlocked
   checkGet TeamFeatureDisabled 30 Public.Unlocked
 
-testGuestLinks :: TestM ()
-testGuestLinks = do
+testGuestLinksInternal :: TestM ()
+testGuestLinksInternal = do
   galley <- view tsGalley
+  testGuestLinks
+    (const $ Util.getTeamFeatureFlagInternal Public.TeamFeatureGuestLinks)
+    (const $ Util.putTeamFeatureFlagInternal @'Public.TeamFeatureGuestLinks galley)
+    (Util.setLockStatusInternal @'Public.TeamFeatureGuestLinks galley)
+
+testGuestLinksPublic :: TestM ()
+testGuestLinksPublic = do
+  galley <- view tsGalley
+  testGuestLinks
+    (Util.getTeamFeatureFlagWithGalley Public.TeamFeatureGuestLinks galley)
+    (Util.putTeamFeatureFlagWithGalley @'Public.TeamFeatureGuestLinks galley)
+    (Util.setLockStatusInternal @'Public.TeamFeatureGuestLinks galley)
+
+testGuestLinks ::
+  (UserId -> TeamId -> TestM ResponseLBS) ->
+  (UserId -> TeamId -> Public.TeamFeatureStatusNoConfig -> TestM ResponseLBS) ->
+  (TeamId -> Public.LockStatusValue -> TestM ResponseLBS) ->
+  TestM ()
+testGuestLinks getStatus putStatus setLockStatusInternal = do
   (owner, tid, []) <- Util.createBindingTeamWithNMembers 0
   let checkGet :: HasCallStack => Public.TeamFeatureStatusValue -> Public.LockStatusValue -> TestM ()
       checkGet status lock =
-        do
-          Util.getTeamFeatureFlagWithGalley Public.TeamFeatureGuestLinks galley owner tid
-          !!! responseJsonEither === const (Right (Public.TeamFeatureStatusNoConfigAndLockStatus status lock))
-      checkSet :: HasCallStack => Public.TeamFeatureStatusValue -> TestM ()
-      checkSet status =
-        do
-          Util.putTeamFeatureFlagWithGalley @'Public.TeamFeatureGuestLinks galley owner tid (Public.TeamFeatureStatusNoConfig status)
-          !!! statusCode === const 200
+        getStatus owner tid !!! do
+          statusCode === const 200
+          responseJsonEither === const (Right (Public.TeamFeatureStatusNoConfigAndLockStatus status lock))
+
+      checkSet :: HasCallStack => Public.TeamFeatureStatusValue -> Int -> TestM ()
+      checkSet status expectedStatusCode =
+        putStatus owner tid (Public.TeamFeatureStatusNoConfig status) !!! statusCode === const expectedStatusCode
+
+      checkSetLockStatusInternal :: HasCallStack => Public.LockStatusValue -> TestM ()
+      checkSetLockStatusInternal lockStatus =
+        setLockStatusInternal tid lockStatus !!! statusCode === const 200
 
   checkGet Public.TeamFeatureEnabled Public.Unlocked
-  checkSet Public.TeamFeatureDisabled
+  checkSet Public.TeamFeatureDisabled 200
   checkGet Public.TeamFeatureDisabled Public.Unlocked
-  checkSet Public.TeamFeatureEnabled
+  checkSet Public.TeamFeatureEnabled 200
   checkGet Public.TeamFeatureEnabled Public.Unlocked
+  checkSet Public.TeamFeatureDisabled 200
+  checkGet Public.TeamFeatureDisabled Public.Unlocked
+  -- when locks status is locked the team default feature status should be returned
+  -- and the team feature status can not be changed
+  checkSetLockStatusInternal Public.Locked
+  checkGet Public.TeamFeatureEnabled Public.Locked
+  checkSet Public.TeamFeatureDisabled 409
+  -- when lock status is unlocked again the previously set feature status is restored
+  checkSetLockStatusInternal Public.Unlocked
+  checkGet Public.TeamFeatureDisabled Public.Unlocked
 
 -- | Call 'GET /teams/:tid/features' and 'GET /feature-configs', and check if all
 -- features are there.

From f99f1e48292f884c74e1c6b1c59262e0970ea3f3 Mon Sep 17 00:00:00 2001
From: Leif Battermann <leif.battermann@gmail.com>
Date: Fri, 17 Dec 2021 17:26:00 +0100
Subject: [PATCH 18/74] SQSERVICES-547 Enforce disabling guest links when
 conversation is joined (#1976)

---
 changelog.d/2-features/pr-1976                |  1 +
 .../wire-api/src/Wire/API/ErrorDescription.hs |  2 +
 .../src/Wire/API/Routes/Public/Galley.hs      |  1 +
 services/galley/src/Galley/API/Error.hs       |  5 ++
 services/galley/src/Galley/API/Query.hs       | 40 +++++++++----
 .../galley/src/Galley/API/Teams/Features.hs   |  1 +
 services/galley/test/integration/API.hs       | 59 +++++++++++++++++++
 services/galley/test/integration/API/Util.hs  |  8 ++-
 8 files changed, 103 insertions(+), 14 deletions(-)
 create mode 100644 changelog.d/2-features/pr-1976

diff --git a/changelog.d/2-features/pr-1976 b/changelog.d/2-features/pr-1976
new file mode 100644
index 00000000000..e67dd816a08
--- /dev/null
+++ b/changelog.d/2-features/pr-1976
@@ -0,0 +1 @@
+If the guest links team feature is disabled guest links will be revoked.
diff --git a/libs/wire-api/src/Wire/API/ErrorDescription.hs b/libs/wire-api/src/Wire/API/ErrorDescription.hs
index f02a37cc0f0..1cb53ce4a38 100644
--- a/libs/wire-api/src/Wire/API/ErrorDescription.hs
+++ b/libs/wire-api/src/Wire/API/ErrorDescription.hs
@@ -261,6 +261,8 @@ type HandleNotFound = ErrorDescription 404 "not-found" "Handle not found"
 
 type TooManyClients = ErrorDescription 403 "too-many-clients" "Too many clients"
 
+type GuestLinksDisabled = ErrorDescription 409 "guest-links-disabled" "The guest link feature is disabled and all guest links have been revoked."
+
 type MissingAuth =
   ErrorDescription
     403
diff --git a/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs b/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs
index 158fddcca3f..30e402c0590 100644
--- a/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs
+++ b/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs
@@ -195,6 +195,7 @@ data Api routes = Api
         :> CanThrow CodeNotFound
         :> CanThrow ConvNotFound
         :> CanThrow ConvAccessDenied
+        :> CanThrow GuestLinksDisabled
         :> ZLocalUser
         :> "conversations"
         :> "join"
diff --git a/services/galley/src/Galley/API/Error.hs b/services/galley/src/Galley/API/Error.hs
index a4569e788c9..2e5a8a9afd5 100644
--- a/services/galley/src/Galley/API/Error.hs
+++ b/services/galley/src/Galley/API/Error.hs
@@ -122,6 +122,7 @@ data ConversationError
   | ConvMemberNotFound
   | NoBindingTeamMembers
   | NoManagedTeamConv
+  | GuestLinksDisabled
 
 instance APIError ConversationError where
   toWai ConvAccessDenied = errorDescriptionTypeToWai @ConvAccessDenied
@@ -130,6 +131,7 @@ instance APIError ConversationError where
   toWai ConvMemberNotFound = errorDescriptionTypeToWai @ConvMemberNotFound
   toWai NoBindingTeamMembers = noBindingTeamMembers
   toWai NoManagedTeamConv = noManagedTeamConv
+  toWai GuestLinksDisabled = guestLinksDisabled
 
 data TeamError
   = NoBindingTeam
@@ -396,6 +398,9 @@ teamMemberNotFound = mkError status404 "no-team-member" "team member not found"
 noManagedTeamConv :: Error
 noManagedTeamConv = mkError status400 "no-managed-team-conv" "Managed team conversations have been deprecated."
 
+guestLinksDisabled :: Error
+guestLinksDisabled = mkError status409 "guest-links-disabled" "The guest link feature is disabled and all guest links have been revoked."
+
 userBindingExists :: Error
 userBindingExists = mkError status403 "binding-exists" "User already bound to a different team."
 
diff --git a/services/galley/src/Galley/API/Query.hs b/services/galley/src/Galley/API/Query.hs
index b2c678d8371..ace30d6eec7 100644
--- a/services/galley/src/Galley/API/Query.hs
+++ b/services/galley/src/Galley/API/Query.hs
@@ -34,6 +34,7 @@ module Galley.API.Query
 where
 
 import qualified Cassandra as C
+import Control.Lens
 import qualified Data.ByteString.Lazy as LBS
 import Data.Code
 import Data.CommaSeparatedList
@@ -54,9 +55,12 @@ import qualified Galley.Effects.ConversationStore as E
 import qualified Galley.Effects.FederatorAccess as E
 import qualified Galley.Effects.ListItems as E
 import qualified Galley.Effects.MemberStore as E
+import qualified Galley.Effects.TeamFeatureStore as TeamFeatures
+import Galley.Options
 import Galley.Types
 import Galley.Types.Conversations.Members
 import Galley.Types.Conversations.Roles
+import Galley.Types.Teams
 import Imports
 import Network.HTTP.Types
 import Network.Wai
@@ -77,6 +81,7 @@ import qualified Wire.API.Federation.API.Galley as F
 import Wire.API.Federation.Error
 import qualified Wire.API.Provider.Bot as Public
 import qualified Wire.API.Routes.MultiTablePaging as Public
+import Wire.API.Team.Feature as Public
 
 getBotConversationH ::
   Members '[ConversationStore, Error ConversationError, Input (Local ())] r =>
@@ -490,16 +495,17 @@ getConversationMeta cnv = do
       pure Nothing
 
 getConversationByReusableCode ::
-  Members
-    '[ BrigAccess,
-       CodeStore,
-       ConversationStore,
-       Error CodeError,
-       Error ConversationError,
-       Error NotATeamMember,
-       TeamStore
-     ]
-    r =>
+  forall r.
+  ( Member BrigAccess r,
+    Member CodeStore r,
+    Member ConversationStore r,
+    Member (Error CodeError) r,
+    Member (Error ConversationError) r,
+    Member (Error NotATeamMember) r,
+    Member TeamStore r,
+    Member TeamFeatureStore r,
+    Member (Input Opts) r
+  ) =>
   Local UserId ->
   Key ->
   Value ->
@@ -507,7 +513,9 @@ getConversationByReusableCode ::
 getConversationByReusableCode lusr key value = do
   c <- verifyReusableCode (ConversationCode key value Nothing)
   conv <- ensureConversationAccess (tUnqualified lusr) (Data.codeConversation c) CodeAccess
-  pure $ coverView conv
+  getFeatureStatus conv >>= \case
+    TeamFeatureEnabled -> pure $ coverView conv
+    TeamFeatureDisabled -> throw GuestLinksDisabled
   where
     coverView :: Data.Conversation -> ConversationCoverView
     coverView conv =
@@ -515,3 +523,13 @@ getConversationByReusableCode lusr key value = do
         { cnvCoverConvId = Data.convId conv,
           cnvCoverName = Data.convName conv
         }
+
+    getDefaultFeatureStatus :: Sem r TeamFeatureStatusValue
+    getDefaultFeatureStatus =
+      input <&> view (optSettings . setFeatureFlags . flagConversationGuestLinks . unDefaults . to tfwoapsStatus)
+
+    getFeatureStatus :: Data.Conversation -> Sem r TeamFeatureStatusValue
+    getFeatureStatus conv = do
+      defaultStatus <- getDefaultFeatureStatus
+      maybeFeatureStatus <- join <$> TeamFeatures.getFeatureStatusNoConfig @'TeamFeatureGuestLinks `traverse` Data.convTeam conv
+      pure $ maybe defaultStatus tfwoStatus maybeFeatureStatus
diff --git a/services/galley/src/Galley/API/Teams/Features.hs b/services/galley/src/Galley/API/Teams/Features.hs
index 0eb176aee28..4593501051f 100644
--- a/services/galley/src/Galley/API/Teams/Features.hs
+++ b/services/galley/src/Galley/API/Teams/Features.hs
@@ -17,6 +17,7 @@
 
 module Galley.API.Teams.Features
   ( getFeatureStatus,
+    getFeatureStatusNoConfig,
     setFeatureStatus,
     getFeatureConfig,
     getAllFeatureConfigs,
diff --git a/services/galley/test/integration/API.hs b/services/galley/test/integration/API.hs
index 13d41e2b806..3d2706dd4e5 100644
--- a/services/galley/test/integration/API.hs
+++ b/services/galley/test/integration/API.hs
@@ -33,6 +33,8 @@ import qualified API.Teams.Feature as TeamFeature
 import qualified API.Teams.LegalHold as Teams.LegalHold
 import qualified API.Teams.LegalHold.DisabledByDefault
 import API.Util
+import qualified API.Util as Util
+import API.Util.TeamFeature as TeamFeatures
 import Bilge hiding (timeout)
 import Bilge.Assert
 import Brig.Types
@@ -93,6 +95,7 @@ import Wire.API.Federation.API.Galley
 import qualified Wire.API.Federation.API.Galley as F
 import qualified Wire.API.Message as Message
 import Wire.API.Routes.MultiTablePaging
+import qualified Wire.API.Team.Feature as Public
 import Wire.API.User.Client
 import Wire.API.UserMap (UserMap (..))
 
@@ -218,6 +221,8 @@ tests s =
           test s "convert code to team-access conversation" postConvertTeamConv,
           test s "local and remote guests are removed when access changes" testAccessUpdateGuestRemoved,
           test s "cannot join private conversation" postJoinConvFail,
+          test s "revoke guest links for team conversation" testJoinTeamConvGuestLinksDisabled,
+          test s "revoke guest links for non-team conversation" testJoinNonTeamConvGuestLinksDisabled,
           test s "remove user with only local convs" removeUserNoFederation,
           test s "remove user with local and remote convs" removeUser,
           test s "iUpsertOne2OneConversation" testAllOne2OneConversationRequests,
@@ -1236,6 +1241,60 @@ testJoinCodeConv = do
   getJoinCodeConv eve (conversationKey cCode) (conversationCode cCode) !!! do
     const 403 === statusCode
 
+testJoinTeamConvGuestLinksDisabled :: TestM ()
+testJoinTeamConvGuestLinksDisabled = do
+  galley <- view tsGalley
+  let convName = "testConversation"
+  (owner, teamId, []) <- Util.createBindingTeamWithNMembers 0
+  userNotInTeam <- randomUser
+  convId <- decodeConvId <$> postTeamConv teamId owner [] (Just convName) [CodeAccess] (Just ActivatedAccessRole) Nothing
+  cCode <- decodeConvCodeEvent <$> postConvCode owner convId
+
+  -- works by default
+  getJoinCodeConv userNotInTeam (conversationKey cCode) (conversationCode cCode) !!! do
+    const (Right (ConversationCoverView convId (Just convName))) === responseJsonEither
+    const 200 === statusCode
+
+  -- fails if disabled
+  let tfStatus = Public.TeamFeatureStatusNoConfig Public.TeamFeatureDisabled
+  TeamFeatures.putTeamFeatureFlagWithGalley @'Public.TeamFeatureGuestLinks galley owner teamId tfStatus !!! do
+    const 200 === statusCode
+
+  getJoinCodeConv userNotInTeam (conversationKey cCode) (conversationCode cCode) !!! do
+    const 409 === statusCode
+
+  -- after re-enabling, the old link is still valid
+  let tfStatus' = Public.TeamFeatureStatusNoConfig Public.TeamFeatureEnabled
+  TeamFeatures.putTeamFeatureFlagWithGalley @'Public.TeamFeatureGuestLinks galley owner teamId tfStatus' !!! do
+    const 200 === statusCode
+
+  getJoinCodeConv userNotInTeam (conversationKey cCode) (conversationCode cCode) !!! do
+    const (Right (ConversationCoverView convId (Just convName))) === responseJsonEither
+    const 200 === statusCode
+
+testJoinNonTeamConvGuestLinksDisabled :: TestM ()
+testJoinNonTeamConvGuestLinksDisabled = do
+  galley <- view tsGalley
+  let convName = "testConversation"
+  (owner, teamId, []) <- Util.createBindingTeamWithNMembers 0
+  userNotInTeam <- randomUser
+  convId <- decodeConvId <$> postConv owner [] (Just convName) [CodeAccess] (Just ActivatedAccessRole) Nothing
+  cCode <- decodeConvCodeEvent <$> postConvCode owner convId
+
+  -- works by default
+  getJoinCodeConv userNotInTeam (conversationKey cCode) (conversationCode cCode) !!! do
+    const (Right (ConversationCoverView convId (Just convName))) === responseJsonEither
+    const 200 === statusCode
+
+  -- for non-team conversations it still works if status is disabled for the team but not server wide
+  let tfStatus = Public.TeamFeatureStatusNoConfig Public.TeamFeatureDisabled
+  TeamFeatures.putTeamFeatureFlagWithGalley @'Public.TeamFeatureGuestLinks galley owner teamId tfStatus !!! do
+    const 200 === statusCode
+
+  getJoinCodeConv userNotInTeam (conversationKey cCode) (conversationCode cCode) !!! do
+    const (Right (ConversationCoverView convId (Just convName))) === responseJsonEither
+    const 200 === statusCode
+
 postJoinCodeConvOk :: TestM ()
 postJoinCodeConvOk = do
   c <- view tsCannon
diff --git a/services/galley/test/integration/API/Util.hs b/services/galley/test/integration/API/Util.hs
index b1cb862d558..31af5c651a5 100644
--- a/services/galley/test/integration/API/Util.hs
+++ b/services/galley/test/integration/API/Util.hs
@@ -1738,7 +1738,10 @@ randomTeamCreator :: HasCallStack => TestM UserId
 randomTeamCreator = qUnqualified <$> randomUser' True True True
 
 randomUser' :: HasCallStack => Bool -> Bool -> Bool -> TestM (Qualified UserId)
-randomUser' isCreator hasPassword hasEmail = do
+randomUser' isCreator hasPassword hasEmail = userQualifiedId . selfUser <$> randomUserProfile' isCreator hasPassword hasEmail
+
+randomUserProfile' :: HasCallStack => Bool -> Bool -> Bool -> TestM SelfProfile
+randomUserProfile' isCreator hasPassword hasEmail = do
   b <- view tsBrig
   e <- liftIO randomEmail
   let p =
@@ -1747,8 +1750,7 @@ randomUser' isCreator hasPassword hasEmail = do
             <> ["password" .= defPassword | hasPassword]
             <> ["email" .= fromEmail e | hasEmail]
             <> ["team" .= Team.BindingNewTeam (Team.newNewTeam (unsafeRange "teamName") (unsafeRange "defaultIcon")) | isCreator]
-  selfProfile <- responseJsonUnsafe <$> (post (b . path "/i/users" . json p) <!! const 201 === statusCode)
-  pure . userQualifiedId . selfUser $ selfProfile
+  responseJsonUnsafe <$> (post (b . path "/i/users" . json p) <!! const 201 === statusCode)
 
 ephemeralUser :: HasCallStack => TestM UserId
 ephemeralUser = do

From e1866b3f6184bb177332191ffb2af57c91146abf Mon Sep 17 00:00:00 2001
From: Paolo Capriotti <paolo@capriotti.io>
Date: Mon, 20 Dec 2021 10:19:50 +0100
Subject: [PATCH 19/74] Servantify cargohold and add `federationDomain` option
 (#1990)

* Schema instances for Asset and related types

* Initial stub of cargohold servant API

* Servantify asset upload endpoint

* Add federation domain configuration to Cargohold

* Add examples to Asset swagger schema

* Formatting fixes

* Document postAsset errors in Swagger

* Add federation domain conf to kube-ci

* Migrate v3 dowload assets endpoint to Servant

* Migrate v3 delete asset endpoint to Servant

* Simplify implementation of ZLocalUser

* Simplify implementation of MultiVerb headers

* Migrate v3 token endpoints to Servant

* Add bot and provider asset APIs

* Specialise asset API for bots and providers

* Check Z-Type header for bot and provider requests

* Migrate legacy asset API to Servant

* Migrate internal status endpoints to Servant

* Use dependent kinds to define `PrincipalPrefix`

Thanks @isovector for suggesting this approach.

* Add servant prometheus metrics and remove wai

* Document new federationDomain option

* Add CHANGELOG entry about cargohold domain

* Improve federationDomain docs

Co-authored-by: jschaul <jschaul@users.noreply.github.com>

* Formatting fixes

* Fix and simplify API paths by principal

* Support asset_token query parameter

Co-authored-by: Sven Tennie <sven.tennie@gmail.com>
Co-authored-by: jschaul <jschaul@users.noreply.github.com>
---
 changelog.d/0-release-notes/cargohold-domain  |   1 +
 charts/cargohold/templates/configmap.yaml     |   3 +
 .../conf/cargohold.demo-docker.yaml           |   1 +
 deploy/services-demo/conf/cargohold.demo.yaml |   1 +
 docs/reference/config-options.md              |  17 +-
 hack/helmfile.yaml                            |   4 +
 libs/metrics-wai/src/Data/Metrics/Servant.hs  |   6 +
 libs/schema-profunctor/src/Data/Schema.hs     |   4 +
 libs/types-common/src/Data/Id.hs              |   1 +
 libs/wire-api/package.yaml                    |   2 +
 libs/wire-api/src/Wire/API/Asset/V3.hs        | 122 ++++---
 .../wire-api/src/Wire/API/ErrorDescription.hs |   8 +
 .../wire-api/src/Wire/API/Routes/AssetBody.hs |  63 ++++
 .../wire-api/src/Wire/API/Routes/MultiVerb.hs |  99 +++--
 libs/wire-api/src/Wire/API/Routes/Public.hs   |  82 ++++-
 .../src/Wire/API/Routes/Public/Cargohold.hs   | 179 +++++++++
 .../src/Wire/API/Routes/Public/Galley.hs      |   8 +-
 libs/wire-api/wire-api.cabal                  |   6 +-
 services/brig/src/Brig/API/Public.hs          |   8 +-
 services/cargohold/cargohold.cabal            |   9 +-
 services/cargohold/cargohold.integration.yaml |   1 +
 services/cargohold/package.yaml               |   6 +-
 services/cargohold/src/CargoHold/API.hs       |  40 --
 services/cargohold/src/CargoHold/API/Error.hs |  34 +-
 .../cargohold/src/CargoHold/API/Public.hs     | 345 +++++-------------
 services/cargohold/src/CargoHold/Options.hs   |  20 +-
 services/cargohold/src/CargoHold/Run.hs       |  30 +-
 services/cargohold/test/integration/API/V3.hs |   9 +
 services/cargohold/test/integration/Main.hs   |  12 +-
 29 files changed, 665 insertions(+), 456 deletions(-)
 create mode 100644 changelog.d/0-release-notes/cargohold-domain
 create mode 100644 libs/wire-api/src/Wire/API/Routes/AssetBody.hs
 create mode 100644 libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs
 delete mode 100644 services/cargohold/src/CargoHold/API.hs

diff --git a/changelog.d/0-release-notes/cargohold-domain b/changelog.d/0-release-notes/cargohold-domain
new file mode 100644
index 00000000000..33e8403cf87
--- /dev/null
+++ b/changelog.d/0-release-notes/cargohold-domain
@@ -0,0 +1 @@
+This release introduces a mandatory `federationDomain` configuration setting to cargohold. Please update your `values/wire-server/values.yaml` to set `cargohold.settings.federationDomain` to the same value as the corresponding option in galley (and brig).
diff --git a/charts/cargohold/templates/configmap.yaml b/charts/cargohold/templates/configmap.yaml
index 3e1f4ce9b2b..52f3ad7c0c6 100644
--- a/charts/cargohold/templates/configmap.yaml
+++ b/charts/cargohold/templates/configmap.yaml
@@ -30,5 +30,8 @@ data:
       {{- end }}
 
     settings:
+      {{- with .Values.config.settings }}
       maxTotalBytes: 5368709120
       downloadLinkTTL: 300      # Seconds
+      federationDomain: {{ .federationDomain }}
+      {{- end }}
diff --git a/deploy/services-demo/conf/cargohold.demo-docker.yaml b/deploy/services-demo/conf/cargohold.demo-docker.yaml
index 0290f1fc0e3..c9dda863aad 100644
--- a/deploy/services-demo/conf/cargohold.demo-docker.yaml
+++ b/deploy/services-demo/conf/cargohold.demo-docker.yaml
@@ -11,6 +11,7 @@ aws:
 settings:
   maxTotalBytes: 27262976
   downloadLinkTTL: 300    # Seconds
+  federationDomain: example.com
 
 logLevel: Info
 logNetStrings: false
diff --git a/deploy/services-demo/conf/cargohold.demo.yaml b/deploy/services-demo/conf/cargohold.demo.yaml
index b4200096b44..0f1228dcbaa 100644
--- a/deploy/services-demo/conf/cargohold.demo.yaml
+++ b/deploy/services-demo/conf/cargohold.demo.yaml
@@ -11,6 +11,7 @@ aws:
 settings:
   maxTotalBytes: 27262976
   downloadLinkTTL: 300    # Seconds
+  federationDomain: example.com
 
 logLevel: Info
 logNetStrings: false
diff --git a/docs/reference/config-options.md b/docs/reference/config-options.md
index ce3535eb736..03630aee07a 100644
--- a/docs/reference/config-options.md
+++ b/docs/reference/config-options.md
@@ -169,18 +169,25 @@ This record should have entries which lead to the federator.
 **IMPORTANT** Once this option is set, it cannot be changed without breaking
 experience for all the users which are already using the backend.
 
-This configuration needs to be made in brig and in galley. (note the slighly different spelling of the config options)
+This configuration needs to be made in brig, cargohold and galley (note the
+slighly different spelling of the config options).
 
 ```yaml
-# galley.yaml
+# brig.yaml
+optSettings:
+  setFederationDomain: example.com
+```
+
+```yaml
+# cargohold.yaml
 settings:
   federationDomain: example.com
 ```
 
 ```yaml
-# brig.yaml
-optSettings:
-  setFederationDomain: example.com
+# galley.yaml
+settings:
+  federationDomain: example.com
 ```
 
 ### Federation allow list
diff --git a/hack/helmfile.yaml b/hack/helmfile.yaml
index 578cef0d9a4..e345085bc1d 100644
--- a/hack/helmfile.yaml
+++ b/hack/helmfile.yaml
@@ -108,6 +108,8 @@ releases:
         value: {{ .Values.federationDomain }}
       - name: galley.config.settings.federationDomain
         value: {{ .Values.federationDomain }}
+      - name: cargohold.config.settings.federationDomain
+        value: {{ .Values.federationDomain }}
 
   - name: '{{ .Values.namespace }}-wire-server-2'
     namespace: '{{ .Values.namespaceFed2 }}'
@@ -120,3 +122,5 @@ releases:
         value: {{ .Values.federationDomainFed2 }}
       - name: galley.config.settings.federationDomain
         value: {{ .Values.federationDomainFed2 }}
+      - name: cargohold.config.settings.federationDomain
+        value: {{ .Values.federationDomainFed2 }}
diff --git a/libs/metrics-wai/src/Data/Metrics/Servant.hs b/libs/metrics-wai/src/Data/Metrics/Servant.hs
index 1bcac5d86e1..02ac26f11ac 100644
--- a/libs/metrics-wai/src/Data/Metrics/Servant.hs
+++ b/libs/metrics-wai/src/Data/Metrics/Servant.hs
@@ -104,6 +104,12 @@ instance
   where
   getRoutes = getRoutes @rest
 
+instance
+  (RoutesToPaths rest) =>
+  RoutesToPaths (StreamBody' opts framing ct a :> rest)
+  where
+  getRoutes = getRoutes @rest
+
 instance
   (RoutesToPaths rest) =>
   RoutesToPaths (Summary summary :> rest)
diff --git a/libs/schema-profunctor/src/Data/Schema.hs b/libs/schema-profunctor/src/Data/Schema.hs
index d93ecf9c9ad..398d4caaabd 100644
--- a/libs/schema-profunctor/src/Data/Schema.hs
+++ b/libs/schema-profunctor/src/Data/Schema.hs
@@ -36,6 +36,7 @@ module Data.Schema
     schemaIn,
     schemaOut,
     HasDoc (..),
+    doc',
     HasSchemaRef (..),
     withParser,
     SwaggerDoc,
@@ -249,6 +250,9 @@ instance Choice (SchemaP doc v v') where
 instance HasDoc (SchemaP doc v v' a b) (SchemaP doc' v v' a b) doc doc' where
   doc = lens schemaDoc $ \(SchemaP d i o) d' -> SchemaP (Lens.set doc d' d) i o
 
+doc' :: Lens' (SchemaP doc v w a b) doc
+doc' = doc
+
 withParser :: SchemaP doc v w a b -> (b -> A.Parser b') -> SchemaP doc v w a b'
 withParser (SchemaP (SchemaDoc d) (SchemaIn p) (SchemaOut o)) q =
   SchemaP (SchemaDoc d) (SchemaIn (p >=> q)) (SchemaOut o)
diff --git a/libs/types-common/src/Data/Id.hs b/libs/types-common/src/Data/Id.hs
index 60f418eba18..44df9477eb8 100644
--- a/libs/types-common/src/Data/Id.hs
+++ b/libs/types-common/src/Data/Id.hs
@@ -325,6 +325,7 @@ newtype BotId = BotId
       Ord,
       FromByteString,
       ToByteString,
+      FromHttpApiData,
       Hashable,
       NFData,
       FromJSON,
diff --git a/libs/wire-api/package.yaml b/libs/wire-api/package.yaml
index b69330dc9ff..d4e8cd1a362 100644
--- a/libs/wire-api/package.yaml
+++ b/libs/wire-api/package.yaml
@@ -35,6 +35,7 @@ library:
   - cassava >= 0.5
   - cereal
   - comonad
+  - conduit
   - cookie
   - cryptonite
   - currency-codes >=2.0
@@ -68,6 +69,7 @@ library:
   - resourcet
   - servant-client
   - servant-client-core
+  - servant-conduit
   - servant-multipart
   - servant-server
   - servant-swagger
diff --git a/libs/wire-api/src/Wire/API/Asset/V3.hs b/libs/wire-api/src/Wire/API/Asset/V3.hs
index db55ca96908..7890b020ab9 100644
--- a/libs/wire-api/src/Wire/API/Asset/V3.hs
+++ b/libs/wire-api/src/Wire/API/Asset/V3.hs
@@ -57,19 +57,26 @@ module Wire.API.Asset.V3
 where
 
 import qualified Codec.MIME.Type as MIME
-import Control.Lens (makeLenses)
-import Data.Aeson
+import Control.Lens (makeLenses, (?~))
+import Data.Aeson (FromJSON (..), ToJSON (..))
+import qualified Data.Aeson as Aeson
 import Data.Attoparsec.ByteString.Char8
+import Data.Bifunctor
 import Data.ByteString.Builder
 import Data.ByteString.Conversion
 import qualified Data.ByteString.Lazy as LBS
 import Data.Id
-import Data.Json.Util (UTCTimeMillis (fromUTCTimeMillis), toUTCTimeMillis, (#))
+import Data.Json.Util (UTCTimeMillis (fromUTCTimeMillis), toUTCTimeMillis)
+import Data.Proxy
+import Data.Schema
+import qualified Data.Swagger as S
+import qualified Data.Text as T
 import Data.Text.Ascii (AsciiBase64Url)
 import qualified Data.Text.Encoding as T
 import Data.Time.Clock
 import qualified Data.UUID as UUID
 import Imports
+import Servant
 import Wire.API.Arbitrary (Arbitrary (..), GenericUniform (..))
 
 --------------------------------------------------------------------------------
@@ -82,6 +89,7 @@ data Asset = Asset
     _assetToken :: Maybe AssetToken
   }
   deriving stock (Eq, Show, Generic)
+  deriving (FromJSON, ToJSON, S.ToSchema) via Schema Asset
 
 -- Generate expiry time with millisecond precision
 instance Arbitrary Asset where
@@ -92,20 +100,15 @@ instance Arbitrary Asset where
 mkAsset :: AssetKey -> Asset
 mkAsset k = Asset k Nothing Nothing
 
-instance ToJSON Asset where
-  toJSON a =
-    object $
-      "key" .= _assetKey a
-        # "expires" .= fmap toUTCTimeMillis (_assetExpires a)
-        # "token" .= _assetToken a
-        # []
-
-instance FromJSON Asset where
-  parseJSON = withObject "Asset" $ \o ->
-    Asset
-      <$> o .: "key"
-      <*> o .:? "expires"
-      <*> o .:? "token"
+instance ToSchema Asset where
+  schema =
+    object "Asset" $
+      Asset
+        <$> _assetKey .= field "key" schema
+        <*> (fmap toUTCTimeMillis . _assetExpires)
+          .= maybe_
+            (optField "expires" (fromUTCTimeMillis <$> schema))
+        <*> _assetToken .= maybe_ (optField "token" schema)
 
 --------------------------------------------------------------------------------
 -- AssetKey
@@ -116,6 +119,7 @@ instance FromJSON Asset where
 data AssetKey = AssetKeyV3 AssetId AssetRetention
   deriving stock (Eq, Show, Generic)
   deriving (Arbitrary) via (GenericUniform AssetKey)
+  deriving (FromJSON, ToJSON, S.ToSchema) via (Schema AssetKey)
 
 instance FromByteString AssetKey where
   parser = do
@@ -143,13 +147,17 @@ instance ToByteString AssetKey where
       <> builder '-'
       <> builder (UUID.toASCIIBytes (toUUID i))
 
-instance ToJSON AssetKey where
-  toJSON = String . T.decodeUtf8 . toByteString'
+instance ToSchema AssetKey where
+  schema =
+    (T.decodeUtf8 . toByteString')
+      .= parsedText "AssetKey" (runParser parser . T.encodeUtf8)
+        & doc' . S.schema . S.example ?~ toJSON ("3-1-47de4580-ae51-4650-acbb-d10c028cb0ac" :: Text)
 
-instance FromJSON AssetKey where
-  parseJSON =
-    withText "AssetKey" $
-      either fail pure . runParser parser . T.encodeUtf8
+instance S.ToParamSchema AssetKey where
+  toParamSchema _ = S.toParamSchema (Proxy @Text)
+
+instance FromHttpApiData AssetKey where
+  parseUrlPiece = first T.pack . runParser parser . T.encodeUtf8
 
 --------------------------------------------------------------------------------
 -- AssetToken
@@ -157,21 +165,32 @@ instance FromJSON AssetKey where
 -- | Asset tokens are bearer tokens that grant access to a single asset.
 newtype AssetToken = AssetToken {assetTokenAscii :: AsciiBase64Url}
   deriving stock (Eq, Show)
-  deriving newtype (FromByteString, ToByteString, FromJSON, ToJSON, Arbitrary)
+  deriving newtype (FromByteString, ToByteString, Arbitrary)
+  deriving (FromJSON, ToJSON) via (Schema AssetToken)
+
+instance ToSchema AssetToken where
+  schema =
+    AssetToken <$> assetTokenAscii
+      .= schema
+        & doc' . S.schema . S.example ?~ toJSON ("aGVsbG8" :: Text)
+
+instance S.ToParamSchema AssetToken where
+  toParamSchema _ = S.toParamSchema (Proxy @Text)
+
+instance FromHttpApiData AssetToken where
+  parseUrlPiece = first T.pack . runParser parser . T.encodeUtf8
 
 -- | A newly (re)generated token for an existing asset.
 newtype NewAssetToken = NewAssetToken
   {newAssetToken :: AssetToken}
   deriving stock (Eq, Show)
   deriving newtype (Arbitrary)
+  deriving (FromJSON, ToJSON, S.ToSchema) via (Schema NewAssetToken)
 
-instance FromJSON NewAssetToken where
-  parseJSON = withObject "NewAssetToken" $ \o ->
-    NewAssetToken <$> o .: "token"
-
-instance ToJSON NewAssetToken where
-  toJSON (NewAssetToken tok) =
-    object ["token" .= tok]
+instance ToSchema NewAssetToken where
+  schema =
+    object "NewAssetToken" $
+      NewAssetToken <$> newAssetToken .= field "token" schema
 
 --------------------------------------------------------------------------------
 -- Body Construction
@@ -208,7 +227,7 @@ beginMultipartBody sets (AssetHeaders t l) =
     <> "\r\n\
        \\r\n"
   where
-    settingsJson = encode sets
+    settingsJson = Aeson.encode (schemaToJSON sets)
 
 -- | The trailer of a non-resumable @multipart/mixed@ request body initiated
 -- via 'beginMultipartBody'.
@@ -237,22 +256,17 @@ data AssetSettings = AssetSettings
   }
   deriving stock (Eq, Show, Generic)
   deriving (Arbitrary) via (GenericUniform AssetSettings)
+  deriving (FromJSON, ToJSON, S.ToSchema) via (Schema AssetSettings)
 
 defAssetSettings :: AssetSettings
 defAssetSettings = AssetSettings False Nothing
 
-instance ToJSON AssetSettings where
-  toJSON s =
-    object $
-      "public" .= _setAssetPublic s
-        # "retention" .= _setAssetRetention s
-        # []
-
-instance FromJSON AssetSettings where
-  parseJSON = withObject "AssetSettings" $ \o ->
-    AssetSettings
-      <$> o .:? "public" .!= False
-      <*> o .:? "retention"
+instance ToSchema AssetSettings where
+  schema =
+    object "AssetSettings" $
+      AssetSettings
+        <$> _setAssetPublic .= (fromMaybe False <$> optField "public" schema)
+        <*> _setAssetRetention .= maybe_ (optField "retention" schema)
 
 --------------------------------------------------------------------------------
 -- AssetRetention
@@ -275,6 +289,7 @@ data AssetRetention
     AssetExpiring
   deriving stock (Eq, Show, Enum, Bounded, Generic)
   deriving (Arbitrary) via (GenericUniform AssetRetention)
+  deriving (FromJSON, ToJSON, S.ToSchema) via (Schema AssetRetention)
 
 -- | The minimum TTL in seconds corresponding to a chosen retention.
 assetRetentionSeconds :: AssetRetention -> Maybe NominalDiffTime
@@ -308,9 +323,6 @@ instance FromByteString AssetRetention where
       5 -> return AssetExpiring
       _ -> fail $ "Invalid asset retention: " ++ show d
 
-instance ToJSON AssetRetention where
-  toJSON = String . retentionToTextRep
-
 retentionToTextRep :: AssetRetention -> Text
 retentionToTextRep AssetEternal = "eternal"
 retentionToTextRep AssetPersistent = "persistent"
@@ -318,16 +330,12 @@ retentionToTextRep AssetVolatile = "volatile"
 retentionToTextRep AssetEternalInfrequentAccess = "eternal-infrequent_access"
 retentionToTextRep AssetExpiring = "expiring"
 
--- | JSON representation, used by AssetSettings are
-instance FromJSON AssetRetention where
-  parseJSON = withText "AssetRetention" $ \t ->
-    case t of
-      "eternal" -> pure AssetEternal
-      "persistent" -> pure AssetPersistent
-      "volatile" -> pure AssetVolatile
-      "eternal-infrequent_access" -> pure AssetEternalInfrequentAccess
-      "expiring" -> pure AssetExpiring
-      _ -> fail $ "Invalid asset retention: " ++ show t
+instance ToSchema AssetRetention where
+  schema =
+    enum @Text "AssetRetention" $
+      foldMap
+        (\value -> element (retentionToTextRep value) value)
+        [minBound .. maxBound]
 
 makeLenses ''Asset
 makeLenses ''AssetSettings
diff --git a/libs/wire-api/src/Wire/API/ErrorDescription.hs b/libs/wire-api/src/Wire/API/ErrorDescription.hs
index 1cb53ce4a38..3b3b194ca03 100644
--- a/libs/wire-api/src/Wire/API/ErrorDescription.hs
+++ b/libs/wire-api/src/Wire/API/ErrorDescription.hs
@@ -240,6 +240,8 @@ operationDenied = operationDeniedSpecialized . show
 
 type NotATeamMember = ErrorDescription 403 "no-team-member" "Requesting user is not a team member"
 
+type Unauthorised = ErrorDescription 403 "unauthorised" "Unauthorised operation"
+
 type ActionDenied = ErrorDescription 403 "action-denied" "Insufficient authorization"
 
 actionDenied :: Show a => a -> ActionDenied
@@ -312,3 +314,9 @@ type InvalidOpOne2OneConv = InvalidOp "invalid operation for 1:1 conversations"
 type InvalidOpConnectConv = InvalidOp "invalid operation for connect conversation"
 
 type InvalidTargetAccess = InvalidOp "invalid target access"
+
+type AssetTooLarge = ErrorDescription 413 "client-error" "Asset too large"
+
+type InvalidLength = ErrorDescription 400 "invalid-length" "Invalid content length"
+
+type AssetNotFound = ErrorDescription 404 "not-found" "Asset not found"
diff --git a/libs/wire-api/src/Wire/API/Routes/AssetBody.hs b/libs/wire-api/src/Wire/API/Routes/AssetBody.hs
new file mode 100644
index 00000000000..fb9f6661093
--- /dev/null
+++ b/libs/wire-api/src/Wire/API/Routes/AssetBody.hs
@@ -0,0 +1,63 @@
+{-# LANGUAGE GeneralizedNewtypeDeriving #-}
+
+-- This file is part of the Wire Server implementation.
+--
+-- Copyright (C) 2021 Wire Swiss GmbH <opensource@wire.com>
+--
+-- This program is free software: you can redistribute it and/or modify it under
+-- the terms of the GNU Affero General Public License as published by the Free
+-- Software Foundation, either version 3 of the License, or (at your option) any
+-- later version.
+--
+-- This program is distributed in the hope that it will be useful, but WITHOUT
+-- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+-- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+-- details.
+--
+-- You should have received a copy of the GNU Affero General Public License along
+-- with this program. If not, see <https://www.gnu.org/licenses/>.
+
+module Wire.API.Routes.AssetBody
+  ( AssetBody,
+    AssetSource (..),
+  )
+where
+
+import Conduit
+import qualified Data.ByteString.Lazy as LBS
+import Data.Swagger
+import Data.Swagger.Internal.Schema
+import Imports
+import Network.HTTP.Media ((//))
+import Servant
+import Servant.Conduit ()
+import Servant.Swagger.Internal.Orphans ()
+
+data MultipartMixed
+
+instance Accept MultipartMixed where
+  contentType _ = "multipart" // "mixed"
+
+instance MimeUnrender MultipartMixed ByteString where
+  mimeUnrender _ = pure . LBS.toStrict
+
+newtype AssetSource = AssetSource
+  { getAssetSource ::
+      ConduitT () ByteString (ResourceT IO) ()
+  }
+  deriving newtype (FromSourceIO ByteString)
+
+instance ToSchema AssetSource where
+  declareNamedSchema _ = pure $ named "AssetSource" $ mempty
+
+type AssetBody =
+  StreamBody'
+    '[ Description
+         "A body with content type `multipart/mixed body`. The first section's \
+         \content type should be `application/json`. The second section's content \
+         \type should be always be `application/octet-stream`. Other content types \
+         \will be ignored by the server."
+     ]
+    NoFraming
+    MultipartMixed
+    AssetSource
diff --git a/libs/wire-api/src/Wire/API/Routes/MultiVerb.hs b/libs/wire-api/src/Wire/API/Routes/MultiVerb.hs
index 79b9f508253..3c500512c88 100644
--- a/libs/wire-api/src/Wire/API/Routes/MultiVerb.hs
+++ b/libs/wire-api/src/Wire/API/Routes/MultiVerb.hs
@@ -44,6 +44,7 @@ where
 import Control.Applicative
 import Control.Lens hiding (Context)
 import qualified Data.ByteString.Lazy as LBS
+import qualified Data.CaseInsensitive as CI
 import Data.Containers.ListUtils
 import Data.HashMap.Strict.InsOrd (InsOrdHashMap)
 import qualified Data.HashMap.Strict.InsOrd as InsOrdHashMap
@@ -54,19 +55,20 @@ import qualified Data.Sequence as Seq
 import qualified Data.Swagger as S
 import qualified Data.Swagger.Declare as S
 import qualified Data.Text as Text
+import qualified Data.Text.Encoding as Text
 import GHC.TypeLits
 import Generics.SOP as GSOP
 import Imports
 import qualified Network.HTTP.Media as M
 import Network.HTTP.Types (HeaderName, hContentType)
+import qualified Network.HTTP.Types as HTTP
 import Network.HTTP.Types.Status
 import qualified Network.Wai as Wai
 import Servant.API
 import Servant.API.ContentTypes
-import Servant.API.ResponseHeaders
 import Servant.API.Status (KnownStatus (..))
 import Servant.Client
-import Servant.Client.Core
+import Servant.Client.Core hiding (addHeader)
 import Servant.Server
 import Servant.Server.Internal
 import Servant.Swagger as S
@@ -210,28 +212,59 @@ data WithHeaders (hs :: [*]) (a :: *) (r :: *)
 
 -- | This is used to convert a response containing headers to a custom type
 -- including the information in the headers.
-class AsHeaders hs a b where
-  fromHeaders :: Headers hs a -> b
-  toHeaders :: b -> Headers hs a
+class AsHeaders xs a b where
+  fromHeaders :: (NP I xs, a) -> b
+  toHeaders :: b -> (NP I xs, a)
 
-instance AsHeaders hs a (Headers hs a) where
-  fromHeaders = id
-  toHeaders = id
+-- single-header empty response
+instance AsHeaders '[a] () a where
+  toHeaders a = (I a :* Nil, ())
+  fromHeaders = unI . hd . fst
 
 data DescHeader (name :: Symbol) (desc :: Symbol) (a :: *)
 
--- convert a list of 'Header's and 'HeaderDesc' to a list of 'Header's
-type family ServantHeaders (hs :: [*]) :: [*]
+class ServantHeaders hs xs | hs -> xs where
+  constructHeaders :: NP I xs -> [HTTP.Header]
+  extractHeaders :: [HTTP.Header] -> Maybe (NP I xs)
 
-type instance ServantHeaders '[] = '[]
+instance ServantHeaders '[] '[] where
+  constructHeaders Nil = []
+  extractHeaders _ = Just Nil
 
-type instance
-  ServantHeaders (DescHeader name desc a ': hs) =
-    Header name a ': ServantHeaders hs
+headerName :: forall name. KnownSymbol name => HTTP.HeaderName
+headerName =
+  CI.mk
+    . Text.encodeUtf8
+    . Text.pack
+    $ symbolVal (Proxy @name)
 
-type instance
-  ServantHeaders (Header name a ': hs) =
-    Header name a ': ServantHeaders hs
+instance
+  ( KnownSymbol name,
+    ServantHeader h name x,
+    ToHttpApiData x,
+    FromHttpApiData x,
+    ServantHeaders hs xs
+  ) =>
+  ServantHeaders (h ': hs) (x ': xs)
+  where
+  constructHeaders (I x :* xs) =
+    (headerName @name, toHeader x) :
+    constructHeaders @hs xs
+
+  extractHeaders hs = do
+    let name = headerName @name
+        (hs0, hs1) = partition (\(h, _) -> h == name) hs
+    x <- case hs0 of
+      [] -> empty
+      ((_, h) : _) -> either (const empty) pure (parseHeader h)
+    xs <- extractHeaders @hs hs1
+    pure (I x :* xs)
+
+class ServantHeader h (name :: Symbol) x | h -> name x
+
+instance ServantHeader (Header' mods name x) name x
+
+instance ServantHeader (DescHeader name desc x) name x
 
 instance
   (KnownSymbol name, KnownSymbol desc, S.ToParamSchema a) =>
@@ -246,29 +279,24 @@ instance
 type instance ResponseType (WithHeaders hs a r) = a
 
 instance
-  ( AsHeaders (ServantHeaders hs) (ResponseType r) a,
-    GetHeaders' (ServantHeaders hs),
-    BuildHeadersTo (ServantHeaders hs),
-    AllToResponseHeader hs,
+  ( AsHeaders xs (ResponseType r) a,
+    ServantHeaders hs xs,
     IsResponse cs r
   ) =>
   IsResponse cs (WithHeaders hs a r)
   where
   type ResponseStatus (WithHeaders hs a r) = ResponseStatus r
 
-  responseRender acc x =
-    fmap addHeaders
-      . responseRender @cs @r acc
-      . getResponse
-      $ h
+  responseRender acc x = fmap addHeaders $ responseRender @cs @r acc y
     where
-      h = toHeaders @(ServantHeaders hs) x
-      addHeaders r = r {roHeaders = roHeaders r ++ getHeaders h}
+      (hs, y) = toHeaders @xs x
+      addHeaders r = r {roHeaders = roHeaders r ++ constructHeaders @hs hs}
 
   responseUnrender c output = do
     x <- responseUnrender @cs @r c output
-    let headers = Headers x (buildHeadersTo @(ServantHeaders hs) (roHeaders output))
-    pure (fromHeaders headers)
+    case extractHeaders @hs (roHeaders output) of
+      Nothing -> UnrenderError "Failed to parse headers"
+      Just hs -> pure $ fromHeaders @xs (hs, x)
 
 instance
   (AllToResponseHeader hs, IsSwaggerResponse r) =>
@@ -375,10 +403,13 @@ instance rs ~ ResponseTypes as => AsUnion as (Union rs) where
   toUnion = id
   fromUnion = id
 
-instance AsUnion '[RespondEmpty code desc] () where
-  toUnion () = Z (I ())
-  fromUnion (Z (I ())) = ()
-  fromUnion (S x) = case x of
+-- | A handler with a single response.
+instance (ResponseType r ~ a) => AsUnion '[r] a where
+  toUnion = Z . I
+  fromUnion = unI . unZ
+
+_foo :: Union '[Int]
+_foo = toUnion @'[Respond 200 "test" Int] @Int 3
 
 class InjectAfter as bs where
   injectAfter :: Union bs -> Union (as .++ bs)
diff --git a/libs/wire-api/src/Wire/API/Routes/Public.hs b/libs/wire-api/src/Wire/API/Routes/Public.hs
index 9fd26ba7fe5..0b64129d31d 100644
--- a/libs/wire-api/src/Wire/API/Routes/Public.hs
+++ b/libs/wire-api/src/Wire/API/Routes/Public.hs
@@ -25,6 +25,8 @@ module Wire.API.Routes.Public
     ZConn,
     ZOptUser,
     ZOptConn,
+    ZBot,
+    ZProvider,
 
     -- * Swagger combinators
     OmitDocs,
@@ -35,15 +37,17 @@ import Control.Lens ((<>~))
 import Data.Domain
 import qualified Data.HashMap.Strict.InsOrd as InsOrdHashMap
 import Data.Id as Id
-import Data.Kind
 import Data.Metrics.Servant
 import Data.Qualified
 import Data.Swagger
 import GHC.Base (Symbol)
 import GHC.TypeLits (KnownSymbol)
 import Imports hiding (All, head)
+import qualified Network.Wai as Wai
 import Servant hiding (Handler, JSON, addHeader, respond)
 import Servant.API.Modifiers
+import Servant.Server.Internal.Delayed
+import Servant.Server.Internal.DelayedIO
 import Servant.Swagger (HasSwagger (toSwagger))
 
 mapRequestArgument ::
@@ -70,42 +74,67 @@ data ZType
     ZLocalAuthUser
   | -- | Get a 'ConnId' from the Z-Conn header
     ZAuthConn
+  | ZAuthBot
+  | ZAuthProvider
 
 class
   (KnownSymbol (ZHeader ztype), FromHttpApiData (ZParam ztype)) =>
-  IsZType (ztype :: ZType)
+  IsZType (ztype :: ZType) ctx
   where
   type ZHeader ztype :: Symbol
   type ZParam ztype :: *
   type ZQualifiedParam ztype :: *
-  type ZConstraint ztype (ctx :: [*]) :: Constraint
 
-  qualifyZParam :: ZConstraint ztype ctx => Context ctx -> ZParam ztype -> ZQualifiedParam ztype
+  qualifyZParam :: Context ctx -> ZParam ztype -> ZQualifiedParam ztype
 
-instance IsZType 'ZLocalAuthUser where
+class HasTokenType ztype where
+  -- | The expected value of the "Z-Type" header.
+  tokenType :: Maybe ByteString
+
+instance {-# OVERLAPPABLE #-} HasTokenType ztype where
+  tokenType = Nothing
+
+instance HasContextEntry ctx Domain => IsZType 'ZLocalAuthUser ctx where
   type ZHeader 'ZLocalAuthUser = "Z-User"
   type ZParam 'ZLocalAuthUser = UserId
   type ZQualifiedParam 'ZLocalAuthUser = Local UserId
-  type ZConstraint 'ZLocalAuthUser ctx = HasContextEntry ctx Domain
 
   qualifyZParam ctx = toLocalUnsafe (getContextEntry ctx)
 
-instance IsZType 'ZAuthUser where
+instance IsZType 'ZAuthUser ctx where
   type ZHeader 'ZAuthUser = "Z-User"
   type ZParam 'ZAuthUser = UserId
   type ZQualifiedParam 'ZAuthUser = UserId
-  type ZConstraint 'ZAuthUser ctx = ()
 
   qualifyZParam _ = id
 
-instance IsZType 'ZAuthConn where
+instance IsZType 'ZAuthConn ctx where
   type ZHeader 'ZAuthConn = "Z-Connection"
   type ZParam 'ZAuthConn = ConnId
   type ZQualifiedParam 'ZAuthConn = ConnId
-  type ZConstraint 'ZAuthConn ctx = ()
 
   qualifyZParam _ = id
 
+instance IsZType 'ZAuthBot ctx where
+  type ZHeader 'ZAuthBot = "Z-Bot"
+  type ZParam 'ZAuthBot = BotId
+  type ZQualifiedParam 'ZAuthBot = BotId
+
+  qualifyZParam _ = id
+
+instance HasTokenType 'ZAuthBot where
+  tokenType = Just "bot"
+
+instance IsZType 'ZAuthProvider ctx where
+  type ZHeader 'ZAuthProvider = "Z-Provider"
+  type ZParam 'ZAuthProvider = ProviderId
+  type ZQualifiedParam 'ZAuthProvider = ProviderId
+
+  qualifyZParam _ = id
+
+instance HasTokenType 'ZAuthProvider where
+  tokenType = Just "provider"
+
 data ZAuthServant (ztype :: ZType) (opts :: [*])
 
 type InternalAuthDefOpts = '[Servant.Required, Servant.Strict]
@@ -122,6 +151,10 @@ type ZUser = ZAuthServant 'ZAuthUser InternalAuthDefOpts
 
 type ZConn = ZAuthServant 'ZAuthConn InternalAuthDefOpts
 
+type ZBot = ZAuthServant 'ZAuthBot InternalAuthDefOpts
+
+type ZProvider = ZAuthServant 'ZAuthProvider InternalAuthDefOpts
+
 type ZOptUser = ZAuthServant 'ZAuthUser '[Servant.Optional, Servant.Strict]
 
 type ZOptConn = ZAuthServant 'ZAuthConn '[Servant.Optional, Servant.Strict]
@@ -141,13 +174,16 @@ instance HasSwagger api => HasSwagger (ZAuthServant 'ZAuthUser _opts :> api) whe
 instance HasSwagger api => HasSwagger (ZAuthServant 'ZLocalAuthUser opts :> api) where
   toSwagger _ = toSwagger (Proxy @(ZAuthServant 'ZAuthUser opts :> api))
 
-instance HasSwagger api => HasSwagger (ZAuthServant 'ZAuthConn _opts :> api) where
+instance
+  {-# OVERLAPPABLE #-}
+  HasSwagger api =>
+  HasSwagger (ZAuthServant ztype _opts :> api)
+  where
   toSwagger _ = toSwagger (Proxy @api)
 
 instance
-  ( IsZType ztype,
+  ( IsZType ztype ctx,
     HasContextEntry (ctx .++ DefaultErrorFormatters) ErrorFormatters,
-    ZConstraint ztype ctx,
     SBoolI (FoldLenient opts),
     SBoolI (FoldRequired opts),
     HasServer api ctx
@@ -158,11 +194,27 @@ instance
     ServerT (ZAuthServant ztype opts :> api) m =
       RequestArgument opts (ZQualifiedParam ztype) -> ServerT api m
 
-  route _ ctx subserver =
+  route _ ctx subserver = do
     Servant.route
       (Proxy @(InternalAuth ztype opts :> api))
       ctx
-      (fmap (. mapRequestArgument @opts (qualifyZParam @ztype ctx)) subserver)
+      ( fmap
+          (. mapRequestArgument @opts (qualifyZParam @ztype ctx))
+          (addAcceptCheck subserver (withRequest (checkType (tokenType @ztype))))
+      )
+    where
+      checkType :: Maybe ByteString -> Wai.Request -> DelayedIO ()
+      checkType token req = case (token, lookup "Z-Type" (Wai.requestHeaders req)) of
+        (Just t, value)
+          | value /= Just t ->
+            delayedFail
+              ServerError
+                { errHTTPCode = 403,
+                  errReasonPhrase = "Access denied",
+                  errBody = "",
+                  errHeaders = []
+                }
+        _ -> pure ()
 
   hoistServerWithContext _ pc nt s = hoistServerWithContext (Proxy :: Proxy api) pc nt . s
 
diff --git a/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs b/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs
new file mode 100644
index 00000000000..f73dc764a2a
--- /dev/null
+++ b/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs
@@ -0,0 +1,179 @@
+{-# LANGUAGE GeneralizedNewtypeDeriving #-}
+
+-- This file is part of the Wire Server implementation.
+--
+-- Copyright (C) 2021 Wire Swiss GmbH <opensource@wire.com>
+--
+-- This program is free software: you can redistribute it and/or modify it under
+-- the terms of the GNU Affero General Public License as published by the Free
+-- Software Foundation, either version 3 of the License, or (at your option) any
+-- later version.
+--
+-- This program is distributed in the hope that it will be useful, but WITHOUT
+-- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+-- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+-- details.
+--
+-- You should have received a copy of the GNU Affero General Public License along
+-- with this program. If not, see <https://www.gnu.org/licenses/>.
+
+module Wire.API.Routes.Public.Cargohold where
+
+import Data.Id
+import Data.Metrics.Servant
+import Data.Qualified
+import Data.SOP
+import qualified Data.Swagger as Swagger
+import Imports
+import Servant
+import Servant.Swagger.Internal
+import Servant.Swagger.Internal.Orphans ()
+import Wire.API.Asset
+import Wire.API.ErrorDescription
+import Wire.API.Routes.AssetBody
+import Wire.API.Routes.MultiVerb
+import Wire.API.Routes.Public
+
+data PrincipalTag = UserPrincipalTag | BotPrincipalTag | ProviderPrincipalTag
+  deriving (Eq, Show)
+
+type family PrincipalId (tag :: PrincipalTag) = (id :: *) | id -> tag where
+  PrincipalId 'UserPrincipalTag = Local UserId
+  PrincipalId 'BotPrincipalTag = BotId
+  PrincipalId 'ProviderPrincipalTag = ProviderId
+
+type family ApplyPrincipalPath (tag :: PrincipalTag) api
+
+type instance ApplyPrincipalPath 'UserPrincipalTag api = ZLocalUser :> "assets" :> "v3" :> api
+
+type instance ApplyPrincipalPath 'BotPrincipalTag api = ZBot :> "bot" :> "assets" :> api
+
+type instance ApplyPrincipalPath 'ProviderPrincipalTag api = ZProvider :> "provider" :> "assets" :> api
+
+instance HasSwagger (ApplyPrincipalPath tag api) => HasSwagger (tag :> api) where
+  toSwagger _ = toSwagger (Proxy @(ApplyPrincipalPath tag api))
+
+instance HasServer (ApplyPrincipalPath tag api) ctx => HasServer (tag :> api) ctx where
+  type ServerT (tag :> api) m = ServerT (ApplyPrincipalPath tag api) m
+  route _ = route (Proxy @(ApplyPrincipalPath tag api))
+  hoistServerWithContext _ = hoistServerWithContext (Proxy @(ApplyPrincipalPath tag api))
+
+instance RoutesToPaths (ApplyPrincipalPath tag api) => RoutesToPaths (tag :> api) where
+  getRoutes = getRoutes @(ApplyPrincipalPath tag api)
+
+newtype AssetLocation = AssetLocation {getAssetLocation :: Text}
+  deriving newtype
+    ( ToHttpApiData,
+      FromHttpApiData,
+      Swagger.ToParamSchema
+    )
+
+instance AsHeaders '[AssetLocation] Asset (Asset, AssetLocation) where
+  toHeaders (asset, loc) = (I loc :* Nil, asset)
+  fromHeaders (I loc :* Nil, asset) = (asset, loc)
+
+type GetAsset =
+  MultiVerb
+    'GET
+    '[JSON]
+    '[ AssetNotFound,
+       WithHeaders
+         '[DescHeader "Location" "Asset location" AssetLocation]
+         AssetLocation
+         (RespondEmpty 302 "Asset found")
+     ]
+    (Maybe AssetLocation)
+
+type ServantAPI =
+  ( Summary "Renew an asset token"
+      :> CanThrow AssetNotFound
+      :> CanThrow Unauthorised
+      :> ZLocalUser
+      :> "assets"
+      :> "v3"
+      :> Capture "key" AssetKey
+      :> "token"
+      :> Post '[JSON] NewAssetToken
+  )
+    :<|> ( Summary "Delete an asset token"
+             :> Description "**Note**: deleting the token makes the asset public."
+             :> ZLocalUser
+             :> "assets"
+             :> "v3"
+             :> Capture "key" AssetKey
+             :> "token"
+             :> MultiVerb
+                  'DELETE
+                  '[JSON]
+                  '[RespondEmpty 200 "Asset token deleted"]
+                  ()
+         )
+    :<|> BaseAPI 'UserPrincipalTag
+    :<|> BaseAPI 'BotPrincipalTag
+    :<|> BaseAPI 'ProviderPrincipalTag
+    :<|> LegacyAPI
+    :<|> InternalAPI
+
+type BaseAPI (tag :: PrincipalTag) =
+  ( Summary "Upload an asset"
+      :> CanThrow AssetTooLarge
+      :> CanThrow InvalidLength
+      :> tag
+      :> AssetBody
+      :> MultiVerb
+           'POST
+           '[JSON]
+           '[ WithHeaders
+                '[DescHeader "Location" "Asset location" AssetLocation]
+                (Asset, AssetLocation)
+                (Respond 201 "Asset posted" Asset)
+            ]
+           (Asset, AssetLocation)
+  )
+    :<|> ( Summary "Download an asset"
+             :> tag
+             :> Capture "key" AssetKey
+             :> Header "Asset-Token" AssetToken
+             :> QueryParam "asset_token" AssetToken
+             :> GetAsset
+         )
+    :<|> ( Summary "Delete an asset"
+             :> CanThrow AssetNotFound
+             :> CanThrow Unauthorised
+             :> tag
+             :> Capture "key" AssetKey
+             :> MultiVerb
+                  'DELETE
+                  '[JSON]
+                  '[RespondEmpty 200 "Asset deleted"]
+                  ()
+         )
+
+type LegacyAPI =
+  ( ZLocalUser
+      :> "assets"
+      :> QueryParam' [Required, Strict] "conv_id" ConvId
+      :> Capture "id" AssetId
+      :> GetAsset
+  )
+    :<|> ( ZLocalUser
+             :> "conversations"
+             :> Capture "cnv" ConvId
+             :> "assets"
+             :> Capture "id" AssetId
+             :> GetAsset
+         )
+    :<|> ( ZLocalUser
+             :> "conversations"
+             :> Capture "cnv" ConvId
+             :> "otr"
+             :> "assets"
+             :> Capture "id" AssetId
+             :> GetAsset
+         )
+
+type InternalAPI =
+  "i" :> "status" :> MultiVerb 'GET '[PlainText] '[RespondEmpty 200 "OK"] ()
+
+swaggerDoc :: Swagger.Swagger
+swaggerDoc = toSwagger (Proxy @ServantAPI)
diff --git a/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs b/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs
index 30e402c0590..63949b1d841 100644
--- a/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs
+++ b/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs
@@ -25,6 +25,7 @@ import Data.CommaSeparatedList
 import Data.Id (ConvId, TeamId, UserId)
 import Data.Qualified (Qualified (..))
 import Data.Range
+import Data.SOP
 import qualified Data.Swagger as Swagger
 import GHC.TypeLits (AppendSymbol)
 import Imports hiding (head)
@@ -45,10 +46,9 @@ import Wire.API.ServantProto (Proto, RawProto)
 import Wire.API.Team.Conversation
 import Wire.API.Team.Feature
 
-instance AsHeaders '[Header "Location" ConvId] Conversation Conversation where
-  -- FUTUREWORK: use addHeader
-  toHeaders c = Headers c (HCons (Header (qUnqualified (cnvQualifiedId c))) HNil)
-  fromHeaders = getResponse
+instance AsHeaders '[ConvId] Conversation Conversation where
+  toHeaders c = (I (qUnqualified (cnvQualifiedId c)) :* Nil, c)
+  fromHeaders = snd
 
 type ConversationResponse = ResponseForExistedCreated Conversation
 
diff --git a/libs/wire-api/wire-api.cabal b/libs/wire-api/wire-api.cabal
index 6d643e1c4d8..f84b7fddf85 100644
--- a/libs/wire-api/wire-api.cabal
+++ b/libs/wire-api/wire-api.cabal
@@ -4,7 +4,7 @@ cabal-version: 1.12
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: bcda0d57293162140cc50d149ad068df7975f9526cf1621c7aa4f753b45e36a6
+-- hash: 80606059441fcf0f725386078aef563bf04549ce657002575a6559ae37544964
 
 name:           wire-api
 version:        0.1.0
@@ -48,6 +48,7 @@ library
       Wire.API.Provider.Service.Tag
       Wire.API.Push.Token
       Wire.API.Push.V2.Token
+      Wire.API.Routes.AssetBody
       Wire.API.Routes.Internal.Brig
       Wire.API.Routes.Internal.Brig.Connection
       Wire.API.Routes.Internal.Brig.EJPD
@@ -56,6 +57,7 @@ library
       Wire.API.Routes.MultiVerb
       Wire.API.Routes.Public
       Wire.API.Routes.Public.Brig
+      Wire.API.Routes.Public.Cargohold
       Wire.API.Routes.Public.Galley
       Wire.API.Routes.Public.LegalHold
       Wire.API.Routes.Public.Spar
@@ -113,6 +115,7 @@ library
     , cassava >=0.5
     , cereal
     , comonad
+    , conduit
     , containers >=0.5
     , cookie
     , cryptonite
@@ -153,6 +156,7 @@ library
     , servant
     , servant-client
     , servant-client-core
+    , servant-conduit
     , servant-multipart
     , servant-server
     , servant-swagger
diff --git a/services/brig/src/Brig/API/Public.hs b/services/brig/src/Brig/API/Public.hs
index 081c96f8009..7bf438b4186 100644
--- a/services/brig/src/Brig/API/Public.hs
+++ b/services/brig/src/Brig/API/Public.hs
@@ -104,6 +104,7 @@ import qualified Wire.API.Properties as Public
 import qualified Wire.API.Routes.MultiTablePaging as Public
 import Wire.API.Routes.Public.Brig (Api (updateConnectionUnqualified))
 import qualified Wire.API.Routes.Public.Brig as BrigAPI
+import qualified Wire.API.Routes.Public.Cargohold as CargoholdAPI
 import qualified Wire.API.Routes.Public.Galley as GalleyAPI
 import qualified Wire.API.Routes.Public.LegalHold as LegalHoldAPI
 import qualified Wire.API.Routes.Public.Spar as SparAPI
@@ -131,7 +132,12 @@ type ServantAPI = BrigAPI.ServantAPI
 swaggerDocsAPI :: Servant.Server SwaggerDocsAPI
 swaggerDocsAPI =
   swaggerSchemaUIServer $
-    (BrigAPI.swagger <> GalleyAPI.swaggerDoc <> LegalHoldAPI.swaggerDoc <> SparAPI.swaggerDoc)
+    ( BrigAPI.swagger
+        <> GalleyAPI.swaggerDoc
+        <> LegalHoldAPI.swaggerDoc
+        <> SparAPI.swaggerDoc
+        <> CargoholdAPI.swaggerDoc
+    )
       & S.info . S.title .~ "Wire-Server API"
       & S.info . S.description ?~ Brig.Docs.Swagger.contents <> mempty
       & S.security %~ nub
diff --git a/services/cargohold/cargohold.cabal b/services/cargohold/cargohold.cabal
index 94c6b8635f6..778c25303a1 100644
--- a/services/cargohold/cargohold.cabal
+++ b/services/cargohold/cargohold.cabal
@@ -4,7 +4,7 @@ cabal-version: 1.12
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: e1d35804687900338efb4ea42019d902f778d6b03ea61e3e8a1d3e0fcba0115e
+-- hash: b8ba2ed196939ab2b035138d3e428c84b88ff77ff219741840e47ae8dac9de0a
 
 name:           cargohold
 version:        1.5.0
@@ -25,7 +25,6 @@ flag static
 
 library
   exposed-modules:
-      CargoHold.API
       CargoHold.API.Error
       CargoHold.API.Federation
       CargoHold.API.Legacy
@@ -92,10 +91,7 @@ library
     , uri-bytestring >=0.2
     , uuid >=1.3.5
     , wai >=3.0
-    , wai-conduit >=3.0
-    , wai-extra >=3.0
-    , wai-predicates >=0.8
-    , wai-routing >=0.12
+    , wai-extra
     , wai-utilities >=0.16.1
     , wire-api
     , wire-api-federation
@@ -165,7 +161,6 @@ executable cargohold-integration
     , http-types >=0.8
     , imports
     , lens >=3.8
-    , metrics-wai
     , mime >=0.4
     , optparse-applicative
     , safe >=0.3
diff --git a/services/cargohold/cargohold.integration.yaml b/services/cargohold/cargohold.integration.yaml
index 5254cf9368d..2773a838499 100644
--- a/services/cargohold/cargohold.integration.yaml
+++ b/services/cargohold/cargohold.integration.yaml
@@ -18,6 +18,7 @@ aws:
 settings:
   maxTotalBytes: 27262976
   downloadLinkTTL: 300    # Seconds
+  federationDomain: example.com
 
 logLevel: Info
 logNetStrings: false
diff --git a/services/cargohold/package.yaml b/services/cargohold/package.yaml
index c73d7934df3..d4bd3dfbcdc 100644
--- a/services/cargohold/package.yaml
+++ b/services/cargohold/package.yaml
@@ -59,10 +59,7 @@ library:
   - uri-bytestring >=0.2
   - uuid >=1.3.5
   - wai >=3.0
-  - wai-conduit >=3.0
-  - wai-extra >=3.0
-  - wai-predicates >=0.8
-  - wai-routing >=0.12
+  - wai-extra
   - wai-utilities >=0.16.1
   - wire-api
   - wire-api-federation
@@ -76,7 +73,6 @@ executables:
     - cargohold-types
     - http-client-tls >=0.2
     - lens >=3.8
-    - metrics-wai
     - optparse-applicative
     - tagged >=0.8
     - tasty >=1.0
diff --git a/services/cargohold/src/CargoHold/API.hs b/services/cargohold/src/CargoHold/API.hs
deleted file mode 100644
index ce5bb5fc32e..00000000000
--- a/services/cargohold/src/CargoHold/API.hs
+++ /dev/null
@@ -1,40 +0,0 @@
--- This file is part of the Wire Server implementation.
---
--- Copyright (C) 2020 Wire Swiss GmbH <opensource@wire.com>
---
--- This program is free software: you can redistribute it and/or modify it under
--- the terms of the GNU Affero General Public License as published by the Free
--- Software Foundation, either version 3 of the License, or (at your option) any
--- later version.
---
--- This program is distributed in the hope that it will be useful, but WITHOUT
--- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
--- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
--- details.
---
--- You should have received a copy of the GNU Affero General Public License along
--- with this program. If not, see <https://www.gnu.org/licenses/>.
-
-module CargoHold.API
-  ( sitemap,
-  )
-where
-
-import qualified CargoHold.API.Public as Public
-import CargoHold.App (Handler)
-import Data.Predicate (true)
-import qualified Data.Swagger.Build.Api as Doc
-import Imports hiding (head)
-import Network.Wai.Routing (Routes, continue, get, head)
-import Network.Wai.Utilities (empty)
-
-sitemap :: Routes Doc.ApiBuilder Handler ()
-sitemap = do
-  Public.sitemap
-  Public.apiDocs
-  routesInternal
-
-routesInternal :: Routes a Handler ()
-routesInternal = do
-  get "/i/status" (continue $ const $ return empty) true
-  head "/i/status" (continue $ const $ return empty) true
diff --git a/services/cargohold/src/CargoHold/API/Error.hs b/services/cargohold/src/CargoHold/API/Error.hs
index bffd8ba433c..12d469439bf 100644
--- a/services/cargohold/src/CargoHold/API/Error.hs
+++ b/services/cargohold/src/CargoHold/API/Error.hs
@@ -17,21 +17,47 @@
 
 module CargoHold.API.Error where
 
+import Data.Proxy
+import qualified Data.Text.Lazy as LT
+import GHC.TypeLits
 import Imports
 import Network.HTTP.Types.Status
 import Network.Wai.Utilities.Error
+import Servant.API.Status
+import Wire.API.ErrorDescription
+
+errorDescriptionToWai ::
+  forall (code :: Nat) (lbl :: Symbol) (desc :: Symbol).
+  (KnownStatus code, KnownSymbol lbl) =>
+  ErrorDescription code lbl desc ->
+  Error
+errorDescriptionToWai (ErrorDescription msg) =
+  mkError
+    (statusVal (Proxy @code))
+    (LT.pack (symbolVal (Proxy @lbl)))
+    (LT.fromStrict msg)
+
+errorDescriptionTypeToWai ::
+  forall e (code :: Nat) (lbl :: Symbol) (desc :: Symbol).
+  ( KnownStatus code,
+    KnownSymbol lbl,
+    KnownSymbol desc,
+    e ~ ErrorDescription code lbl desc
+  ) =>
+  Error
+errorDescriptionTypeToWai = errorDescriptionToWai (mkErrorDescription :: e)
 
 assetTooLarge :: Error
-assetTooLarge = mkError status413 "client-error" "Asset too large."
+assetTooLarge = errorDescriptionTypeToWai @AssetTooLarge
 
 unauthorised :: Error
-unauthorised = mkError status403 "unauthorised" "Unauthorised operation."
+unauthorised = errorDescriptionTypeToWai @Unauthorised
 
 invalidLength :: Error
-invalidLength = mkError status400 "invalid-length" "Invalid content length."
+invalidLength = errorDescriptionTypeToWai @InvalidLength
 
 assetNotFound :: Error
-assetNotFound = mkError status404 "not-found" "Asset not found."
+assetNotFound = errorDescriptionTypeToWai @AssetNotFound
 
 invalidMD5 :: Error
 invalidMD5 = mkError status400 "client-error" "Invalid MD5."
diff --git a/services/cargohold/src/CargoHold/API/Public.hs b/services/cargohold/src/CargoHold/API/Public.hs
index b2b4660e5be..1c588ce99b0 100644
--- a/services/cargohold/src/CargoHold/API/Public.hs
+++ b/services/cargohold/src/CargoHold/API/Public.hs
@@ -1,6 +1,6 @@
 -- This file is part of the Wire Server implementation.
 --
--- Copyright (C) 2020 Wire Swiss GmbH <opensource@wire.com>
+-- Copyright (C) 2021 Wire Swiss GmbH <opensource@wire.com>
 --
 -- This program is free software: you can redistribute it and/or modify it under
 -- the terms of the GNU Affero General Public License as published by the Free
@@ -15,269 +15,98 @@
 -- You should have received a copy of the GNU Affero General Public License along
 -- with this program. If not, see <https://www.gnu.org/licenses/>.
 
-module CargoHold.API.Public
-  ( sitemap,
-    apiDocs,
-  )
-where
+module CargoHold.API.Public (servantSitemap) where
 
-import qualified CargoHold.API.Error as Error
 import qualified CargoHold.API.Legacy as LegacyAPI
 import qualified CargoHold.API.V3 as V3
 import CargoHold.App
-import qualified CargoHold.Types.V3 as V3 (Principal (..))
-import Control.Error
-import Control.Lens ((^.))
+import qualified CargoHold.Types.V3 as V3
+import Control.Lens
 import Data.ByteString.Conversion
 import Data.Id
-import Data.Predicate
-import qualified Data.Swagger.Build.Api as Doc
-import Data.Text.Encoding (decodeLatin1)
+import Data.Qualified
+import qualified Data.Text.Encoding as Text
+import qualified Data.Text.Encoding.Error as Text
 import Imports hiding (head)
-import Network.HTTP.Types.Status
-import Network.Wai (Request, Response)
-import Network.Wai.Conduit (sourceRequestBody)
-import Network.Wai.Predicate hiding (Error, setStatus)
-import Network.Wai.Routing
-import Network.Wai.Utilities hiding (message)
-import Network.Wai.Utilities.Swagger (document, mkSwaggerApi)
-import qualified Network.Wai.Utilities.Swagger as Doc
-import Network.Wai.Utilities.ZAuth
+import Servant ((:<|>) (..))
+import Servant.Server hiding (Handler)
 import URI.ByteString
-import qualified Wire.API.Asset as Public
-
--- FUTUREWORK: restore (and servantify) resumable upload functionality, removed
--- in https://github.com/wireapp/wire-server/pull/1998
-
-sitemap :: Routes Doc.ApiBuilder Handler ()
-sitemap = do
-  ---------------------------------------------------------------------------
-  -- User API
-
-  -- Simple (one-step) Upload
-
-  post "/assets/v3" (continue uploadAssetV3) $
-    header "Z-User"
-      .&. contentType "multipart" "mixed"
-      .&. request
-  document "POST" "uploadAsset" $ do
-    Doc.summary "Upload an asset. In the multipart/mixed body, the first section's content type should be application/json. The second section's content type should be always application/octet-stream. Other content types will be ignored by the server."
-    Doc.consumes "multipart/mixed"
-    Doc.errorResponse Error.assetTooLarge
-    Doc.errorResponse Error.invalidLength
-    Doc.response 201 "Asset posted" Doc.end
-
-  --- Download
-
-  get "/assets/v3/:key" (continue downloadAssetV3) $
-    header "Z-User"
-      .&. capture "key"
-      .&. opt (header "Asset-Token" .|. query "asset_token")
-  document "GET" "downloadAsset" $ do
-    Doc.summary "Download an asset"
-    Doc.parameter Doc.Path "key" Doc.bytes' $
-      Doc.description "Asset key"
-    Doc.parameter Doc.Header "Asset-Token" Doc.bytes' $ do
-      Doc.description "Asset token"
-      Doc.optional
-    Doc.errorResponse Error.assetNotFound
-    Doc.response 302 "Asset found" Doc.end
-
-  --- Token Management
-
-  post "/assets/v3/:key/token" (continue renewTokenV3) $
-    header "Z-User"
-      .&. capture "key"
-  document "POST" "renewAssetToken" $ do
-    Doc.summary "Renew an asset token"
-    Doc.parameter Doc.Path "key" Doc.bytes' $
-      Doc.description "Asset key"
-    Doc.response 200 "Asset token renewed" Doc.end
-    Doc.errorResponse Error.assetNotFound
-    Doc.errorResponse Error.unauthorised
-
-  delete "/assets/v3/:key/token" (continue deleteTokenV3) $
-    header "Z-User"
-      .&. capture "key"
-  document "DELETE" "deleteAssetToken" $ do
-    Doc.summary "Delete an asset token"
-    Doc.notes "Deleting the token makes the asset public."
-    Doc.parameter Doc.Path "key" Doc.bytes' $
-      Doc.description "Asset key"
-    Doc.response 200 "Asset token deleted" Doc.end
-
-  --- Deletion
-
-  delete "/assets/v3/:key" (continue deleteAssetV3) $
-    header "Z-User"
-      .&. capture "key"
-  document "DELETE" "deleteAsset" $ do
-    Doc.summary "Delete an asset"
-    Doc.parameter Doc.Path "key" Doc.bytes' $
-      Doc.description "Asset key"
-    Doc.response 200 "Asset deleted" Doc.end
-    Doc.errorResponse Error.assetNotFound
-    Doc.errorResponse Error.unauthorised
-
-  ---------------------------------------------------------------------------
-  -- Provider API
-
-  post "/provider/assets" (continue providerUploadV3) $
-    zauth ZAuthProvider
-      .&> contentType "multipart" "mixed"
-      .&> zauthProviderId
-      .&. request
-
-  get "/provider/assets/:key" (continue providerDownloadV3) $
-    zauth ZAuthProvider
-      .&> zauthProviderId
-      .&. capture "key"
-      .&. opt (header "Asset-Token" .|. query "asset_token")
-
-  delete "/provider/assets/:key" (continue providerDeleteV3) $
-    zauth ZAuthProvider
-      .&> zauthProviderId
-      .&. capture "key"
-
-  ---------------------------------------------------------------------------
-  -- Bot API
-
-  post "/bot/assets" (continue botUploadV3) $
-    zauth ZAuthBot
-      .&> contentType "multipart" "mixed"
-      .&> zauthBotId
-      .&. request
-
-  get "/bot/assets/:key" (continue botDownloadV3) $
-    zauth ZAuthBot
-      .&> zauthBotId
-      .&. capture "key"
-      .&. opt (header "Asset-Token" .|. query "asset_token")
-
-  delete "/bot/assets/:key" (continue botDeleteV3) $
-    zauth ZAuthBot
-      .&> zauthBotId
-      .&. capture "key"
-
-  -- Legacy
-
-  get "/assets/:id" (continue legacyDownloadPlain) $
-    header "Z-User"
-      .&. param "conv_id"
-      .&. capture "id"
-
-  get "/conversations/:cnv/assets/:id" (continue legacyDownloadPlain) $
-    header "Z-User"
-      .&. capture "cnv"
-      .&. capture "id"
-
-  get "/conversations/:cnv/otr/assets/:id" (continue legacyDownloadOtr) $
-    header "Z-User"
-      .&. capture "cnv"
-      .&. capture "id"
-
-apiDocs :: Routes Doc.ApiBuilder Handler ()
-apiDocs = do
-  get
-    "/assets/api-docs"
-    ( \(_ ::: url) k ->
-        let doc = mkSwaggerApi (decodeLatin1 url) [] sitemap
-         in k $ json doc
-    )
-    $ accept "application" "json"
-      .&. query "base_url"
-
------------------------------------------------------------------------------
--- User API Handlers
-
--- FUTUREWORK: make these types more descriptive than 'Request' -> 'Response'
-uploadAssetV3 :: UserId ::: Media "multipart" "mixed" ::: Request -> Handler Response
-uploadAssetV3 (usr ::: _ ::: req) = do
-  let principal = V3.UserPrincipal usr
-  assetResponse principal <$> V3.upload principal (sourceRequestBody req)
-
-downloadAssetV3 :: UserId ::: Public.AssetKey ::: Maybe Public.AssetToken -> Handler Response
-downloadAssetV3 (usr ::: key ::: tok) = do
-  url <- V3.download (V3.UserPrincipal usr) key tok
-  redirect url
-
-deleteAssetV3 :: UserId ::: Public.AssetKey -> Handler Response
-deleteAssetV3 (usr ::: key) = do
-  V3.delete (V3.UserPrincipal usr) key
-  return empty
-
-renewTokenV3 :: UserId ::: Public.AssetKey -> Handler Response
-renewTokenV3 (usr ::: key) = do
-  tok <- V3.renewToken (V3.UserPrincipal usr) key
-  return $ json (Public.NewAssetToken tok)
-
-deleteTokenV3 :: UserId ::: Public.AssetKey -> Handler Response
-deleteTokenV3 (usr ::: key) = do
-  V3.deleteToken (V3.UserPrincipal usr) key
-  return empty
-
---------------------------------------------------------------------------------
--- Provider API Handlers
-
-providerUploadV3 :: ProviderId ::: Request -> Handler Response
-providerUploadV3 (prv ::: req) = do
-  let principal = V3.ProviderPrincipal prv
-  assetResponse principal <$> V3.upload principal (sourceRequestBody req)
-
-providerDownloadV3 :: ProviderId ::: Public.AssetKey ::: Maybe Public.AssetToken -> Handler Response
-providerDownloadV3 (prv ::: key ::: tok) = do
-  url <- V3.download (V3.ProviderPrincipal prv) key tok
-  redirect url
-
-providerDeleteV3 :: ProviderId ::: Public.AssetKey -> Handler Response
-providerDeleteV3 (prv ::: key) = do
-  V3.delete (V3.ProviderPrincipal prv) key
-  return empty
-
---------------------------------------------------------------------------------
--- Bot API Handlers
-
-botUploadV3 :: BotId ::: Request -> Handler Response
-botUploadV3 (bot ::: req) = do
-  let principal = V3.BotPrincipal bot
-  assetResponse principal <$> V3.upload principal (sourceRequestBody req)
-
-botDownloadV3 :: BotId ::: Public.AssetKey ::: Maybe Public.AssetToken -> Handler Response
-botDownloadV3 (bot ::: key ::: tok) = do
-  url <- V3.download (V3.BotPrincipal bot) key tok
-  redirect url
-
-botDeleteV3 :: BotId ::: Public.AssetKey -> Handler Response
-botDeleteV3 (bot ::: key) = do
-  V3.delete (V3.BotPrincipal bot) key
-  return empty
-
---------------------------------------------------------------------------------
--- Helpers
-
-assetResponse :: V3.Principal -> Public.Asset -> Response
-assetResponse prc asset =
-  setStatus status201 . loc (asset ^. Public.assetKey) $ json asset
+import Wire.API.Asset
+import Wire.API.Routes.AssetBody
+import Wire.API.Routes.Public.Cargohold
+
+servantSitemap :: ServerT ServantAPI Handler
+servantSitemap =
+  renewTokenV3 :<|> deleteTokenV3
+    :<|> userAPI
+    :<|> botAPI
+    :<|> providerAPI
+    :<|> legacyAPI
+    :<|> internalAPI
   where
-    loc k = location $ case prc of
-      V3.UserPrincipal {} -> "/assets/v3/" <> toByteString k
-      V3.BotPrincipal {} -> "/bot/assets/" <> toByteString k
-      V3.ProviderPrincipal {} -> "/provider/assets/" <> toByteString k
-
-redirect :: Maybe URI -> Handler Response
-redirect (Just url) = return . setStatus status302 $ location (serializeURIRef url) empty
-redirect Nothing = throwE Error.assetNotFound
-{-# INLINE redirect #-}
-
-location :: ToByteString a => a -> Response -> Response
-location = addHeader "Location" . toByteString'
-{-# INLINE location #-}
-
---------------------------------------------------------------------------------
--- Legacy
-
-legacyDownloadPlain :: UserId ::: ConvId ::: AssetId -> Handler Response
-legacyDownloadPlain (usr ::: cnv ::: ast) = LegacyAPI.download usr cnv ast >>= redirect
-
-legacyDownloadOtr :: UserId ::: ConvId ::: AssetId -> Handler Response
-legacyDownloadOtr (usr ::: cnv ::: ast) = LegacyAPI.downloadOtr usr cnv ast >>= redirect
+    userAPI :: forall tag. tag ~ 'UserPrincipalTag => ServerT (BaseAPI tag) Handler
+    userAPI = uploadAssetV3 @tag :<|> downloadAssetV3 @tag :<|> deleteAssetV3 @tag
+    botAPI :: forall tag. tag ~ 'BotPrincipalTag => ServerT (BaseAPI tag) Handler
+    botAPI = uploadAssetV3 @tag :<|> downloadAssetV3 @tag :<|> deleteAssetV3 @tag
+    providerAPI :: forall tag. tag ~ 'ProviderPrincipalTag => ServerT (BaseAPI tag) Handler
+    providerAPI = uploadAssetV3 @tag :<|> downloadAssetV3 @tag :<|> deleteAssetV3 @tag
+    legacyAPI = legacyDownloadPlain :<|> legacyDownloadPlain :<|> legacyDownloadOtr
+    internalAPI = pure ()
+
+class MakePrincipal (tag :: PrincipalTag) (id :: *) | id -> tag, tag -> id where
+  mkPrincipal :: id -> V3.Principal
+
+instance MakePrincipal 'UserPrincipalTag (Local UserId) where
+  mkPrincipal = V3.UserPrincipal . tUnqualified
+
+instance MakePrincipal 'BotPrincipalTag BotId where
+  mkPrincipal = V3.BotPrincipal
+
+instance MakePrincipal 'ProviderPrincipalTag ProviderId where
+  mkPrincipal = V3.ProviderPrincipal
+
+uploadAssetV3 ::
+  MakePrincipal tag id =>
+  id ->
+  AssetSource ->
+  Handler (Asset, AssetLocation)
+uploadAssetV3 pid req = do
+  let principal = mkPrincipal pid
+  asset <- V3.upload principal (getAssetSource req)
+  let key = Text.decodeUtf8With Text.lenientDecode (toByteString' (asset ^. assetKey))
+  let loc = case principal of
+        V3.UserPrincipal {} -> "/assets/v3/" <> key
+        V3.BotPrincipal {} -> "/bot/assets/" <> key
+        V3.ProviderPrincipal {} -> "/provider/assets/" <> key
+  pure (asset, AssetLocation loc)
+
+downloadAssetV3 ::
+  MakePrincipal tag id =>
+  id ->
+  AssetKey ->
+  Maybe AssetToken ->
+  Maybe AssetToken ->
+  Handler (Maybe AssetLocation)
+downloadAssetV3 usr key tok1 tok2 = do
+  url <- V3.download (mkPrincipal usr) key (tok1 <|> tok2)
+  pure $ fmap (AssetLocation . Text.decodeUtf8With Text.lenientDecode . serializeURIRef') url
+
+deleteAssetV3 :: MakePrincipal tag id => id -> AssetKey -> Handler ()
+deleteAssetV3 usr key = V3.delete (mkPrincipal usr) key
+
+renewTokenV3 :: Local UserId -> AssetKey -> Handler NewAssetToken
+renewTokenV3 (tUnqualified -> usr) key =
+  NewAssetToken <$> V3.renewToken (V3.UserPrincipal usr) key
+
+deleteTokenV3 :: Local UserId -> AssetKey -> Handler ()
+deleteTokenV3 (tUnqualified -> usr) key = V3.deleteToken (V3.UserPrincipal usr) key
+
+legacyDownloadPlain :: Local UserId -> ConvId -> AssetId -> Handler (Maybe AssetLocation)
+legacyDownloadPlain (tUnqualified -> usr) cnv ast = do
+  url <- LegacyAPI.download usr cnv ast
+  pure $ fmap (AssetLocation . Text.decodeUtf8With Text.lenientDecode . serializeURIRef') url
+
+legacyDownloadOtr :: Local UserId -> ConvId -> AssetId -> Handler (Maybe AssetLocation)
+legacyDownloadOtr (tUnqualified -> usr) cnv ast = do
+  url <- LegacyAPI.downloadOtr usr cnv ast
+  pure $ fmap (AssetLocation . Text.decodeUtf8With Text.lenientDecode . serializeURIRef') url
diff --git a/services/cargohold/src/CargoHold/Options.hs b/services/cargohold/src/CargoHold/Options.hs
index 31992d462af..302bcc68977 100644
--- a/services/cargohold/src/CargoHold/Options.hs
+++ b/services/cargohold/src/CargoHold/Options.hs
@@ -19,10 +19,11 @@
 
 module CargoHold.Options where
 
-import CargoHold.CloudFront (Domain (..), KeyPairId (..))
+import qualified CargoHold.CloudFront as CF
 import Control.Lens hiding (Level)
 import Data.Aeson (FromJSON (..), withText)
 import Data.Aeson.TH
+import Data.Domain
 import Imports
 import System.Logger.Extended (Level, LogFormat)
 import Util.Options
@@ -31,9 +32,9 @@ import Util.Options.Common
 -- | AWS CloudFront settings.
 data CloudFrontOpts = CloudFrontOpts
   { -- | Domain
-    _cfDomain :: Domain,
+    _cfDomain :: CF.Domain,
     -- | Keypair ID
-    _cfKeyPairId :: KeyPairId,
+    _cfKeyPairId :: CF.KeyPairId,
     -- | Path to private key
     _cfPrivateKey :: FilePath
   }
@@ -78,7 +79,18 @@ data Settings = Settings
   { -- | Maximum allowed size for uploads, in bytes
     _setMaxTotalBytes :: !Int,
     -- | TTL for download links, in seconds
-    _setDownloadLinkTTL :: !Word
+    _setDownloadLinkTTL :: !Word,
+    -- | FederationDomain is required, even when not wanting to federate with other backends
+    -- (in that case the 'setFederationAllowedDomains' can be set to empty in Federator)
+    -- Federation domain is used to qualify local IDs and handles,
+    -- e.g. 0c4d8944-70fa-480e-a8b7-9d929862d18c@wire.com and somehandle@wire.com.
+    -- It should also match the SRV DNS records under which other wire-server installations can find this backend:
+    --    _wire-server-federator._tcp.<federationDomain>
+    -- Once set, DO NOT change it: if you do, existing users may have a broken experience and/or stop working
+    -- Remember to keep it the same in Galley and in Brig.
+    -- This is referred to as the 'backend domain' in the public documentation; See
+    -- https://docs.wire.com/how-to/install/configure-federation.html#choose-a-backend-domain-name
+    _setFederationDomain :: !Domain
   }
   deriving (Show, Generic)
 
diff --git a/services/cargohold/src/CargoHold/Run.hs b/services/cargohold/src/CargoHold/Run.hs
index bf305eb2d06..08a98d085a0 100644
--- a/services/cargohold/src/CargoHold/Run.hs
+++ b/services/cargohold/src/CargoHold/Run.hs
@@ -20,15 +20,16 @@ module CargoHold.Run
   )
 where
 
-import CargoHold.API (sitemap)
 import CargoHold.API.Federation
+import CargoHold.API.Public
 import CargoHold.App
 import CargoHold.Options
 import Control.Lens (set, (^.))
 import Control.Monad.Catch (finally)
 import Data.Default
+import Data.Domain
 import Data.Id
-import Data.Metrics.Middleware.Prometheus (waiPrometheusMiddleware)
+import Data.Metrics.Servant
 import Data.Proxy
 import Data.Text (unpack)
 import Imports
@@ -37,12 +38,13 @@ import qualified Network.Wai.Middleware.Gzip as GZip
 import Network.Wai.Utilities.Request
 import Network.Wai.Utilities.Server
 import qualified Network.Wai.Utilities.Server as Server
-import Servant (hoistServer)
 import qualified Servant
 import Servant.API
+import Servant.Server hiding (Handler, runHandler)
 import Util.Options
+import qualified Wire.API.Routes.Public.Cargohold as Public
 
-type CombinedAPI = FederationAPI :<|> Servant.Raw
+type CombinedAPI = FederationAPI :<|> Public.ServantAPI
 
 run :: Opts -> IO ()
 run o = do
@@ -51,22 +53,30 @@ run o = do
   runSettingsWithShutdown s (middleware e $ servantApp e) 5
     `finally` closeEnv e
   where
-    rtree = compile sitemap
     server e = defaultServer (unpack $ o ^. optCargohold . epHost) (o ^. optCargohold . epPort) (e ^. appLogger) (e ^. metrics)
     middleware :: Env -> Wai.Middleware
     middleware e =
-      waiPrometheusMiddleware sitemap
+      servantPrometheusMiddleware (Proxy @CombinedAPI)
         . GZip.gzip GZip.def
         . catchErrors (e ^. appLogger) [Right $ e ^. metrics]
-    serve e r k = runHandler e (Server.route rtree r k)
     servantApp e0 r =
       let e = set requestId (maybe def RequestId (lookupRequestId r)) e0
-       in Servant.serve
+       in Servant.serveWithContext
             (Proxy @CombinedAPI)
-            ( hoistServer (Proxy @FederationAPI) (toServantHandler e) federationSitemap
-                :<|> Servant.Tagged (serve e)
+            ((o ^. optSettings . setFederationDomain) :. Servant.EmptyContext)
+            ( hoistServer' @FederationAPI (toServantHandler e) federationSitemap
+                :<|> hoistServer' @Public.ServantAPI (toServantHandler e) servantSitemap
             )
             r
 
 toServantHandler :: Env -> Handler a -> Servant.Handler a
 toServantHandler env = liftIO . runHandler env
+
+-- | See 'Galley.Run' for an explanation of this function.
+hoistServer' ::
+  forall api m n.
+  HasServer api '[Domain] =>
+  (forall x. m x -> n x) ->
+  ServerT api m ->
+  ServerT api n
+hoistServer' = hoistServerWithContext (Proxy @api) (Proxy @'[Domain])
diff --git a/services/cargohold/test/integration/API/V3.hs b/services/cargohold/test/integration/API/V3.hs
index a6a34f6ef58..f3d2a780011 100644
--- a/services/cargohold/test/integration/API/V3.hs
+++ b/services/cargohold/test/integration/API/V3.hs
@@ -125,9 +125,15 @@ testSimpleTokens c = do
   -- No access without token from other user (opaque 404)
   get (c . path loc . zUser uid2 . noRedirect)
     !!! const 404 === statusCode
+  -- No access with empty token query parameter from other user (opaque 404)
+  get (c . path loc . zUser uid2 . queryItem' "asset_token" Nothing . noRedirect)
+    !!! const 404 === statusCode
   -- No access with wrong token (opaque 404)
   get (c . path loc . zUser uid2 . header "Asset-Token" "acb123" . noRedirect)
     !!! const 404 === statusCode
+  -- No access with wrong token as query parameter (opaque 404)
+  get (c . path loc . zUser uid2 . queryItem "asset_token" "acb123" . noRedirect)
+    !!! const 404 === statusCode
   -- Token renewal fails if not done by owner
   post (c . paths ["assets", "v3", toByteString' key, "token"] . zUser uid2) !!! do
     const 403 === statusCode
@@ -156,6 +162,9 @@ testSimpleTokens c = do
   -- Verify access with new token from a different user.
   get (c . path loc . header "Asset-Token" (toByteString' tok') . zUser uid2 . noRedirect)
     !!! const 302 === statusCode
+  -- Verify access with new token as query parameter from a different user
+  get (c . path loc . queryItem "asset_token" (toByteString' tok') . zUser uid2 . noRedirect)
+    !!! const 302 === statusCode
   -- Delete Token fails if not done by owner
   delete (c . paths ["assets", "v3", toByteString' key, "token"] . zUser uid2) !!! do
     const 403 === statusCode
diff --git a/services/cargohold/test/integration/Main.hs b/services/cargohold/test/integration/Main.hs
index ea5156ec567..21e1e336102 100644
--- a/services/cargohold/test/integration/Main.hs
+++ b/services/cargohold/test/integration/Main.hs
@@ -22,9 +22,6 @@ where
 
 import qualified API.V3
 import Bilge hiding (body, header)
-import qualified CargoHold.API (sitemap)
-import Data.Metrics.Test (pathsConsistencyCheck)
-import Data.Metrics.WaiRoute (treeToPaths)
 import Data.Proxy
 import Data.Tagged
 import Data.Text.Encoding (encodeUtf8)
@@ -33,10 +30,8 @@ import Imports hiding (local)
 import qualified Metrics
 import Network.HTTP.Client (responseTimeoutMicro)
 import Network.HTTP.Client.TLS
-import Network.Wai.Utilities.Server (compile)
 import Options.Applicative
 import Test.Tasty
-import Test.Tasty.HUnit
 import Test.Tasty.Options
 import TestSetup
 import Util.Options
@@ -86,12 +81,7 @@ main = runTests go
     go c i = withResource (getOpts c i) releaseOpts $ \opts ->
       testGroup
         "Cargohold"
-        [ testCase "sitemap" $
-            assertEqual
-              "inconcistent sitemap"
-              mempty
-              (pathsConsistencyCheck . treeToPaths . compile $ CargoHold.API.sitemap),
-          API.V3.tests opts,
+        [ API.V3.tests opts,
           Metrics.tests opts
         ]
     getOpts _ i = do

From a176340595fd32b7fbb1aac625c35ac53545dd9d Mon Sep 17 00:00:00 2001
From: Paolo Capriotti <paolo@capriotti.io>
Date: Mon, 20 Dec 2021 10:31:05 +0100
Subject: [PATCH 20/74] Update polysemy-check version in cabal.freeze (#2006)

---
 cabal.project.freeze | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cabal.project.freeze b/cabal.project.freeze
index 6e81f6e4022..fda8eeef868 100644
--- a/cabal.project.freeze
+++ b/cabal.project.freeze
@@ -1690,7 +1690,7 @@ constraints: any.AC-Angle ==1.0,
              any.polynomials-bernstein ==1.1.2,
              any.polyparse ==1.13,
              any.polysemy ==1.7.0.0,
-             any.polysemy-check ==0.8.1.0,
+             any.polysemy-check ==0.9.0.0,
              any.polysemy-plugin ==0.4.2.0,
              any.pooled-io ==0.0.2.2,
              any.port-utils ==0.2.1.0,

From dd36838727fe712a5ad2450fcc6f7292ec2c6fcb Mon Sep 17 00:00:00 2001
From: Leif Battermann <leif.battermann@gmail.com>
Date: Mon, 20 Dec 2021 13:49:46 +0100
Subject: [PATCH 21/74] post/get conversation/:cnv/code returns error if
 feature disabled (#1980)

---
 changelog.d/2-features/pr-1980           |  1 +
 services/galley/src/Galley/API/Query.hs  | 33 ++++++----
 services/galley/src/Galley/API/Update.hs | 78 +++++++++++++-----------
 services/galley/test/integration/API.hs  | 38 ++++++++++++
 4 files changed, 102 insertions(+), 48 deletions(-)
 create mode 100644 changelog.d/2-features/pr-1980

diff --git a/changelog.d/2-features/pr-1980 b/changelog.d/2-features/pr-1980
new file mode 100644
index 00000000000..1eafba32ca6
--- /dev/null
+++ b/changelog.d/2-features/pr-1980
@@ -0,0 +1 @@
+Revoke guest links if feature is disabled. If the guest links team feature is disabled `get /conversations/join`, `post /conversations/:cnv/code`, and `get /conversations/:cnv/code` will return an error.
diff --git a/services/galley/src/Galley/API/Query.hs b/services/galley/src/Galley/API/Query.hs
index ace30d6eec7..736e401397e 100644
--- a/services/galley/src/Galley/API/Query.hs
+++ b/services/galley/src/Galley/API/Query.hs
@@ -30,6 +30,7 @@ module Galley.API.Query
     internalGetMemberH,
     getConversationMetaH,
     getConversationByReusableCode,
+    ensureGuestLinksEnabled,
   )
 where
 
@@ -513,9 +514,8 @@ getConversationByReusableCode ::
 getConversationByReusableCode lusr key value = do
   c <- verifyReusableCode (ConversationCode key value Nothing)
   conv <- ensureConversationAccess (tUnqualified lusr) (Data.codeConversation c) CodeAccess
-  getFeatureStatus conv >>= \case
-    TeamFeatureEnabled -> pure $ coverView conv
-    TeamFeatureDisabled -> throw GuestLinksDisabled
+  ensureGuestLinksEnabled conv
+  pure $ coverView conv
   where
     coverView :: Data.Conversation -> ConversationCoverView
     coverView conv =
@@ -524,12 +524,23 @@ getConversationByReusableCode lusr key value = do
           cnvCoverName = Data.convName conv
         }
 
+-- FUTUREWORK(leif): refactor and make it consistent for all team features
+ensureGuestLinksEnabled ::
+  forall r.
+  ( Member (Error ConversationError) r,
+    Member TeamFeatureStore r,
+    Member (Input Opts) r
+  ) =>
+  Data.Conversation ->
+  Sem r ()
+ensureGuestLinksEnabled conv = do
+  defaultStatus <- getDefaultFeatureStatus
+  maybeFeatureStatus <- join <$> TeamFeatures.getFeatureStatusNoConfig @'TeamFeatureGuestLinks `traverse` Data.convTeam conv
+  case maybe defaultStatus tfwoStatus maybeFeatureStatus of
+    TeamFeatureEnabled -> pure ()
+    TeamFeatureDisabled -> throw GuestLinksDisabled
+  where
     getDefaultFeatureStatus :: Sem r TeamFeatureStatusValue
-    getDefaultFeatureStatus =
-      input <&> view (optSettings . setFeatureFlags . flagConversationGuestLinks . unDefaults . to tfwoapsStatus)
-
-    getFeatureStatus :: Data.Conversation -> Sem r TeamFeatureStatusValue
-    getFeatureStatus conv = do
-      defaultStatus <- getDefaultFeatureStatus
-      maybeFeatureStatus <- join <$> TeamFeatures.getFeatureStatusNoConfig @'TeamFeatureGuestLinks `traverse` Data.convTeam conv
-      pure $ maybe defaultStatus tfwoStatus maybeFeatureStatus
+    getDefaultFeatureStatus = do
+      status <- input <&> view (optSettings . setFeatureFlags . flagConversationGuestLinks . unDefaults)
+      pure $ tfwoapsStatus status
diff --git a/services/galley/src/Galley/API/Update.hs b/services/galley/src/Galley/API/Update.hs
index 26af1fabcb2..aec91abde61 100644
--- a/services/galley/src/Galley/API/Update.hs
+++ b/services/galley/src/Galley/API/Update.hs
@@ -82,6 +82,7 @@ import Galley.API.Error
 import Galley.API.LegalHold.Conflicts
 import Galley.API.Mapping
 import Galley.API.Message
+import qualified Galley.API.Query as Query
 import Galley.API.Util
 import qualified Galley.Data.Conversation as Data
 import Galley.Data.Services as Data
@@ -522,16 +523,17 @@ getUpdateResult :: Sem (Error NoChanges ': r) a -> Sem r (UpdateResult a)
 getUpdateResult = fmap (either (const Unchanged) Updated) . runError
 
 addCodeH ::
-  Members
-    '[ CodeStore,
-       ConversationStore,
-       Error ConversationError,
-       ExternalAccess,
-       GundeckAccess,
-       Input (Local ()),
-       Input UTCTime
-     ]
-    r =>
+  forall r.
+  ( Member CodeStore r,
+    Member ConversationStore r,
+    Member (Error ConversationError) r,
+    Member ExternalAccess r,
+    Member GundeckAccess r,
+    Member (Input (Local ())) r,
+    Member (Input UTCTime) r,
+    Member (Input Opts) r,
+    Member TeamFeatureStore r
+  ) =>
   UserId ::: ConnId ::: ConvId ->
   Sem r Response
 addCodeH (usr ::: zcon ::: cnv) = do
@@ -547,21 +549,22 @@ data AddCodeResult
 
 addCode ::
   forall r.
-  Members
-    '[ CodeStore,
-       ConversationStore,
-       Error ConversationError,
-       ExternalAccess,
-       GundeckAccess,
-       Input UTCTime
-     ]
-    r =>
+  ( Member CodeStore r,
+    Member ConversationStore r,
+    Member (Error ConversationError) r,
+    Member ExternalAccess r,
+    Member GundeckAccess r,
+    Member (Input UTCTime) r,
+    Member (Input Opts) r,
+    Member TeamFeatureStore r
+  ) =>
   Local UserId ->
   ConnId ->
   Local ConvId ->
   Sem r AddCodeResult
 addCode lusr zcon lcnv = do
   conv <- E.getConversation (tUnqualified lcnv) >>= note ConvNotFound
+  Query.ensureGuestLinksEnabled conv
   ensureConvMember (Data.convLocalMembers conv) (tUnqualified lusr)
   ensureAccess conv CodeAccess
   let (bots, users) = localBotsAndUsers $ Data.convLocalMembers conv
@@ -582,8 +585,7 @@ addCode lusr zcon lcnv = do
   where
     createCode :: Code -> Sem r ConversationCode
     createCode code = do
-      urlPrefix <- E.getConversationCodeURI
-      return $ mkConversationCode (codeKey code) (codeValue code) urlPrefix
+      mkConversationCode (codeKey code) (codeValue code) <$> E.getConversationCodeURI
 
 rmCodeH ::
   Members
@@ -631,32 +633,35 @@ rmCode lusr zcon lcnv = do
   pure event
 
 getCodeH ::
-  Members
-    '[ CodeStore,
-       ConversationStore,
-       Error CodeError,
-       Error ConversationError
-     ]
-    r =>
+  forall r.
+  ( Member CodeStore r,
+    Member ConversationStore r,
+    Member (Error CodeError) r,
+    Member (Error ConversationError) r,
+    Member (Input Opts) r,
+    Member TeamFeatureStore r
+  ) =>
   UserId ::: ConvId ->
   Sem r Response
 getCodeH (usr ::: cnv) =
   setStatus status200 . json <$> getCode usr cnv
 
 getCode ::
-  Members
-    '[ CodeStore,
-       ConversationStore,
-       Error CodeError,
-       Error ConversationError
-     ]
-    r =>
+  forall r.
+  ( Member CodeStore r,
+    Member ConversationStore r,
+    Member (Error CodeError) r,
+    Member (Error ConversationError) r,
+    Member (Input Opts) r,
+    Member TeamFeatureStore r
+  ) =>
   UserId ->
   ConvId ->
   Sem r Public.ConversationCode
 getCode usr cnv = do
   conv <-
     E.getConversation cnv >>= note ConvNotFound
+  Query.ensureGuestLinksEnabled conv
   ensureAccess conv CodeAccess
   ensureConvMember (Data.convLocalMembers conv) usr
   key <- E.makeKey cnv
@@ -665,8 +670,7 @@ getCode usr cnv = do
 
 returnCode :: Member CodeStore r => Code -> Sem r Public.ConversationCode
 returnCode c = do
-  urlPrefix <- E.getConversationCodeURI
-  pure $ Public.mkConversationCode (codeKey c) (codeValue c) urlPrefix
+  Public.mkConversationCode (codeKey c) (codeValue c) <$> E.getConversationCodeURI
 
 checkReusableCodeH ::
   Members '[CodeStore, Error CodeError, WaiRoutes] r =>
diff --git a/services/galley/test/integration/API.hs b/services/galley/test/integration/API.hs
index 3d2706dd4e5..5a29641a606 100644
--- a/services/galley/test/integration/API.hs
+++ b/services/galley/test/integration/API.hs
@@ -223,6 +223,8 @@ tests s =
           test s "cannot join private conversation" postJoinConvFail,
           test s "revoke guest links for team conversation" testJoinTeamConvGuestLinksDisabled,
           test s "revoke guest links for non-team conversation" testJoinNonTeamConvGuestLinksDisabled,
+          test s "get code rejected if guest links disabled" testGetCodeRejectedIfGuestLinksDisabled,
+          test s "post code rejected if guest links disabled" testPostCodeRejectedIfGuestLinksDisabled,
           test s "remove user with only local convs" removeUserNoFederation,
           test s "remove user with local and remote convs" removeUser,
           test s "iUpsertOne2OneConversation" testAllOne2OneConversationRequests,
@@ -1241,6 +1243,42 @@ testJoinCodeConv = do
   getJoinCodeConv eve (conversationKey cCode) (conversationCode cCode) !!! do
     const 403 === statusCode
 
+testGetCodeRejectedIfGuestLinksDisabled :: TestM ()
+testGetCodeRejectedIfGuestLinksDisabled = do
+  galley <- view tsGalley
+  (owner, teamId, []) <- Util.createBindingTeamWithNMembers 0
+  let createConvWithGuestLink = do
+        convId <- decodeConvId <$> postTeamConv teamId owner [] (Just "testConversation") [CodeAccess] (Just ActivatedAccessRole) Nothing
+        void $ decodeConvCodeEvent <$> postConvCode owner convId
+        pure convId
+  convId <- createConvWithGuestLink
+  let checkGetCode expectedStatus = getConvCode owner convId !!! statusCode === const expectedStatus
+  let setStatus tfStatus =
+        TeamFeatures.putTeamFeatureFlagWithGalley @'Public.TeamFeatureGuestLinks galley owner teamId (Public.TeamFeatureStatusNoConfig tfStatus) !!! do
+          const 200 === statusCode
+
+  checkGetCode 200
+  setStatus Public.TeamFeatureDisabled
+  checkGetCode 409
+  setStatus Public.TeamFeatureEnabled
+  checkGetCode 200
+
+testPostCodeRejectedIfGuestLinksDisabled :: TestM ()
+testPostCodeRejectedIfGuestLinksDisabled = do
+  galley <- view tsGalley
+  (owner, teamId, []) <- Util.createBindingTeamWithNMembers 0
+  convId <- decodeConvId <$> postTeamConv teamId owner [] (Just "testConversation") [CodeAccess] (Just ActivatedAccessRole) Nothing
+  let checkPostCode expectedStatus = postConvCode owner convId !!! statusCode === const expectedStatus
+  let setStatus tfStatus =
+        TeamFeatures.putTeamFeatureFlagWithGalley @'Public.TeamFeatureGuestLinks galley owner teamId (Public.TeamFeatureStatusNoConfig tfStatus) !!! do
+          const 200 === statusCode
+
+  checkPostCode 201
+  setStatus Public.TeamFeatureDisabled
+  checkPostCode 409
+  setStatus Public.TeamFeatureEnabled
+  checkPostCode 200
+
 testJoinTeamConvGuestLinksDisabled :: TestM ()
 testJoinTeamConvGuestLinksDisabled = do
   galley <- view tsGalley

From b3730cf8e4b01bf41b769549d7a1408464041f32 Mon Sep 17 00:00:00 2001
From: Leif Battermann <leif.battermann@wire.com>
Date: Mon, 20 Dec 2021 15:43:30 +0000
Subject: [PATCH 22/74] wip

---
 .../src/Wire/API/Routes/Public/Galley.hs      | 22 +++++++++-
 libs/wire-api/src/Wire/API/Team.hs            |  6 +++
 services/galley/src/Galley/API/Public.hs      | 15 +------
 services/galley/src/Galley/API/Teams.hs       | 41 +++++--------------
 4 files changed, 40 insertions(+), 44 deletions(-)

diff --git a/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs b/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs
index 63949b1d841..54b95c0c154 100644
--- a/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs
+++ b/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs
@@ -1,4 +1,5 @@
 {-# LANGUAGE DerivingVia #-}
+{-# LANGUAGE GeneralizedNewtypeDeriving #-}
 {-# OPTIONS_GHC -Wno-orphans #-}
 
 -- This file is part of the Wire Server implementation.
@@ -43,6 +44,7 @@ import Wire.API.Routes.Public
 import Wire.API.Routes.Public.Util
 import Wire.API.Routes.QualifiedCapture
 import Wire.API.ServantProto (Proto, RawProto)
+import Wire.API.Team
 import Wire.API.Team.Conversation
 import Wire.API.Team.Feature
 
@@ -705,7 +707,25 @@ data Api routes = Api
         :- FeatureConfigGet 'WithLockStatus 'TeamFeatureSelfDeletingMessages,
     featureConfigGuestLinksGet ::
       routes
-        :- FeatureConfigGet 'WithLockStatus 'TeamFeatureGuestLinks
+        :- FeatureConfigGet 'WithLockStatus 'TeamFeatureGuestLinks,
+    -- teams
+    createNonBindingTeam ::
+      routes
+        :- Summary "Create a new non binding team"
+        :> ZUser
+        :> ZConn
+        :> "teams"
+        :> ReqBody '[Servant.JSON] NonBindingNewTeam
+        :> MultiVerb
+             'POST
+             '[JSON]
+             '[ NotConnected,
+                WithHeaders
+                  '[DescHeader "Location" "Team ID" TeamId]
+                  TeamId
+                  (RespondEmpty 201 "Team ID as `Location` header value")
+              ]
+             TeamId
   }
   deriving (Generic)
 
diff --git a/libs/wire-api/src/Wire/API/Team.hs b/libs/wire-api/src/Wire/API/Team.hs
index b1307bea120..2f96d6c6a49 100644
--- a/libs/wire-api/src/Wire/API/Team.hs
+++ b/libs/wire-api/src/Wire/API/Team.hs
@@ -77,6 +77,8 @@ import Data.Id (TeamId, UserId)
 import Data.Json.Util
 import Data.Misc (PlainTextPassword (..))
 import Data.Range
+import Data.Schema (Schema (..), ToSchema, schema)
+import qualified Data.Swagger as S
 import qualified Data.Swagger.Build.Api as Doc
 import Imports
 import Test.QuickCheck.Gen (suchThat)
@@ -227,6 +229,10 @@ instance Arbitrary BindingNewTeam where
 -- | FUTUREWORK: this is dead code!  remove!
 newtype NonBindingNewTeam = NonBindingNewTeam (NewTeam (Range 1 127 [TeamMember]))
   deriving stock (Eq, Show, Generic)
+  deriving (S.ToSchema) via (Schema NonBindingNewTeam)
+
+instance ToSchema NonBindingNewTeam where
+  schema = error "todo"
 
 modelNewNonBindingTeam :: Doc.Model
 modelNewNonBindingTeam = Doc.defineModel "newNonBindingTeam" $ do
diff --git a/services/galley/src/Galley/API/Public.hs b/services/galley/src/Galley/API/Public.hs
index 31d41ae0531..42db3104f91 100644
--- a/services/galley/src/Galley/API/Public.hs
+++ b/services/galley/src/Galley/API/Public.hs
@@ -187,25 +187,14 @@ servantSitemap =
         GalleyAPI.featureConfigClassifiedDomainsGet = Features.getFeatureConfig @'Public.WithoutLockStatus @'Public.TeamFeatureClassifiedDomains Features.getClassifiedDomainsInternal,
         GalleyAPI.featureConfigConferenceCallingGet = Features.getFeatureConfig @'Public.WithoutLockStatus @'Public.TeamFeatureConferenceCalling Features.getConferenceCallingInternal,
         GalleyAPI.featureConfigSelfDeletingMessagesGet = Features.getFeatureConfig @'Public.WithLockStatus @'Public.TeamFeatureSelfDeletingMessages Features.getSelfDeletingMessagesInternal,
-        GalleyAPI.featureConfigGuestLinksGet = Features.getFeatureConfig @'Public.WithLockStatus @'Public.TeamFeatureGuestLinks Features.getGuestLinkInternal
+        GalleyAPI.featureConfigGuestLinksGet = Features.getFeatureConfig @'Public.WithLockStatus @'Public.TeamFeatureGuestLinks Features.getGuestLinkInternal,
+        GalleyAPI.createNonBindingTeam = Teams.createNonBindingTeamH
       }
 
 sitemap :: Routes ApiBuilder (Sem GalleyEffects) ()
 sitemap = do
   -- Team API -----------------------------------------------------------
 
-  post "/teams" (continue Teams.createNonBindingTeamH) $
-    zauthUserId
-      .&. zauthConnId
-      .&. jsonRequest @Public.NonBindingNewTeam
-      .&. accept "application" "json"
-  document "POST" "createNonBindingTeam" $ do
-    summary "Create a new non binding team"
-    body (ref Public.modelNewNonBindingTeam) $
-      description "JSON body"
-    response 201 "Team ID as `Location` header value" end
-    errorResponse (Error.errorDescriptionTypeToWai @Error.NotConnected)
-
   put "/teams/:tid" (continue Teams.updateTeamH) $
     zauthUserId
       .&. zauthConnId
diff --git a/services/galley/src/Galley/API/Teams.hs b/services/galley/src/Galley/API/Teams.hs
index 9d46c2fcd7a..d85390e7fd5 100644
--- a/services/galley/src/Galley/API/Teams.hs
+++ b/services/galley/src/Galley/API/Teams.hs
@@ -203,40 +203,21 @@ lookupTeam zusr tid = do
     else pure Nothing
 
 createNonBindingTeamH ::
-  Members
-    '[ BrigAccess,
-       Error ActionError,
-       Error TeamError,
-       GundeckAccess,
-       Input UTCTime,
-       P.TinyLog,
-       TeamStore,
-       WaiRoutes
-     ]
-    r =>
-  UserId ::: ConnId ::: JsonRequest Public.NonBindingNewTeam ::: JSON ->
-  Sem r Response
-createNonBindingTeamH (zusr ::: zcon ::: req ::: _) = do
-  newTeam <- fromJsonBody req
-  newTeamId <- createNonBindingTeam zusr zcon newTeam
-  pure (empty & setStatus status201 . location newTeamId)
-
-createNonBindingTeam ::
-  Members
-    '[ BrigAccess,
-       Error ActionError,
-       Error TeamError,
-       GundeckAccess,
-       Input UTCTime,
-       TeamStore,
-       P.TinyLog
-     ]
-    r =>
+  forall r.
+  ( Member BrigAccess r,
+    Member (Error ActionError) r,
+    Member (Error TeamError) r,
+    Member GundeckAccess r,
+    Member (Input UTCTime) r,
+    Member P.TinyLog r,
+    Member TeamStore r,
+    Member WaiRoutes r
+  ) =>
   UserId ->
   ConnId ->
   Public.NonBindingNewTeam ->
   Sem r TeamId
-createNonBindingTeam zusr zcon (Public.NonBindingNewTeam body) = do
+createNonBindingTeamH zusr zcon (Public.NonBindingNewTeam body) = do
   let owner = Public.TeamMember zusr fullPermissions Nothing LH.defUserLegalHoldStatus
   let others =
         filter ((zusr /=) . view userId)

From dcd754eb939a77b7f39daf51aafd6e09fb032ca2 Mon Sep 17 00:00:00 2001
From: Leif Battermann <leif.battermann@wire.com>
Date: Mon, 20 Dec 2021 15:45:30 +0000
Subject: [PATCH 23/74] Revert "wip"

This reverts commit b3730cf8e4b01bf41b769549d7a1408464041f32.
---
 .../src/Wire/API/Routes/Public/Galley.hs      | 22 +---------
 libs/wire-api/src/Wire/API/Team.hs            |  6 ---
 services/galley/src/Galley/API/Public.hs      | 15 ++++++-
 services/galley/src/Galley/API/Teams.hs       | 41 ++++++++++++++-----
 4 files changed, 44 insertions(+), 40 deletions(-)

diff --git a/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs b/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs
index 54b95c0c154..63949b1d841 100644
--- a/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs
+++ b/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs
@@ -1,5 +1,4 @@
 {-# LANGUAGE DerivingVia #-}
-{-# LANGUAGE GeneralizedNewtypeDeriving #-}
 {-# OPTIONS_GHC -Wno-orphans #-}
 
 -- This file is part of the Wire Server implementation.
@@ -44,7 +43,6 @@ import Wire.API.Routes.Public
 import Wire.API.Routes.Public.Util
 import Wire.API.Routes.QualifiedCapture
 import Wire.API.ServantProto (Proto, RawProto)
-import Wire.API.Team
 import Wire.API.Team.Conversation
 import Wire.API.Team.Feature
 
@@ -707,25 +705,7 @@ data Api routes = Api
         :- FeatureConfigGet 'WithLockStatus 'TeamFeatureSelfDeletingMessages,
     featureConfigGuestLinksGet ::
       routes
-        :- FeatureConfigGet 'WithLockStatus 'TeamFeatureGuestLinks,
-    -- teams
-    createNonBindingTeam ::
-      routes
-        :- Summary "Create a new non binding team"
-        :> ZUser
-        :> ZConn
-        :> "teams"
-        :> ReqBody '[Servant.JSON] NonBindingNewTeam
-        :> MultiVerb
-             'POST
-             '[JSON]
-             '[ NotConnected,
-                WithHeaders
-                  '[DescHeader "Location" "Team ID" TeamId]
-                  TeamId
-                  (RespondEmpty 201 "Team ID as `Location` header value")
-              ]
-             TeamId
+        :- FeatureConfigGet 'WithLockStatus 'TeamFeatureGuestLinks
   }
   deriving (Generic)
 
diff --git a/libs/wire-api/src/Wire/API/Team.hs b/libs/wire-api/src/Wire/API/Team.hs
index 2f96d6c6a49..b1307bea120 100644
--- a/libs/wire-api/src/Wire/API/Team.hs
+++ b/libs/wire-api/src/Wire/API/Team.hs
@@ -77,8 +77,6 @@ import Data.Id (TeamId, UserId)
 import Data.Json.Util
 import Data.Misc (PlainTextPassword (..))
 import Data.Range
-import Data.Schema (Schema (..), ToSchema, schema)
-import qualified Data.Swagger as S
 import qualified Data.Swagger.Build.Api as Doc
 import Imports
 import Test.QuickCheck.Gen (suchThat)
@@ -229,10 +227,6 @@ instance Arbitrary BindingNewTeam where
 -- | FUTUREWORK: this is dead code!  remove!
 newtype NonBindingNewTeam = NonBindingNewTeam (NewTeam (Range 1 127 [TeamMember]))
   deriving stock (Eq, Show, Generic)
-  deriving (S.ToSchema) via (Schema NonBindingNewTeam)
-
-instance ToSchema NonBindingNewTeam where
-  schema = error "todo"
 
 modelNewNonBindingTeam :: Doc.Model
 modelNewNonBindingTeam = Doc.defineModel "newNonBindingTeam" $ do
diff --git a/services/galley/src/Galley/API/Public.hs b/services/galley/src/Galley/API/Public.hs
index 42db3104f91..31d41ae0531 100644
--- a/services/galley/src/Galley/API/Public.hs
+++ b/services/galley/src/Galley/API/Public.hs
@@ -187,14 +187,25 @@ servantSitemap =
         GalleyAPI.featureConfigClassifiedDomainsGet = Features.getFeatureConfig @'Public.WithoutLockStatus @'Public.TeamFeatureClassifiedDomains Features.getClassifiedDomainsInternal,
         GalleyAPI.featureConfigConferenceCallingGet = Features.getFeatureConfig @'Public.WithoutLockStatus @'Public.TeamFeatureConferenceCalling Features.getConferenceCallingInternal,
         GalleyAPI.featureConfigSelfDeletingMessagesGet = Features.getFeatureConfig @'Public.WithLockStatus @'Public.TeamFeatureSelfDeletingMessages Features.getSelfDeletingMessagesInternal,
-        GalleyAPI.featureConfigGuestLinksGet = Features.getFeatureConfig @'Public.WithLockStatus @'Public.TeamFeatureGuestLinks Features.getGuestLinkInternal,
-        GalleyAPI.createNonBindingTeam = Teams.createNonBindingTeamH
+        GalleyAPI.featureConfigGuestLinksGet = Features.getFeatureConfig @'Public.WithLockStatus @'Public.TeamFeatureGuestLinks Features.getGuestLinkInternal
       }
 
 sitemap :: Routes ApiBuilder (Sem GalleyEffects) ()
 sitemap = do
   -- Team API -----------------------------------------------------------
 
+  post "/teams" (continue Teams.createNonBindingTeamH) $
+    zauthUserId
+      .&. zauthConnId
+      .&. jsonRequest @Public.NonBindingNewTeam
+      .&. accept "application" "json"
+  document "POST" "createNonBindingTeam" $ do
+    summary "Create a new non binding team"
+    body (ref Public.modelNewNonBindingTeam) $
+      description "JSON body"
+    response 201 "Team ID as `Location` header value" end
+    errorResponse (Error.errorDescriptionTypeToWai @Error.NotConnected)
+
   put "/teams/:tid" (continue Teams.updateTeamH) $
     zauthUserId
       .&. zauthConnId
diff --git a/services/galley/src/Galley/API/Teams.hs b/services/galley/src/Galley/API/Teams.hs
index d85390e7fd5..9d46c2fcd7a 100644
--- a/services/galley/src/Galley/API/Teams.hs
+++ b/services/galley/src/Galley/API/Teams.hs
@@ -203,21 +203,40 @@ lookupTeam zusr tid = do
     else pure Nothing
 
 createNonBindingTeamH ::
-  forall r.
-  ( Member BrigAccess r,
-    Member (Error ActionError) r,
-    Member (Error TeamError) r,
-    Member GundeckAccess r,
-    Member (Input UTCTime) r,
-    Member P.TinyLog r,
-    Member TeamStore r,
-    Member WaiRoutes r
-  ) =>
+  Members
+    '[ BrigAccess,
+       Error ActionError,
+       Error TeamError,
+       GundeckAccess,
+       Input UTCTime,
+       P.TinyLog,
+       TeamStore,
+       WaiRoutes
+     ]
+    r =>
+  UserId ::: ConnId ::: JsonRequest Public.NonBindingNewTeam ::: JSON ->
+  Sem r Response
+createNonBindingTeamH (zusr ::: zcon ::: req ::: _) = do
+  newTeam <- fromJsonBody req
+  newTeamId <- createNonBindingTeam zusr zcon newTeam
+  pure (empty & setStatus status201 . location newTeamId)
+
+createNonBindingTeam ::
+  Members
+    '[ BrigAccess,
+       Error ActionError,
+       Error TeamError,
+       GundeckAccess,
+       Input UTCTime,
+       TeamStore,
+       P.TinyLog
+     ]
+    r =>
   UserId ->
   ConnId ->
   Public.NonBindingNewTeam ->
   Sem r TeamId
-createNonBindingTeamH zusr zcon (Public.NonBindingNewTeam body) = do
+createNonBindingTeam zusr zcon (Public.NonBindingNewTeam body) = do
   let owner = Public.TeamMember zusr fullPermissions Nothing LH.defUserLegalHoldStatus
   let others =
         filter ((zusr /=) . view userId)

From 04fde5ad909ea5c50d0b403c6fcd1f571df78a2e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marko=20Dimja=C5=A1evi=C4=87?= <marko.dimjasevic@wire.com>
Date: Tue, 21 Dec 2021 13:51:54 +0100
Subject: [PATCH 24/74] Documentation for Federation Test Cases (#2000)

Co-authored-by: Leif Battermann <leif.battermann@wire.com>
Co-authored-by: Matthias Fischmann <mf@zerobuzz.net>
---
 changelog.d/5-internal/map-federation-tests   |  1 +
 services/brig/docs/swagger.md                 |  2 +-
 services/federator/src/Federator/Discovery.hs |  2 +-
 .../federator/src/Federator/Validation.hs     |  3 +-
 .../integration/Test/Federator/IngressSpec.hs | 17 ++++++++-
 .../integration/Test/Federator/InwardSpec.hs  | 38 ++++++++++++++++---
 .../unit/Test/Federator/InternalServer.hs     |  5 +++
 .../test/unit/Test/Federator/Options.hs       |  4 +-
 .../test/unit/Test/Federator/Response.hs      |  2 +-
 .../test/unit/Test/Federator/Validation.hs    | 14 +++++++
 .../test-integration/Test/Spar/APISpec.hs     |  2 +
 11 files changed, 78 insertions(+), 12 deletions(-)
 create mode 100644 changelog.d/5-internal/map-federation-tests

diff --git a/changelog.d/5-internal/map-federation-tests b/changelog.d/5-internal/map-federation-tests
new file mode 100644
index 00000000000..b53c1449dde
--- /dev/null
+++ b/changelog.d/5-internal/map-federation-tests
@@ -0,0 +1 @@
+Tag integration tests for security audit.
\ No newline at end of file
diff --git a/services/brig/docs/swagger.md b/services/brig/docs/swagger.md
index 63ec978afb9..59e6c1c3b8f 100644
--- a/services/brig/docs/swagger.md
+++ b/services/brig/docs/swagger.md
@@ -54,7 +54,7 @@ An error in this category likely indicates an issue with the configuration of fe
 
  - **Federation unavailable** (status: 500, label: `federation-not-available`): Federation is configured for this backend, but the local federator cannot be reached. This can be transient, so clients should retry the request.
  - **Federation not implemented** (status: 500, label: `federation-not-implemented`): Federated behaviour for a certain endpoint is not yet implemented.
- - **Federator discovery failed** (status: 500, label: `discovery-failure`): A DNS error occurred during discovery of a remote backend. This can be transient, so clients should retry the request.
+ - **Federator discovery failed** (status: 400, label: `discovery-failure`): A DNS error occurred during discovery of a remote backend. This can be transient, so clients should retry the request.
  - **Local federation error** (status: 500, label: `federation-local-error`): An error occurred in the communication between this backend and its local federator. These errors are most likely caused by bugs in the backend, and should be reported as such.
 
 ### Remote federation errors
diff --git a/services/federator/src/Federator/Discovery.hs b/services/federator/src/Federator/Discovery.hs
index 65844e33d86..4148e67c136 100644
--- a/services/federator/src/Federator/Discovery.hs
+++ b/services/federator/src/Federator/Discovery.hs
@@ -49,7 +49,7 @@ instance AsWai DiscoveryFailure where
     where
       (status, label) = case e of
         DiscoveryFailureSrvNotAvailable _ -> (HTTP.status422, "invalid-domain")
-        DiscoveryFailureDNSError _ -> (HTTP.status500, "discovery-failure")
+        DiscoveryFailureDNSError _ -> (HTTP.status400, "discovery-failure")
   waiErrorDescription :: DiscoveryFailure -> Text
   waiErrorDescription (DiscoveryFailureSrvNotAvailable msg) =
     "srv record not found: " <> Text.decodeUtf8 msg
diff --git a/services/federator/src/Federator/Validation.hs b/services/federator/src/Federator/Validation.hs
index 4d7f35867d6..6dc9e21ebd8 100644
--- a/services/federator/src/Federator/Validation.hs
+++ b/services/federator/src/Federator/Validation.hs
@@ -150,6 +150,7 @@ validateDomain ::
 validateDomain Nothing _ = throw NoClientCertificate
 validateDomain (Just encodedCertificate) unparsedDomain = do
   targetDomain <- parseDomain unparsedDomain
+  ensureCanFederateWith targetDomain
 
   -- run discovery to find the hostname of the client federator
   certificate <-
@@ -160,7 +161,7 @@ validateDomain (Just encodedCertificate) unparsedDomain = do
   unless (any null validationErrors) $
     throw $ AuthenticationFailure validationErrors
 
-  ensureCanFederateWith targetDomain $> targetDomain
+  pure targetDomain
 
 -- | Match a hostname against the domain names of a certificate.
 --
diff --git a/services/federator/test/integration/Test/Federator/IngressSpec.hs b/services/federator/test/integration/Test/Federator/IngressSpec.hs
index 08d989b647a..34b6af1d327 100644
--- a/services/federator/test/integration/Test/Federator/IngressSpec.hs
+++ b/services/federator/test/integration/Test/Federator/IngressSpec.hs
@@ -46,6 +46,8 @@ import Wire.API.Federation.Domain
 import Wire.API.User
 import Wire.Network.DNS.SRV
 
+-- | This module contains tests for the interface between federator and ingress.  Ingress is
+-- mocked with nginz.
 spec :: TestEnv -> Spec
 spec env = do
   describe "Ingress" $ do
@@ -68,7 +70,16 @@ spec env = do
           responseStatusCode resp `shouldBe` HTTP.status200
           actualProfile `shouldBe` (Just expectedProfile)
 
-  it "should not be accessible without a client certificate" $
+  -- @SF.Federation @TSFI.RESTfulAPI @S2 @S3 @S7
+  --
+  -- This test was primarily intended to test that federator is using the API right (header
+  -- name etc.), but it is also effectively testing that federator rejects clients without
+  -- certificates that have been validated by ingress.
+  --
+  -- We can't test end-to-end here: the TLS termination happens in k8s, and would have to be
+  -- tested there (and with a good emulation of the concrete configuration of the prod
+  -- system).
+  it "rejectRequestsWithoutClientCertIngress" $
     runTestFederator env $ do
       brig <- view teBrig <$> ask
       user <- randomUser brig
@@ -93,6 +104,10 @@ spec env = do
           expectationFailure "Expected client certificate error, got remote error"
         Left (RemoteErrorResponse _ status _) -> status `shouldBe` HTTP.status400
 
+-- FUTUREWORK: ORMOLU_DISABLE
+-- @END
+-- ORMOLU_ENABLE
+
 runTestSem :: Sem '[Input TestEnv, Embed IO] a -> TestFederator IO a
 runTestSem action = do
   e <- ask
diff --git a/services/federator/test/integration/Test/Federator/InwardSpec.hs b/services/federator/test/integration/Test/Federator/InwardSpec.hs
index da02ec6f459..3ef28b069d8 100644
--- a/services/federator/test/integration/Test/Federator/InwardSpec.hs
+++ b/services/federator/test/integration/Test/Federator/InwardSpec.hs
@@ -39,8 +39,11 @@ import Wire.API.Federation.Domain
 import Wire.API.User
 
 -- FUTUREWORK(federation): move these tests to brig-integration (benefit: avoid duplicating all of the brig helper code)
+-- FUTUREWORK(fisx): better yet, reorganize integration tests (or at least the helpers) so
+-- they don't spread out over the different sevices.
 
--- | Path covered by this test
+-- | This module contains tests for the interface between federator and brig.  The tests call
+-- federator directly, circumnventing ingress:
 --
 --  +----------+
 --  |federator-|          +------+--+
@@ -72,6 +75,14 @@ spec env =
             <!! const 200 === statusCode
         liftIO $ bdy `shouldBe` expectedProfile
 
+    -- @SF.Federation @TSFI.RESTfulAPI @S2 @S3 @S7
+    --
+    -- (This is tested in unit tests; search for
+    -- 'validateDomainCertInvalid' and 'testDiscoveryFailure'.)
+    it "shouldRejectMissmatchingOriginDomainInward" $
+      runTestFederator env $ pure ()
+    -- @END
+
     it "should be able to call cargohold" $
       runTestFederator env $ do
         inwardCall "/federation/cargohold/get-asset" (encode ())
@@ -98,9 +109,11 @@ spec env =
         inwardCall "/i/users" (encode o)
           !!! const 403 === statusCode
 
-    -- Matching client certificates against domain names is better tested in
-    -- unit tests.
-    it "should reject requests without a client certificate" $
+    -- @SF.Federation @TSFI.RESTfulAPI @S2 @S3 @S7
+    --
+    -- See related tests in unit tests (for matching client certificates against domain names)
+    -- and "IngressSpec".
+    it "rejectRequestsWithoutClientCertInward" $
       runTestFederator env $ do
         originDomain <- cfgOriginDomain <$> view teTstOpts
         hdl <- randomHandle
@@ -110,6 +123,10 @@ spec env =
           (encode hdl)
           !!! const 403 === statusCode
 
+-- TODO: ORMOLU_DISABLE
+-- @END
+-- ORMOLU_ENABLE
+
 inwardCallWithHeaders ::
   (MonadIO m, MonadHttp m, MonadReader TestEnv m, HasCallStack) =>
   ByteString ->
@@ -132,8 +149,17 @@ inwardCall ::
   LBS.ByteString ->
   m (Response (Maybe LByteString))
 inwardCall requestPath payload = do
+  originDomain :: Text <- cfgOriginDomain <$> view teTstOpts
+  inwardCallWithOriginDomain (toByteString' originDomain) requestPath payload
+
+inwardCallWithOriginDomain ::
+  (MonadIO m, MonadHttp m, MonadReader TestEnv m, HasCallStack) =>
+  ByteString ->
+  ByteString ->
+  LBS.ByteString ->
+  m (Response (Maybe LByteString))
+inwardCallWithOriginDomain originDomain requestPath payload = do
   Endpoint fedHost fedPort <- cfgFederatorExternal <$> view teTstOpts
-  originDomain <- cfgOriginDomain <$> view teTstOpts
   clientCertFilename <- clientCertificate . optSettings . view teOpts <$> ask
   clientCert <- liftIO $ BS.readFile clientCertFilename
   post
@@ -141,6 +167,6 @@ inwardCall requestPath payload = do
         . port fedPort
         . path requestPath
         . header "X-SSL-Certificate" (HTTP.urlEncode True clientCert)
-        . header originDomainHeaderName (toByteString' originDomain)
+        . header originDomainHeaderName originDomain
         . bytes (toByteString' payload)
     )
diff --git a/services/federator/test/unit/Test/Federator/InternalServer.hs b/services/federator/test/unit/Test/Federator/InternalServer.hs
index db3393c5290..b384d0b88fc 100644
--- a/services/federator/test/unit/Test/Federator/InternalServer.hs
+++ b/services/federator/test/unit/Test/Federator/InternalServer.hs
@@ -99,6 +99,9 @@ federatedRequestSuccess =
     body <- Wai.lazyResponseBody res
     body @?= "\"bar\""
 
+-- @SF.Federation @TSFI.RESTfulAPI @S2 @S3 @S7
+--
+-- Refuse to send outgoing request to non-included domain when allowlist is configured.
 federatedRequestFailureAllowList :: TestTree
 federatedRequestFailureAllowList =
   testCase "should not make a call when target domain not in the allowList" $ do
@@ -134,3 +137,5 @@ federatedRequestFailureAllowList =
         . runInputConst settings
         $ callOutward request
     eith @?= Left (FederationDenied targetDomain)
+
+-- @END
diff --git a/services/federator/test/unit/Test/Federator/Options.hs b/services/federator/test/unit/Test/Federator/Options.hs
index 3bf5930a2dd..90345862734 100644
--- a/services/federator/test/unit/Test/Federator/Options.hs
+++ b/services/federator/test/unit/Test/Federator/Options.hs
@@ -171,7 +171,8 @@ testSettings =
             assertFailure $
               "expected failure for non-existing client certificate, got: "
                 <> show (tlsSettings ^. creds),
-      testCase "fail on invalid certificate" $ do
+      -- @SF.Federation @TSFI.RESTfulAPI @S3 @S7
+      testCase "failToStartWithInvalidServerCredentials" $ do
         let settings =
               defRunSettings
                 "test/resources/unit/invalid.pem"
@@ -193,6 +194,7 @@ testSettings =
             assertFailure $
               "expected failure for invalid client certificate, got: "
                 <> show (tlsSettings ^. creds),
+      -- @END
       testCase "fail on invalid private key" $ do
         let settings =
               defRunSettings
diff --git a/services/federator/test/unit/Test/Federator/Response.hs b/services/federator/test/unit/Test/Federator/Response.hs
index 8413b9b95a2..b8addefb8de 100644
--- a/services/federator/test/unit/Test/Federator/Response.hs
+++ b/services/federator/test/unit/Test/Federator/Response.hs
@@ -72,7 +72,7 @@ testDiscoveryFailure =
         throw (DiscoveryFailureDNSError "mock error")
     body <- Wai.lazyResponseBody resp
     let merr = Aeson.decode body
-    Wai.responseStatus resp @?= HTTP.status500
+    Wai.responseStatus resp @?= HTTP.status400
     fmap Wai.label merr @?= Just "discovery-failure"
 
 testRemoteError :: TestTree
diff --git a/services/federator/test/unit/Test/Federator/Validation.hs b/services/federator/test/unit/Test/Federator/Validation.hs
index 4c4597a6c51..785757927fb 100644
--- a/services/federator/test/unit/Test/Federator/Validation.hs
+++ b/services/federator/test/unit/Test/Federator/Validation.hs
@@ -113,6 +113,9 @@ validateDomainAllowListFailSemantic =
         $ validateDomain (Just exampleCert) "invalid//.><-semantic-&@-domain"
     res @?= Left (DomainParseError "invalid//.><-semantic-&@-domain")
 
+-- @SF.Federation @TSFI.RESTfulAPI @S2 @S3 @S7
+--
+-- Refuse to send outgoing request to non-included domain when allowlist is configured.
 validateDomainAllowListFail :: TestTree
 validateDomainAllowListFail =
   testCase "allow list validation" $ do
@@ -127,6 +130,8 @@ validateDomainAllowListFail =
         $ validateDomain (Just exampleCert) "localhost.example.com"
     res @?= Left (FederationDenied (Domain "localhost.example.com"))
 
+-- @END
+
 validateDomainAllowListSuccess :: TestTree
 validateDomainAllowListSuccess =
   testCase "should give parsed domain if in the allow list" $ do
@@ -153,6 +158,7 @@ validateDomainCertMissing =
         $ validateDomain Nothing "foo.example.com"
     res @?= Left NoClientCertificate
 
+-- @SF.Federation @TSFI.RESTfulAPI @S2 @S3 @S7
 validateDomainCertInvalid :: TestTree
 validateDomainCertInvalid =
   testCase "should fail if the client certificate is invalid" $ do
@@ -164,6 +170,12 @@ validateDomainCertInvalid =
         $ validateDomain (Just "not a certificate") "foo.example.com"
     res @?= Left (CertificateParseError "no certificate found")
 
+-- @END
+
+-- @SF.Federation @TSFI.RESTfulAPI @S3 @S7
+--
+-- Reject request if the infrastructure domain in the client cert does not match the backend
+-- domain in the `Wire-origin-domain` header.
 validateDomainCertWrongDomain :: TestTree
 validateDomainCertWrongDomain =
   testCase "should fail if the client certificate has a wrong domain" $ do
@@ -176,6 +188,8 @@ validateDomainCertWrongDomain =
         $ validateDomain (Just exampleCert) "foo.example.com"
     res @?= Left (AuthenticationFailure (pure [X509.NameMismatch "foo.example.com"]))
 
+-- @END
+
 validateDomainCertCN :: TestTree
 validateDomainCertCN =
   testCase "should succeed if the certificate has subject CN but no SAN" $ do
diff --git a/services/spar/test-integration/Test/Spar/APISpec.hs b/services/spar/test-integration/Test/Spar/APISpec.hs
index af466b1650e..7d73042cf0d 100644
--- a/services/spar/test-integration/Test/Spar/APISpec.hs
+++ b/services/spar/test-integration/Test/Spar/APISpec.hs
@@ -482,7 +482,9 @@ specFinalizeLogin = do
               (cs . fromJust . responseBody $ sparresp) `shouldContain` "<title>wire:sso:error:forbidden</title>"
         check mkareq mkaresp submitaresp checkresp
 
+    -- {- ORMOLU_DISABLE -} -- FUTUREWORK: try a newer release of ormolu?
     -- @END
+    -- {- ORMOLU_ENABLE -}
 
     context "IdP changes response format" $ do
       it "treats NameId case-insensitively" $ do

From 9285b7412b8b931b852e7284374dbfad7b4585f9 Mon Sep 17 00:00:00 2001
From: Sandy Maguire <sandy@sandymaguire.me>
Date: Tue, 21 Dec 2021 06:21:11 -0800
Subject: [PATCH 25/74] Move Spar Polysemy Specs into spar:lib (#2005)

* Move NowSpec into spar:lb

* Move DefaultSsoCodeSpec into spar:lib

* Move IdPRawMetadataStoreSpec to spar:lib

* Move ScimExternalIdStoreSpec to spar:lib

* Move IdPSpec into spar:lib

* Pend the flakey test

* CI

* make format

* Changelog
---
 .../5-internal/integration-spar-polysemy      |   1 +
 services/spar/package.yaml                    |   6 +-
 services/spar/spar.cabal                      |  20 +-
 services/spar/src/Spar/Sem/DefaultSsoCode.hs  |   2 +
 .../spar/src/Spar/Sem/DefaultSsoCode/Spec.hs  | 164 +++++++++
 services/spar/src/Spar/Sem/IdP.hs             |   2 +
 services/spar/src/Spar/Sem/IdP/Spec.hs        | 315 ++++++++++++++++++
 .../spar/src/Spar/Sem/IdPRawMetadataStore.hs  |   2 +
 .../src/Spar/Sem/IdPRawMetadataStore/Spec.hs  | 125 +++++++
 services/spar/src/Spar/Sem/Now.hs             |   2 +
 services/spar/src/Spar/Sem/Now/Spec.hs        |  52 +++
 .../spar/src/Spar/Sem/ScimExternalIdStore.hs  |   2 +
 .../src/Spar/Sem/ScimExternalIdStore/Spec.hs  | 183 ++++++++++
 .../test/Test/Spar/Sem/DefaultSsoCodeSpec.hs  | 158 +--------
 .../Test/Spar/Sem/IdPRawMetadataStoreSpec.hs  | 119 +------
 services/spar/test/Test/Spar/Sem/IdPSpec.hs   | 305 +----------------
 services/spar/test/Test/Spar/Sem/NowSpec.hs   |  45 +--
 .../Test/Spar/Sem/ScimExternalIdStoreSpec.hs  | 179 +---------
 18 files changed, 877 insertions(+), 805 deletions(-)
 create mode 100644 changelog.d/5-internal/integration-spar-polysemy
 create mode 100644 services/spar/src/Spar/Sem/DefaultSsoCode/Spec.hs
 create mode 100644 services/spar/src/Spar/Sem/IdP/Spec.hs
 create mode 100644 services/spar/src/Spar/Sem/IdPRawMetadataStore/Spec.hs
 create mode 100644 services/spar/src/Spar/Sem/Now/Spec.hs
 create mode 100644 services/spar/src/Spar/Sem/ScimExternalIdStore/Spec.hs

diff --git a/changelog.d/5-internal/integration-spar-polysemy b/changelog.d/5-internal/integration-spar-polysemy
new file mode 100644
index 00000000000..f12d69de1cf
--- /dev/null
+++ b/changelog.d/5-internal/integration-spar-polysemy
@@ -0,0 +1 @@
+Moved specifications for Spar effects out of the test suite and into the library
diff --git a/services/spar/package.yaml b/services/spar/package.yaml
index 935e8cbfe0f..5efbb34c319 100644
--- a/services/spar/package.yaml
+++ b/services/spar/package.yaml
@@ -39,6 +39,7 @@ dependencies:
   - galley-types
   - ghc-prim
   - hscim
+  - hspec
   - HsOpenSSL
   - http-api-data
   - http-client
@@ -53,7 +54,9 @@ dependencies:
   - network-uri
   - optparse-applicative
   - polysemy
+  - polysemy-check >= 0.9
   - polysemy-plugin
+  - QuickCheck
   - raw-strings-qq
   - retry
   - saml2-web-sso >= 0.18
@@ -94,12 +97,9 @@ tests:
       - hspec-discover:hspec-discover
     dependencies:
       - lens-aeson
-      - hspec
       - metrics-wai
-      - QuickCheck
       - spar
       - uri-bytestring
-      - polysemy-check >= 0.9
 
 executables:
   spar:
diff --git a/services/spar/spar.cabal b/services/spar/spar.cabal
index cc6c8bb7890..f596bfc9ecd 100644
--- a/services/spar/spar.cabal
+++ b/services/spar/spar.cabal
@@ -4,7 +4,7 @@ cabal-version: 1.12
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 4a323def34cfdc7673cea02e13fe518d53d7b04bae552bff2d0784dfb6964162
+-- hash: c721f9a156f292d2f25f9189e2250e105c48a5a3a67d8fdbf3069c9b3a55f921
 
 name:           spar
 version:        0.1
@@ -50,19 +50,23 @@ library
       Spar.Sem.DefaultSsoCode
       Spar.Sem.DefaultSsoCode.Cassandra
       Spar.Sem.DefaultSsoCode.Mem
+      Spar.Sem.DefaultSsoCode.Spec
       Spar.Sem.GalleyAccess
       Spar.Sem.GalleyAccess.Http
       Spar.Sem.IdP
       Spar.Sem.IdP.Cassandra
       Spar.Sem.IdP.Mem
+      Spar.Sem.IdP.Spec
       Spar.Sem.IdPRawMetadataStore
       Spar.Sem.IdPRawMetadataStore.Cassandra
       Spar.Sem.IdPRawMetadataStore.Mem
+      Spar.Sem.IdPRawMetadataStore.Spec
       Spar.Sem.Logger
       Spar.Sem.Logger.TinyLog
       Spar.Sem.Now
       Spar.Sem.Now.Input
       Spar.Sem.Now.IO
+      Spar.Sem.Now.Spec
       Spar.Sem.Random
       Spar.Sem.Random.IO
       Spar.Sem.Reporter
@@ -77,6 +81,7 @@ library
       Spar.Sem.ScimExternalIdStore
       Spar.Sem.ScimExternalIdStore.Cassandra
       Spar.Sem.ScimExternalIdStore.Mem
+      Spar.Sem.ScimExternalIdStore.Spec
       Spar.Sem.ScimTokenStore
       Spar.Sem.ScimTokenStore.Cassandra
       Spar.Sem.ScimTokenStore.Mem
@@ -94,6 +99,7 @@ library
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -j -Wno-redundant-constraints -Werror
   build-depends:
       HsOpenSSL
+    , QuickCheck
     , aeson
     , aeson-qq
     , attoparsec
@@ -116,6 +122,7 @@ library
     , galley-types
     , ghc-prim
     , hscim
+    , hspec
     , http-api-data
     , http-client
     , http-media
@@ -129,6 +136,7 @@ library
     , network-uri
     , optparse-applicative
     , polysemy
+    , polysemy-check >=0.9
     , polysemy-plugin
     , raw-strings-qq
     , retry
@@ -167,6 +175,7 @@ executable spar
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -j -Wno-redundant-constraints -Werror -threaded -rtsopts -with-rtsopts=-N -with-rtsopts=-T
   build-depends:
       HsOpenSSL
+    , QuickCheck
     , aeson
     , aeson-qq
     , attoparsec
@@ -189,6 +198,7 @@ executable spar
     , galley-types
     , ghc-prim
     , hscim
+    , hspec
     , http-api-data
     , http-client
     , http-media
@@ -202,6 +212,7 @@ executable spar
     , network-uri
     , optparse-applicative
     , polysemy
+    , polysemy-check >=0.9
     , polysemy-plugin
     , raw-strings-qq
     , retry
@@ -298,6 +309,7 @@ executable spar-integration
     , network-uri
     , optparse-applicative
     , polysemy
+    , polysemy-check >=0.9
     , polysemy-plugin
     , random
     , raw-strings-qq
@@ -349,6 +361,7 @@ executable spar-migrate-data
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -j -Wno-redundant-constraints -Werror -threaded -rtsopts -with-rtsopts=-N
   build-depends:
       HsOpenSSL
+    , QuickCheck
     , aeson
     , aeson-qq
     , attoparsec
@@ -372,6 +385,7 @@ executable spar-migrate-data
     , galley-types
     , ghc-prim
     , hscim
+    , hspec
     , http-api-data
     , http-client
     , http-media
@@ -385,6 +399,7 @@ executable spar-migrate-data
     , network-uri
     , optparse-applicative
     , polysemy
+    , polysemy-check >=0.9
     , polysemy-plugin
     , raw-strings-qq
     , retry
@@ -440,6 +455,7 @@ executable spar-schema
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -j -Wno-redundant-constraints -Werror -threaded -rtsopts -with-rtsopts=-N
   build-depends:
       HsOpenSSL
+    , QuickCheck
     , aeson
     , aeson-qq
     , attoparsec
@@ -462,6 +478,7 @@ executable spar-schema
     , galley-types
     , ghc-prim
     , hscim
+    , hspec
     , http-api-data
     , http-client
     , http-media
@@ -475,6 +492,7 @@ executable spar-schema
     , network-uri
     , optparse-applicative
     , polysemy
+    , polysemy-check >=0.9
     , polysemy-plugin
     , raw-strings-qq
     , retry
diff --git a/services/spar/src/Spar/Sem/DefaultSsoCode.hs b/services/spar/src/Spar/Sem/DefaultSsoCode.hs
index 9f594c16b4f..af9a49bda4c 100644
--- a/services/spar/src/Spar/Sem/DefaultSsoCode.hs
+++ b/services/spar/src/Spar/Sem/DefaultSsoCode.hs
@@ -2,6 +2,7 @@ module Spar.Sem.DefaultSsoCode where
 
 import Imports
 import Polysemy
+import Polysemy.Check (deriveGenericK)
 import qualified SAML2.WebSSO as SAML
 
 data DefaultSsoCode m a where
@@ -12,3 +13,4 @@ data DefaultSsoCode m a where
 deriving instance Show (DefaultSsoCode m a)
 
 makeSem ''DefaultSsoCode
+deriveGenericK ''DefaultSsoCode
diff --git a/services/spar/src/Spar/Sem/DefaultSsoCode/Spec.hs b/services/spar/src/Spar/Sem/DefaultSsoCode/Spec.hs
new file mode 100644
index 00000000000..e9aac14b42a
--- /dev/null
+++ b/services/spar/src/Spar/Sem/DefaultSsoCode/Spec.hs
@@ -0,0 +1,164 @@
+{-# LANGUAGE QuantifiedConstraints #-}
+{-# OPTIONS_GHC -fplugin=Polysemy.Plugin #-}
+
+module Spar.Sem.DefaultSsoCode.Spec (propsForInterpreter) where
+
+import Imports
+import Polysemy
+import Polysemy.Check
+import SAML2.WebSSO.Types
+import qualified Spar.Sem.DefaultSsoCode as E
+import Test.Hspec
+import Test.Hspec.QuickCheck
+import Test.QuickCheck
+
+propsForInterpreter ::
+  PropConstraints r f =>
+  String ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Spec
+propsForInterpreter interpreter lower = do
+  describe interpreter $ do
+    prop "delete/delete" $ prop_deleteDelete Nothing lower
+    prop "delete/get" $ prop_deleteGet Nothing lower
+    prop "delete/store" $ prop_deleteStore Nothing lower
+    prop "get/store" $ prop_getStore Nothing lower
+    prop "store/delete" $ prop_storeDelete Nothing lower
+    prop "store/get" $ prop_storeGet Nothing lower
+    prop "store/store" $ prop_storeStore Nothing lower
+
+-- | All the constraints we need to generalize properties in this module.
+-- A regular type synonym doesn't work due to dreaded impredicative
+-- polymorphism.
+class
+  (Arbitrary IdPId, CoArbitrary IdPId, Functor f, Member E.DefaultSsoCode r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
+  PropConstraints r f
+
+instance
+  (Arbitrary IdPId, CoArbitrary IdPId, Functor f, Member E.DefaultSsoCode r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
+  PropConstraints r f
+
+prop_storeGet ::
+  PropConstraints r f =>
+  Maybe (f (Maybe IdPId) -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_storeGet =
+  prepropLaw @'[E.DefaultSsoCode] $ do
+    s <- arbitrary
+    pure $
+      simpleLaw
+        ( do
+            E.store s
+            E.get
+        )
+        ( do
+            E.store s
+            pure (Just s)
+        )
+
+prop_getStore ::
+  PropConstraints r f =>
+  Maybe (f () -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_getStore =
+  prepropLaw @'[E.DefaultSsoCode] $ do
+    pure $
+      simpleLaw
+        ( do
+            E.get >>= maybe (pure ()) E.store
+        )
+        ( do
+            pure ()
+        )
+
+prop_storeDelete ::
+  PropConstraints r f =>
+  Maybe (f () -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_storeDelete =
+  prepropLaw @'[E.DefaultSsoCode] $ do
+    s <- arbitrary
+    pure $
+      simpleLaw
+        ( do
+            E.store s
+            E.delete
+        )
+        ( do
+            E.delete
+        )
+
+prop_deleteStore ::
+  PropConstraints r f =>
+  Maybe (f () -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_deleteStore =
+  prepropLaw @'[E.DefaultSsoCode] $ do
+    s <- arbitrary
+    pure $
+      simpleLaw
+        ( do
+            E.delete
+            E.store s
+        )
+        ( do
+            E.store s
+        )
+
+prop_storeStore ::
+  PropConstraints r f =>
+  Maybe (f () -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_storeStore =
+  prepropLaw @'[E.DefaultSsoCode] $ do
+    s <- arbitrary
+    s' <- arbitrary
+    pure $
+      simpleLaw
+        ( do
+            E.store s
+            E.store s'
+        )
+        ( do
+            E.store s'
+        )
+
+prop_deleteDelete ::
+  PropConstraints r f =>
+  Maybe (f () -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_deleteDelete =
+  prepropLaw @'[E.DefaultSsoCode] $ do
+    pure $
+      simpleLaw
+        ( do
+            E.delete
+            E.delete
+        )
+        ( do
+            E.delete
+        )
+
+prop_deleteGet ::
+  PropConstraints r f =>
+  Maybe (f (Maybe IdPId) -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_deleteGet =
+  prepropLaw @'[E.DefaultSsoCode] $ do
+    pure $
+      simpleLaw
+        ( do
+            E.delete
+            E.get
+        )
+        ( do
+            E.delete
+            pure Nothing
+        )
diff --git a/services/spar/src/Spar/Sem/IdP.hs b/services/spar/src/Spar/Sem/IdP.hs
index 53e94faed03..81674e06e6e 100644
--- a/services/spar/src/Spar/Sem/IdP.hs
+++ b/services/spar/src/Spar/Sem/IdP.hs
@@ -3,6 +3,7 @@ module Spar.Sem.IdP where
 import Data.Id
 import Imports
 import Polysemy
+import Polysemy.Check (deriveGenericK)
 import qualified SAML2.WebSSO as SAML
 import qualified Wire.API.User.IdentityProvider as IP
 
@@ -41,3 +42,4 @@ deriving stock instance Show (IdP m a)
 
 -- TODO(sandy): Inline this definition --- no TH
 makeSem ''IdP
+deriveGenericK ''IdP
diff --git a/services/spar/src/Spar/Sem/IdP/Spec.hs b/services/spar/src/Spar/Sem/IdP/Spec.hs
new file mode 100644
index 00000000000..d561ebc28ff
--- /dev/null
+++ b/services/spar/src/Spar/Sem/IdP/Spec.hs
@@ -0,0 +1,315 @@
+{-# LANGUAGE DeriveDataTypeable #-}
+{-# LANGUAGE QuantifiedConstraints #-}
+{-# LANGUAGE StandaloneDeriving #-}
+{-# OPTIONS_GHC -Wno-orphans #-}
+{-# OPTIONS_GHC -fplugin=Polysemy.Plugin #-}
+
+module Spar.Sem.IdP.Spec (propsForInterpreter) where
+
+import Control.Arrow
+import Control.Lens
+import Data.Data (Data)
+import Imports
+import Polysemy
+import Polysemy.Check
+import SAML2.WebSSO.Types
+import qualified SAML2.WebSSO.Types as SAML
+import qualified Spar.Sem.IdP as E
+import Test.Hspec
+import Test.Hspec.QuickCheck
+import Test.QuickCheck
+import qualified Wire.API.User.IdentityProvider as IP
+
+deriving instance Data IdPId
+
+deriving instance Data (E.GetIdPResult IdPId)
+
+propsForInterpreter ::
+  (Member E.IdP r, PropConstraints r f) =>
+  String ->
+  (forall x. f x -> x) ->
+  (forall x. Show x => Maybe (f x -> String)) ->
+  (forall x. Sem r x -> IO (f x)) ->
+  Spec
+propsForInterpreter interpreter extract labeler lower = do
+  describe interpreter $ do
+    prop "deleteConfig/deleteConfig" $ prop_deleteDelete Nothing lower
+    prop "deleteConfig/getConfig" $ prop_deleteGet labeler lower
+    prop "getConfig/storeConfig" $ prop_getStore (Just $ show . (() <$) . extract) lower
+    prop "getConfig/getConfig" $ prop_getGet (Just $ show . ((() <$) *** (() <$)) . extract) lower
+    prop "setReplacedBy/clearReplacedBy" $ prop_setClear labeler lower
+    prop "setReplacedBy/getReplacedBy" $ prop_setGet (Just $ show . (fmap (() <$)) . extract) lower
+    prop "setReplacedBy/setReplacedBy" $ prop_setSet (Just $ show . (fmap (() <$)) . extract) lower
+    prop "storeConfig/getConfig" $ prop_storeGet (Just $ show . (() <$) . extract) lower
+    xit "storeConfig/getIdByIssuerWithoutTeam" $ property $ prop_storeGetByIssuer (Just $ constructorLabel . extract) lower
+    prop "storeConfig/storeConfig (different keys)" $ prop_storeStoreInterleave Nothing lower
+    prop "storeConfig/storeConfig (same keys)" $ prop_storeStore Nothing lower
+
+getReplacedBy :: Member E.IdP r => SAML.IdPId -> Sem r (Maybe (Maybe SAML.IdPId))
+getReplacedBy idpid = fmap (view $ SAML.idpExtraInfo . IP.wiReplacedBy) <$> E.getConfig idpid
+
+-- | All the constraints we need to generalize properties in this module.
+-- A regular type synonym doesn't work due to dreaded impredicative
+-- polymorphism.
+class
+  (Arbitrary Issuer, CoArbitrary Issuer, Arbitrary E.Replaced, Arbitrary E.Replaced, Arbitrary E.Replacing, Arbitrary IdPId, CoArbitrary IdPId, Arbitrary IP.IdP, CoArbitrary IP.IdP, CoArbitrary (E.GetIdPResult IdPId), Functor f, Member E.IdP r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
+  PropConstraints r f
+
+instance
+  (Arbitrary Issuer, CoArbitrary Issuer, Arbitrary E.Replaced, Arbitrary E.Replaced, Arbitrary E.Replacing, Arbitrary IdPId, CoArbitrary IdPId, Arbitrary IP.IdP, CoArbitrary IP.IdP, CoArbitrary (E.GetIdPResult IdPId), Functor f, Member E.IdP r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
+  PropConstraints r f
+
+prop_storeStore ::
+  PropConstraints r f =>
+  Maybe (f () -> String) ->
+  (forall x. Sem r x -> IO (f x)) ->
+  Property
+prop_storeStore =
+  prepropLaw @'[E.IdP] $ do
+    s <- arbitrary
+    s' <- arbitrary
+    pure $
+      Law
+        { lawLhs = do
+            E.storeConfig $ s & SAML.idpId .~ s' ^. SAML.idpId
+            E.storeConfig s',
+          lawRhs = do
+            E.storeConfig s',
+          lawPrelude = [],
+          lawPostlude = [E.getConfig $ s' ^. SAML.idpId]
+        }
+
+prop_storeStoreInterleave ::
+  PropConstraints r f =>
+  Maybe (f () -> String) ->
+  (forall x. Sem r x -> IO (f x)) ->
+  Property
+prop_storeStoreInterleave =
+  prepropLaw @'[E.IdP] $ do
+    s <- arbitrary
+    s' <- arbitrary
+    !_ <-
+      when (s ^. SAML.idpId == s' ^. SAML.idpId) discard
+    pure $
+      Law
+        { lawLhs = do
+            E.storeConfig s
+            E.storeConfig s',
+          lawRhs = do
+            E.storeConfig s'
+            E.storeConfig s,
+          lawPrelude = [],
+          lawPostlude = [E.getConfig $ s ^. SAML.idpId, E.getConfig $ s' ^. SAML.idpId]
+        }
+
+prop_storeGet ::
+  PropConstraints r f =>
+  Maybe (f (Maybe IP.IdP) -> String) ->
+  (forall x. Sem r x -> IO (f x)) ->
+  Property
+prop_storeGet =
+  prepropLaw @'[E.IdP] $
+    do
+      s <- arbitrary
+      pure $
+        simpleLaw
+          ( do
+              E.storeConfig s
+              E.getConfig $ s ^. idpId
+          )
+          ( do
+              E.storeConfig s
+              pure (Just s)
+          )
+
+prop_deleteGet ::
+  PropConstraints r f =>
+  Maybe (f (Maybe IP.IdP) -> String) ->
+  (forall x. Sem r x -> IO (f x)) ->
+  Property
+prop_deleteGet =
+  prepropLaw @'[E.IdP] $ do
+    s <- arbitrary
+    pure $
+      Law
+        { lawLhs = do
+            E.deleteConfig s
+            E.getConfig $ s ^. SAML.idpId,
+          lawRhs = do
+            E.deleteConfig s
+            pure Nothing,
+          lawPrelude =
+            [ E.storeConfig s
+            ],
+          lawPostlude = [] :: [Sem r ()]
+        }
+
+prop_deleteDelete ::
+  PropConstraints r f =>
+  Maybe (f () -> String) ->
+  (forall x. Sem r x -> IO (f x)) ->
+  Property
+prop_deleteDelete =
+  prepropLaw @'[E.IdP] $ do
+    s <- arbitrary
+    pure $
+      simpleLaw
+        ( do
+            E.deleteConfig s
+            E.deleteConfig s
+        )
+        ( do
+            E.deleteConfig s
+        )
+
+prop_storeGetByIssuer ::
+  PropConstraints r f =>
+  Maybe (f (E.GetIdPResult IdPId) -> String) ->
+  (forall x. Sem r x -> IO (f x)) ->
+  Property
+prop_storeGetByIssuer =
+  prepropLaw @'[E.IdP] $
+    do
+      s <- arbitrary
+      pure $
+        simpleLaw
+          ( do
+              E.storeConfig s
+              E.getIdByIssuerWithoutTeam $ s ^. idpMetadata . edIssuer
+          )
+          ( do
+              E.storeConfig s
+              -- NOT TRUE! This can also return E.GetIdPNonUnique with nonzero probability!
+              pure $ E.GetIdPFound $ s ^. idpId
+          )
+
+prop_setClear ::
+  PropConstraints r f =>
+  Maybe (f (Maybe (Maybe IdPId)) -> String) ->
+  (forall x. Sem r x -> IO (f x)) ->
+  Property
+prop_setClear =
+  prepropLaw @'[E.IdP] $
+    do
+      idp <- arbitrary
+      replaced_id <- arbitrary
+      let replaced = E.Replaced replaced_id
+      replacing <- arbitrary
+      pure $
+        Law
+          { lawLhs = do
+              E.setReplacedBy replaced replacing
+              E.clearReplacedBy replaced
+              getReplacedBy replaced_id,
+            lawRhs = do
+              E.clearReplacedBy replaced
+              getReplacedBy replaced_id,
+            lawPrelude =
+              [ E.storeConfig $ idp & SAML.idpId .~ replaced_id
+              ],
+            lawPostlude = [] @(Sem _ ())
+          }
+
+prop_getGet ::
+  forall r f.
+  PropConstraints r f =>
+  Maybe (f (Maybe IP.IdP, Maybe IP.IdP) -> String) ->
+  (forall x. Sem r x -> IO (f x)) ->
+  Property
+prop_getGet =
+  prepropLaw @'[E.IdP] $
+    do
+      idpid <- arbitrary
+      idp <- arbitrary
+      pure $
+        Law
+          { lawLhs = do
+              liftA2 (,) (E.getConfig idpid) (E.getConfig idpid),
+            lawRhs = do
+              cfg <- E.getConfig idpid
+              pure (cfg, cfg),
+            lawPrelude =
+              [ E.storeConfig $ idp & SAML.idpId .~ idpid
+              ],
+            lawPostlude = [] :: [Sem r ()]
+          }
+
+prop_getStore ::
+  PropConstraints r f =>
+  Maybe (f (Maybe IP.IdP) -> String) ->
+  (forall x. Sem r x -> IO (f x)) ->
+  Property
+prop_getStore =
+  prepropLaw @'[E.IdP] $
+    do
+      idpid <- arbitrary
+      s <- arbitrary
+      let s' = s & SAML.idpId .~ idpid
+      pure $
+        Law
+          { lawLhs = do
+              r <- E.getConfig idpid
+              maybe (pure ()) E.storeConfig r
+              pure r,
+            lawRhs = do
+              E.getConfig idpid,
+            lawPrelude =
+              [E.storeConfig s'],
+            lawPostlude =
+              [E.getConfig idpid]
+          }
+
+prop_setSet ::
+  PropConstraints r f =>
+  Maybe (f (Maybe (Maybe IdPId)) -> String) ->
+  (forall x. Sem r x -> IO (f x)) ->
+  Property
+prop_setSet =
+  prepropLaw @'[E.IdP] $
+    do
+      replaced_id <- arbitrary
+      s <- arbitrary
+      let s' = s & SAML.idpId .~ replaced_id
+      let replaced = E.Replaced replaced_id
+      replacing <- arbitrary
+      replacing' <- arbitrary
+      pure $
+        Law
+          { lawLhs = do
+              E.setReplacedBy replaced replacing
+              E.setReplacedBy replaced replacing'
+              getReplacedBy replaced_id,
+            lawRhs = do
+              E.setReplacedBy replaced replacing'
+              getReplacedBy replaced_id,
+            lawPrelude =
+              [E.storeConfig s'],
+            lawPostlude = [] @(Sem _ ())
+          }
+
+prop_setGet ::
+  PropConstraints r f =>
+  Maybe (f (Maybe (Maybe IdPId)) -> String) ->
+  (forall x. Sem r x -> IO (f x)) ->
+  Property
+prop_setGet =
+  prepropLaw @'[E.IdP] $
+    do
+      idp <- arbitrary
+      replaced_id <- arbitrary
+      let replaced = E.Replaced replaced_id
+      replacing_id <- arbitrary
+      let replacing = E.Replacing replacing_id
+      pure $
+        Law
+          { lawLhs = do
+              E.setReplacedBy replaced replacing
+              getReplacedBy replaced_id,
+            lawRhs = do
+              E.setReplacedBy replaced replacing
+              (Just replacing_id <$) <$> E.getConfig replaced_id,
+            lawPrelude =
+              [ E.storeConfig $ idp & SAML.idpId .~ replaced_id
+              ],
+            lawPostlude = [] :: [Sem r ()]
+          }
diff --git a/services/spar/src/Spar/Sem/IdPRawMetadataStore.hs b/services/spar/src/Spar/Sem/IdPRawMetadataStore.hs
index 4cee44c4c80..5b000899378 100644
--- a/services/spar/src/Spar/Sem/IdPRawMetadataStore.hs
+++ b/services/spar/src/Spar/Sem/IdPRawMetadataStore.hs
@@ -2,6 +2,7 @@ module Spar.Sem.IdPRawMetadataStore where
 
 import Imports
 import Polysemy
+import Polysemy.Check (deriveGenericK)
 import qualified SAML2.WebSSO as SAML
 
 data IdPRawMetadataStore m a where
@@ -13,3 +14,4 @@ deriving stock instance Show (IdPRawMetadataStore m a)
 
 -- TODO(sandy): Inline this definition --- no TH
 makeSem ''IdPRawMetadataStore
+deriveGenericK ''IdPRawMetadataStore
diff --git a/services/spar/src/Spar/Sem/IdPRawMetadataStore/Spec.hs b/services/spar/src/Spar/Sem/IdPRawMetadataStore/Spec.hs
new file mode 100644
index 00000000000..181aec23304
--- /dev/null
+++ b/services/spar/src/Spar/Sem/IdPRawMetadataStore/Spec.hs
@@ -0,0 +1,125 @@
+{-# LANGUAGE QuantifiedConstraints #-}
+{-# OPTIONS_GHC -fplugin=Polysemy.Plugin #-}
+
+module Spar.Sem.IdPRawMetadataStore.Spec (propsForInterpreter) where
+
+import Imports
+import Polysemy
+import Polysemy.Check
+import SAML2.WebSSO.Types (IdPId)
+import qualified Spar.Sem.IdPRawMetadataStore as E
+import Test.Hspec
+import Test.Hspec.QuickCheck
+import Test.QuickCheck
+
+class
+  (Arbitrary IdPId, CoArbitrary IdPId, Arbitrary Text, CoArbitrary Text, Functor f, Member E.IdPRawMetadataStore r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
+  PropConstraints r f
+
+instance
+  (Arbitrary IdPId, CoArbitrary IdPId, Arbitrary Text, CoArbitrary Text, Functor f, Member E.IdPRawMetadataStore r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
+  PropConstraints r f
+
+prop_storeGetRaw ::
+  PropConstraints r f =>
+  Maybe (f (Maybe Text) -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_storeGetRaw =
+  prepropLaw @'[E.IdPRawMetadataStore]
+    ( do
+        idpid <- arbitrary
+        t <- arbitrary
+        pure $
+          simpleLaw
+            ( do
+                E.store idpid t
+                E.get idpid
+            )
+            ( do
+                E.store idpid t
+                pure (Just t)
+            )
+    )
+
+prop_storeStoreRaw ::
+  PropConstraints r f =>
+  Maybe (f (Maybe Text) -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_storeStoreRaw =
+  prepropLaw @'[E.IdPRawMetadataStore]
+    ( do
+        idpid <- arbitrary
+        t1 <- arbitrary
+        t2 <- arbitrary
+        pure $
+          simpleLaw
+            ( do
+                E.store idpid t1
+                E.store idpid t2
+                E.get idpid
+            )
+            ( do
+                E.store idpid t2
+                E.get idpid
+            )
+    )
+
+prop_storeDeleteRaw ::
+  PropConstraints r f =>
+  Maybe (f (Maybe Text) -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_storeDeleteRaw =
+  prepropLaw @'[E.IdPRawMetadataStore] $
+    do
+      idpid <- arbitrary
+      t <- arbitrary
+      pure $
+        simpleLaw
+          ( do
+              E.store idpid t
+              E.delete idpid
+              E.get idpid
+          )
+          ( do
+              E.delete idpid
+              E.get idpid
+          )
+
+prop_deleteGetRaw ::
+  PropConstraints r f =>
+  Maybe (f (Maybe Text) -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_deleteGetRaw =
+  prepropLaw @'[E.IdPRawMetadataStore]
+    ( do
+        idpid <- arbitrary
+        t <- arbitrary
+        pure $
+          Law
+            { lawLhs = do
+                E.delete idpid
+                E.get idpid,
+              lawRhs = do
+                E.delete idpid
+                pure Nothing,
+              lawPrelude =
+                [ E.store idpid t
+                ],
+              lawPostlude = [] @(Sem _ ())
+            }
+    )
+
+propsForInterpreter ::
+  PropConstraints r f =>
+  (forall x. f x -> x) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Spec
+propsForInterpreter extract lower = do
+  prop "store/store" $ prop_storeStoreRaw (Just $ constructorLabel . extract) lower
+  prop "store/get" $ prop_storeGetRaw (Just $ constructorLabel . extract) lower
+  prop "store/delete" $ prop_storeDeleteRaw (Just $ constructorLabel . extract) lower
+  prop "delete/get" $ prop_deleteGetRaw (Just $ constructorLabel . extract) lower
diff --git a/services/spar/src/Spar/Sem/Now.hs b/services/spar/src/Spar/Sem/Now.hs
index f5a701b1a03..883eb8d44cf 100644
--- a/services/spar/src/Spar/Sem/Now.hs
+++ b/services/spar/src/Spar/Sem/Now.hs
@@ -2,12 +2,14 @@ module Spar.Sem.Now where
 
 import Imports
 import Polysemy
+import Polysemy.Check (deriveGenericK)
 import qualified SAML2.WebSSO as SAML
 
 data Now m a where
   Get :: Now m SAML.Time
 
 makeSem ''Now
+deriveGenericK ''Now
 
 deriving instance Show (Now m a)
 
diff --git a/services/spar/src/Spar/Sem/Now/Spec.hs b/services/spar/src/Spar/Sem/Now/Spec.hs
new file mode 100644
index 00000000000..f7fab8c9d1f
--- /dev/null
+++ b/services/spar/src/Spar/Sem/Now/Spec.hs
@@ -0,0 +1,52 @@
+{-# LANGUAGE QuantifiedConstraints #-}
+{-# OPTIONS_GHC -fplugin=Polysemy.Plugin #-}
+
+module Spar.Sem.Now.Spec (propsForInterpreter) where
+
+import Imports
+import Polysemy
+import Polysemy.Check
+import Polysemy.Input
+import qualified Spar.Sem.Now as E
+import Test.Hspec
+import Test.Hspec.QuickCheck
+import Test.QuickCheck
+
+propsForInterpreter ::
+  PropConstraints r f =>
+  String ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Spec
+propsForInterpreter interpreter lower = do
+  describe interpreter $ do
+    prop "now/now" $ prop_nowNow Nothing lower
+
+-- | All the constraints we need to generalize properties in this module.
+-- A regular type synonym doesn't work due to dreaded impredicative
+-- polymorphism.
+class
+  (Functor f, Member E.Now r, Member (Input ()) r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
+  PropConstraints r f
+
+instance
+  (Functor f, Member E.Now r, Member (Input ()) r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
+  PropConstraints r f
+
+prop_nowNow ::
+  PropConstraints r f =>
+  Maybe (f Bool -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_nowNow =
+  -- NOTE: This @Input ()@ effect is a workaround to an oversight in
+  -- @polysemy-check@. 'prepropLaw' wants to synthesize some actions to run
+  -- before and after its generators, and check their results for equality. We
+  -- can't use 'Now' as this effect, because 'E.get' won't return equivalent
+  -- results! And we can't keep it empty, because that triggers a crash in
+  -- @polysemy-check@. Thus @Input ()@, which isn't beautiful, but works fine.
+  prepropLaw @'[Input ()] $ do
+    pure $
+      simpleLaw
+        (liftA2 (<=) E.get E.get)
+        ( pure True
+        )
diff --git a/services/spar/src/Spar/Sem/ScimExternalIdStore.hs b/services/spar/src/Spar/Sem/ScimExternalIdStore.hs
index 3978108770c..717daa58b8a 100644
--- a/services/spar/src/Spar/Sem/ScimExternalIdStore.hs
+++ b/services/spar/src/Spar/Sem/ScimExternalIdStore.hs
@@ -3,6 +3,7 @@ module Spar.Sem.ScimExternalIdStore where
 import Data.Id (TeamId, UserId)
 import Imports
 import Polysemy
+import Polysemy.Check (deriveGenericK)
 import Wire.API.User.Identity (Email)
 
 data ScimExternalIdStore m a where
@@ -13,3 +14,4 @@ data ScimExternalIdStore m a where
 deriving instance Show (ScimExternalIdStore m a)
 
 makeSem ''ScimExternalIdStore
+deriveGenericK ''ScimExternalIdStore
diff --git a/services/spar/src/Spar/Sem/ScimExternalIdStore/Spec.hs b/services/spar/src/Spar/Sem/ScimExternalIdStore/Spec.hs
new file mode 100644
index 00000000000..57c2a1742e9
--- /dev/null
+++ b/services/spar/src/Spar/Sem/ScimExternalIdStore/Spec.hs
@@ -0,0 +1,183 @@
+{-# LANGUAGE QuantifiedConstraints #-}
+{-# OPTIONS_GHC -fplugin=Polysemy.Plugin #-}
+
+module Spar.Sem.ScimExternalIdStore.Spec (propsForInterpreter) where
+
+import Data.Id
+import Imports
+import Polysemy
+import Polysemy.Check
+import qualified Spar.Sem.ScimExternalIdStore as E
+import Test.Hspec
+import Test.Hspec.QuickCheck
+import Test.QuickCheck
+
+propsForInterpreter ::
+  PropConstraints r f =>
+  String ->
+  (forall a. f a -> a) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Spec
+propsForInterpreter interpreter extract lower = do
+  describe interpreter $ do
+    prop "delete/delete" $ prop_deleteDelete Nothing lower
+    prop "delete/lookup" $ prop_deleteLookup (Just $ show . (() <$) . extract) lower
+    prop "delete/insert" $ prop_deleteInsert Nothing lower
+    prop "lookup/insert" $ prop_lookupInsert Nothing lower
+    prop "insert/delete" $ prop_insertDelete Nothing lower
+    prop "insert/lookup" $ prop_insertLookup (Just $ show . (() <$) . extract) lower
+    prop "insert/insert" $ prop_insertInsert (Just $ show . (() <$) . extract) lower
+
+-- | All the constraints we need to generalize properties in this module.
+-- A regular type synonym doesn't work due to dreaded impredicative
+-- polymorphism.
+class
+  (Arbitrary UserId, CoArbitrary UserId, Functor f, Member E.ScimExternalIdStore r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
+  PropConstraints r f
+
+instance
+  (Arbitrary UserId, CoArbitrary UserId, Functor f, Member E.ScimExternalIdStore r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
+  PropConstraints r f
+
+prop_insertLookup ::
+  PropConstraints r f =>
+  Maybe (f (Maybe UserId) -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_insertLookup =
+  prepropLaw @'[E.ScimExternalIdStore] $ do
+    tid <- arbitrary
+    email <- arbitrary
+    uid <- arbitrary
+    pure $
+      simpleLaw
+        ( do
+            E.insert tid email uid
+            E.lookup tid email
+        )
+        ( do
+            E.insert tid email uid
+            pure (Just uid)
+        )
+
+prop_lookupInsert ::
+  PropConstraints r f =>
+  Maybe (f () -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_lookupInsert =
+  prepropLaw @'[E.ScimExternalIdStore] $ do
+    tid <- arbitrary
+    email <- arbitrary
+    pure $
+      simpleLaw
+        ( do
+            E.lookup tid email >>= maybe (pure ()) (E.insert tid email)
+        )
+        ( do
+            pure ()
+        )
+
+prop_insertDelete ::
+  PropConstraints r f =>
+  Maybe (f () -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_insertDelete =
+  prepropLaw @'[E.ScimExternalIdStore] $ do
+    tid <- arbitrary
+    email <- arbitrary
+    uid <- arbitrary
+    pure $
+      simpleLaw
+        ( do
+            E.insert tid email uid
+            E.delete tid email
+        )
+        ( do
+            E.delete tid email
+        )
+
+prop_deleteInsert ::
+  PropConstraints r f =>
+  Maybe (f () -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_deleteInsert =
+  prepropLaw @'[E.ScimExternalIdStore] $ do
+    tid <- arbitrary
+    email <- arbitrary
+    uid <- arbitrary
+    pure $
+      simpleLaw
+        ( do
+            E.delete tid email
+            E.insert tid email uid
+        )
+        ( do
+            E.insert tid email uid
+        )
+
+prop_insertInsert ::
+  PropConstraints r f =>
+  Maybe (f (Maybe UserId) -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_insertInsert =
+  prepropLaw @'[E.ScimExternalIdStore] $ do
+    tid <- arbitrary
+    email <- arbitrary
+    uid <- arbitrary
+    uid' <- arbitrary
+    pure $
+      simpleLaw
+        ( do
+            E.insert tid email uid
+            E.insert tid email uid'
+            E.lookup tid email
+        )
+        ( do
+            E.insert tid email uid'
+            E.lookup tid email
+        )
+
+prop_deleteDelete ::
+  PropConstraints r f =>
+  Maybe (f () -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_deleteDelete =
+  prepropLaw @'[E.ScimExternalIdStore] $ do
+    tid <- arbitrary
+    email <- arbitrary
+    pure $
+      simpleLaw
+        ( do
+            E.delete tid email
+            E.delete tid email
+        )
+        ( do
+            E.delete tid email
+        )
+
+prop_deleteLookup ::
+  PropConstraints r f =>
+  Maybe (f (Maybe UserId) -> String) ->
+  (forall a. Sem r a -> IO (f a)) ->
+  Property
+prop_deleteLookup =
+  prepropLaw @'[E.ScimExternalIdStore] $ do
+    tid <- arbitrary
+    email <- arbitrary
+    uid <- arbitrary
+    pure $
+      Law
+        { lawLhs = do
+            E.delete tid email
+            E.lookup tid email,
+          lawRhs = do
+            E.delete tid email
+            pure Nothing,
+          lawPrelude = [E.insert tid email uid],
+          lawPostlude = [] @(Sem _ ())
+        }
diff --git a/services/spar/test/Test/Spar/Sem/DefaultSsoCodeSpec.hs b/services/spar/test/Test/Spar/Sem/DefaultSsoCodeSpec.hs
index 9a638ba9907..bc55fa5e410 100644
--- a/services/spar/test/Test/Spar/Sem/DefaultSsoCodeSpec.hs
+++ b/services/spar/test/Test/Spar/Sem/DefaultSsoCodeSpec.hs
@@ -7,167 +7,11 @@ module Test.Spar.Sem.DefaultSsoCodeSpec where
 import Arbitrary ()
 import Imports
 import Polysemy
-import Polysemy.Check
-import SAML2.WebSSO.Types
-import qualified Spar.Sem.DefaultSsoCode as E
 import Spar.Sem.DefaultSsoCode.Mem
+import Spar.Sem.DefaultSsoCode.Spec
 import Test.Hspec
 import Test.Hspec.QuickCheck
-import Test.QuickCheck
-
-deriveGenericK ''E.DefaultSsoCode
-
-propsForInterpreter ::
-  PropConstraints r f =>
-  String ->
-  (forall a. Sem r a -> IO (f a)) ->
-  Spec
-propsForInterpreter interpreter lower = do
-  describe interpreter $ do
-    prop "delete/delete" $ prop_deleteDelete Nothing lower
-    prop "delete/get" $ prop_deleteGet Nothing lower
-    prop "delete/store" $ prop_deleteStore Nothing lower
-    prop "get/store" $ prop_getStore Nothing lower
-    prop "store/delete" $ prop_storeStore Nothing lower
-    prop "store/get" $ prop_storeGet Nothing lower
-    prop "store/store" $ prop_storeStore Nothing lower
 
 spec :: Spec
 spec = modifyMaxSuccess (const 1000) $ do
   propsForInterpreter "defaultSsoCodeToMem" $ pure . run . defaultSsoCodeToMem
-
--- | All the constraints we need to generalize properties in this module.
--- A regular type synonym doesn't work due to dreaded impredicative
--- polymorphism.
-class
-  (Functor f, Member E.DefaultSsoCode r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
-  PropConstraints r f
-
-instance
-  (Functor f, Member E.DefaultSsoCode r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
-  PropConstraints r f
-
-prop_storeGet ::
-  PropConstraints r f =>
-  Maybe (f (Maybe IdPId) -> String) ->
-  (forall a. Sem r a -> IO (f a)) ->
-  Property
-prop_storeGet =
-  prepropLaw @'[E.DefaultSsoCode] $ do
-    s <- arbitrary
-    pure $
-      simpleLaw
-        ( do
-            E.store s
-            E.get
-        )
-        ( do
-            E.store s
-            pure (Just s)
-        )
-
-prop_getStore ::
-  PropConstraints r f =>
-  Maybe (f () -> String) ->
-  (forall a. Sem r a -> IO (f a)) ->
-  Property
-prop_getStore =
-  prepropLaw @'[E.DefaultSsoCode] $ do
-    pure $
-      simpleLaw
-        ( do
-            E.get >>= maybe (pure ()) E.store
-        )
-        ( do
-            pure ()
-        )
-
-prop_storeDelete ::
-  PropConstraints r f =>
-  Maybe (f () -> String) ->
-  (forall a. Sem r a -> IO (f a)) ->
-  Property
-prop_storeDelete =
-  prepropLaw @'[E.DefaultSsoCode] $ do
-    s <- arbitrary
-    pure $
-      simpleLaw
-        ( do
-            E.store s
-            E.delete
-        )
-        ( do
-            E.delete
-        )
-
-prop_deleteStore ::
-  PropConstraints r f =>
-  Maybe (f () -> String) ->
-  (forall a. Sem r a -> IO (f a)) ->
-  Property
-prop_deleteStore =
-  prepropLaw @'[E.DefaultSsoCode] $ do
-    s <- arbitrary
-    pure $
-      simpleLaw
-        ( do
-            E.delete
-            E.store s
-        )
-        ( do
-            E.store s
-        )
-
-prop_storeStore ::
-  PropConstraints r f =>
-  Maybe (f () -> String) ->
-  (forall a. Sem r a -> IO (f a)) ->
-  Property
-prop_storeStore =
-  prepropLaw @'[E.DefaultSsoCode] $ do
-    s <- arbitrary
-    s' <- arbitrary
-    pure $
-      simpleLaw
-        ( do
-            E.store s
-            E.store s'
-        )
-        ( do
-            E.store s'
-        )
-
-prop_deleteDelete ::
-  PropConstraints r f =>
-  Maybe (f () -> String) ->
-  (forall a. Sem r a -> IO (f a)) ->
-  Property
-prop_deleteDelete =
-  prepropLaw @'[E.DefaultSsoCode] $ do
-    pure $
-      simpleLaw
-        ( do
-            E.delete
-            E.delete
-        )
-        ( do
-            E.delete
-        )
-
-prop_deleteGet ::
-  PropConstraints r f =>
-  Maybe (f (Maybe IdPId) -> String) ->
-  (forall a. Sem r a -> IO (f a)) ->
-  Property
-prop_deleteGet =
-  prepropLaw @'[E.DefaultSsoCode] $ do
-    pure $
-      simpleLaw
-        ( do
-            E.delete
-            E.get
-        )
-        ( do
-            E.delete
-            pure Nothing
-        )
diff --git a/services/spar/test/Test/Spar/Sem/IdPRawMetadataStoreSpec.hs b/services/spar/test/Test/Spar/Sem/IdPRawMetadataStoreSpec.hs
index 28aa64122dd..2f8ce187cc8 100644
--- a/services/spar/test/Test/Spar/Sem/IdPRawMetadataStoreSpec.hs
+++ b/services/spar/test/Test/Spar/Sem/IdPRawMetadataStoreSpec.hs
@@ -1,5 +1,3 @@
-{-# LANGUAGE QuantifiedConstraints #-}
-{-# OPTIONS_GHC -Wno-orphans #-}
 {-# OPTIONS_GHC -fplugin=Polysemy.Plugin #-}
 
 module Test.Spar.Sem.IdPRawMetadataStoreSpec where
@@ -7,130 +5,15 @@ module Test.Spar.Sem.IdPRawMetadataStoreSpec where
 import Arbitrary ()
 import Imports
 import Polysemy
-import Polysemy.Check
 import qualified Spar.Sem.IdPRawMetadataStore as E
 import Spar.Sem.IdPRawMetadataStore.Mem
+import Spar.Sem.IdPRawMetadataStore.Spec
 import Test.Hspec
 import Test.Hspec.QuickCheck
-import Test.QuickCheck
-
-deriveGenericK ''E.IdPRawMetadataStore
-
-class
-  (Functor f, Member E.IdPRawMetadataStore r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
-  PropConstraints r f
-
-instance
-  (Functor f, Member E.IdPRawMetadataStore r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
-  PropConstraints r f
-
-prop_storeGetRaw ::
-  PropConstraints r f =>
-  Maybe (f (Maybe Text) -> String) ->
-  (forall a. Sem r a -> IO (f a)) ->
-  Property
-prop_storeGetRaw =
-  prepropLaw @'[E.IdPRawMetadataStore]
-    ( do
-        idpid <- arbitrary
-        t <- arbitrary
-        pure $
-          simpleLaw
-            ( do
-                E.store idpid t
-                E.get idpid
-            )
-            ( do
-                E.store idpid t
-                pure (Just t)
-            )
-    )
-
-prop_storeStoreRaw ::
-  PropConstraints r f =>
-  Maybe (f (Maybe Text) -> String) ->
-  (forall a. Sem r a -> IO (f a)) ->
-  Property
-prop_storeStoreRaw =
-  prepropLaw @'[E.IdPRawMetadataStore]
-    ( do
-        idpid <- arbitrary
-        t1 <- arbitrary
-        t2 <- arbitrary
-        pure $
-          simpleLaw
-            ( do
-                E.store idpid t1
-                E.store idpid t2
-                E.get idpid
-            )
-            ( do
-                E.store idpid t2
-                E.get idpid
-            )
-    )
-
-prop_storeDeleteRaw ::
-  PropConstraints r f =>
-  Maybe (f (Maybe Text) -> String) ->
-  (forall a. Sem r a -> IO (f a)) ->
-  Property
-prop_storeDeleteRaw =
-  prepropLaw @'[E.IdPRawMetadataStore] $
-    do
-      idpid <- arbitrary
-      t <- arbitrary
-      pure $
-        simpleLaw
-          ( do
-              E.store idpid t
-              E.delete idpid
-              E.get idpid
-          )
-          ( do
-              E.delete idpid
-              E.get idpid
-          )
-
-prop_deleteGetRaw ::
-  PropConstraints r f =>
-  Maybe (f (Maybe Text) -> String) ->
-  (forall a. Sem r a -> IO (f a)) ->
-  Property
-prop_deleteGetRaw =
-  prepropLaw @'[E.IdPRawMetadataStore]
-    ( do
-        idpid <- arbitrary
-        t <- arbitrary
-        pure $
-          Law
-            { lawLhs = do
-                E.delete idpid
-                E.get idpid,
-              lawRhs = do
-                E.delete idpid
-                pure Nothing,
-              lawPrelude =
-                [ E.store idpid t
-                ],
-              lawPostlude = [] @(Sem _ ())
-            }
-    )
 
 testInterpreter :: Sem '[E.IdPRawMetadataStore] a -> IO (RawState, a)
 testInterpreter = pure . run . idpRawMetadataStoreToMem
 
-propsForInterpreter ::
-  PropConstraints r f =>
-  (forall x. f x -> x) ->
-  (forall a. Sem r a -> IO (f a)) ->
-  Spec
-propsForInterpreter extract lower = do
-  prop "store/store" $ prop_storeStoreRaw (Just $ constructorLabel . extract) lower
-  prop "store/get" $ prop_storeGetRaw (Just $ constructorLabel . extract) lower
-  prop "store/delete" $ prop_storeDeleteRaw (Just $ constructorLabel . extract) lower
-  prop "delete/get" $ prop_deleteGetRaw (Just $ constructorLabel . extract) lower
-
 spec :: Spec
 spec = modifyMaxSuccess (const 1000) $ do
   propsForInterpreter snd testInterpreter
diff --git a/services/spar/test/Test/Spar/Sem/IdPSpec.hs b/services/spar/test/Test/Spar/Sem/IdPSpec.hs
index ef1eba1f471..43232daa1b2 100644
--- a/services/spar/test/Test/Spar/Sem/IdPSpec.hs
+++ b/services/spar/test/Test/Spar/Sem/IdPSpec.hs
@@ -7,316 +7,13 @@
 module Test.Spar.Sem.IdPSpec where
 
 import Arbitrary ()
-import Control.Arrow
-import Control.Lens
-import Data.Data (Data)
 import Imports
 import Polysemy
-import Polysemy.Check
-import SAML2.WebSSO.Types
-import qualified SAML2.WebSSO.Types as SAML
-import qualified Spar.Sem.IdP as E
 import Spar.Sem.IdP.Mem
+import Spar.Sem.IdP.Spec
 import Test.Hspec
 import Test.Hspec.QuickCheck
-import Test.QuickCheck
-import qualified Wire.API.User.IdentityProvider as IP
-
-deriveGenericK ''E.IdP
-
-deriving instance Data (E.GetIdPResult IdPId)
-
-deriving instance Data (IdPId)
-
-propsForInterpreter ::
-  (Member E.IdP r, PropConstraints r f) =>
-  String ->
-  (forall x. f x -> x) ->
-  (forall x. Show x => Maybe (f x -> String)) ->
-  (forall x. Sem r x -> IO (f x)) ->
-  Spec
-propsForInterpreter interpreter extract labeler lower = do
-  describe interpreter $ do
-    prop "deleteConfig/deleteConfig" $ prop_deleteDelete Nothing lower
-    prop "deleteConfig/getConfig" $ prop_deleteGet labeler lower
-    prop "getConfig/storeConfig" $ prop_getStore (Just $ show . (() <$) . extract) lower
-    prop "getConfig/getConfig" $ prop_getGet (Just $ show . ((() <$) *** (() <$)) . extract) lower
-    prop "setReplacedBy/clearReplacedBy" $ prop_setClear labeler lower
-    prop "setReplacedBy/getReplacedBy" $ prop_setGet (Just $ show . (fmap (() <$)) . extract) lower
-    prop "setReplacedBy/setReplacedBy" $ prop_setSet (Just $ show . (fmap (() <$)) . extract) lower
-    prop "storeConfig/getConfig" $ prop_storeGet (Just $ show . (() <$) . extract) lower
-    prop "storeConfig/getIdByIssuerWithoutTeam" $ prop_storeGetByIssuer (Just $ constructorLabel . extract) lower
-    prop "storeConfig/storeConfig (different keys)" $ prop_storeStoreInterleave Nothing lower
-    prop "storeConfig/storeConfig (same keys)" $ prop_storeStore Nothing lower
 
 spec :: Spec
 spec = modifyMaxSuccess (const 1000) $ do
   propsForInterpreter "idPToMem" snd (Just $ show . snd) $ pure . run . idPToMem
-
-getReplacedBy :: Member E.IdP r => SAML.IdPId -> Sem r (Maybe (Maybe SAML.IdPId))
-getReplacedBy idpid = fmap (view $ SAML.idpExtraInfo . IP.wiReplacedBy) <$> E.getConfig idpid
-
--- | All the constraints we need to generalize properties in this module.
--- A regular type synonym doesn't work due to dreaded impredicative
--- polymorphism.
-class
-  (Functor f, Member E.IdP r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
-  PropConstraints r f
-
-instance
-  (Functor f, Member E.IdP r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
-  PropConstraints r f
-
-prop_storeStore ::
-  PropConstraints r f =>
-  Maybe (f () -> String) ->
-  (forall x. Sem r x -> IO (f x)) ->
-  Property
-prop_storeStore =
-  prepropLaw @'[E.IdP] $ do
-    s <- arbitrary
-    s' <- arbitrary
-    pure $
-      Law
-        { lawLhs = do
-            E.storeConfig $ s & SAML.idpId .~ s' ^. SAML.idpId
-            E.storeConfig s',
-          lawRhs = do
-            E.storeConfig s',
-          lawPrelude = [],
-          lawPostlude = [E.getConfig $ s' ^. SAML.idpId]
-        }
-
-prop_storeStoreInterleave ::
-  PropConstraints r f =>
-  Maybe (f () -> String) ->
-  (forall x. Sem r x -> IO (f x)) ->
-  Property
-prop_storeStoreInterleave =
-  prepropLaw @'[E.IdP] $ do
-    s <- arbitrary
-    s' <- arbitrary
-    !_ <-
-      when (s ^. SAML.idpId == s' ^. SAML.idpId) discard
-    pure $
-      Law
-        { lawLhs = do
-            E.storeConfig s
-            E.storeConfig s',
-          lawRhs = do
-            E.storeConfig s'
-            E.storeConfig s,
-          lawPrelude = [],
-          lawPostlude = [E.getConfig $ s ^. SAML.idpId, E.getConfig $ s' ^. SAML.idpId]
-        }
-
-prop_storeGet ::
-  PropConstraints r f =>
-  Maybe (f (Maybe IP.IdP) -> String) ->
-  (forall x. Sem r x -> IO (f x)) ->
-  Property
-prop_storeGet =
-  prepropLaw @'[E.IdP] $
-    do
-      s <- arbitrary
-      pure $
-        simpleLaw
-          ( do
-              E.storeConfig s
-              E.getConfig $ s ^. idpId
-          )
-          ( do
-              E.storeConfig s
-              pure (Just s)
-          )
-
-prop_deleteGet ::
-  PropConstraints r f =>
-  Maybe (f (Maybe IP.IdP) -> String) ->
-  (forall x. Sem r x -> IO (f x)) ->
-  Property
-prop_deleteGet =
-  prepropLaw @'[E.IdP] $ do
-    s <- arbitrary
-    pure $
-      Law
-        { lawLhs = do
-            E.deleteConfig s
-            E.getConfig $ s ^. SAML.idpId,
-          lawRhs = do
-            E.deleteConfig s
-            pure Nothing,
-          lawPrelude =
-            [ E.storeConfig s
-            ],
-          lawPostlude = [] :: [Sem r ()]
-        }
-
-prop_deleteDelete ::
-  PropConstraints r f =>
-  Maybe (f () -> String) ->
-  (forall x. Sem r x -> IO (f x)) ->
-  Property
-prop_deleteDelete =
-  prepropLaw @'[E.IdP] $ do
-    s <- arbitrary
-    pure $
-      simpleLaw
-        ( do
-            E.deleteConfig s
-            E.deleteConfig s
-        )
-        ( do
-            E.deleteConfig s
-        )
-
-prop_storeGetByIssuer ::
-  PropConstraints r f =>
-  Maybe (f (E.GetIdPResult IdPId) -> String) ->
-  (forall x. Sem r x -> IO (f x)) ->
-  Property
-prop_storeGetByIssuer =
-  prepropLaw @'[E.IdP] $
-    do
-      s <- arbitrary
-      pure $
-        simpleLaw
-          ( do
-              E.storeConfig s
-              E.getIdByIssuerWithoutTeam $ s ^. idpMetadata . edIssuer
-          )
-          ( do
-              E.storeConfig s
-              pure $ E.GetIdPFound $ s ^. idpId
-          )
-
-prop_setClear ::
-  PropConstraints r f =>
-  Maybe (f (Maybe (Maybe IdPId)) -> String) ->
-  (forall x. Sem r x -> IO (f x)) ->
-  Property
-prop_setClear =
-  prepropLaw @'[E.IdP] $
-    do
-      idp <- arbitrary
-      replaced_id <- arbitrary
-      let replaced = E.Replaced replaced_id
-      replacing <- arbitrary
-      pure $
-        Law
-          { lawLhs = do
-              E.setReplacedBy replaced replacing
-              E.clearReplacedBy replaced
-              getReplacedBy replaced_id,
-            lawRhs = do
-              E.clearReplacedBy replaced
-              getReplacedBy replaced_id,
-            lawPrelude =
-              [ E.storeConfig $ idp & SAML.idpId .~ replaced_id
-              ],
-            lawPostlude = [] @(Sem _ ())
-          }
-
-prop_getGet ::
-  forall r f.
-  PropConstraints r f =>
-  Maybe (f (Maybe IP.IdP, Maybe IP.IdP) -> String) ->
-  (forall x. Sem r x -> IO (f x)) ->
-  Property
-prop_getGet =
-  prepropLaw @'[E.IdP] $
-    do
-      idpid <- arbitrary
-      idp <- arbitrary
-      pure $
-        Law
-          { lawLhs = do
-              liftA2 (,) (E.getConfig idpid) (E.getConfig idpid),
-            lawRhs = do
-              cfg <- E.getConfig idpid
-              pure (cfg, cfg),
-            lawPrelude =
-              [ E.storeConfig $ idp & SAML.idpId .~ idpid
-              ],
-            lawPostlude = [] :: [Sem r ()]
-          }
-
-prop_getStore ::
-  PropConstraints r f =>
-  Maybe (f (Maybe IP.IdP) -> String) ->
-  (forall x. Sem r x -> IO (f x)) ->
-  Property
-prop_getStore =
-  prepropLaw @'[E.IdP] $
-    do
-      idpid <- arbitrary
-      s <- arbitrary
-      let s' = s & SAML.idpId .~ idpid
-      pure $
-        Law
-          { lawLhs = do
-              r <- E.getConfig idpid
-              maybe (pure ()) E.storeConfig r
-              pure r,
-            lawRhs = do
-              E.getConfig idpid,
-            lawPrelude =
-              [E.storeConfig s'],
-            lawPostlude =
-              [E.getConfig idpid]
-          }
-
-prop_setSet ::
-  PropConstraints r f =>
-  Maybe (f (Maybe (Maybe IdPId)) -> String) ->
-  (forall x. Sem r x -> IO (f x)) ->
-  Property
-prop_setSet =
-  prepropLaw @'[E.IdP] $
-    do
-      replaced_id <- arbitrary
-      s <- arbitrary
-      let s' = s & SAML.idpId .~ replaced_id
-      let replaced = E.Replaced replaced_id
-      replacing <- arbitrary
-      replacing' <- arbitrary
-      pure $
-        Law
-          { lawLhs = do
-              E.setReplacedBy replaced replacing
-              E.setReplacedBy replaced replacing'
-              getReplacedBy replaced_id,
-            lawRhs = do
-              E.setReplacedBy replaced replacing'
-              getReplacedBy replaced_id,
-            lawPrelude =
-              [E.storeConfig s'],
-            lawPostlude = [] @(Sem _ ())
-          }
-
-prop_setGet ::
-  PropConstraints r f =>
-  Maybe (f (Maybe (Maybe IdPId)) -> String) ->
-  (forall x. Sem r x -> IO (f x)) ->
-  Property
-prop_setGet =
-  prepropLaw @'[E.IdP] $
-    do
-      idp <- arbitrary
-      replaced_id <- arbitrary
-      let replaced = E.Replaced replaced_id
-      replacing_id <- arbitrary
-      let replacing = E.Replacing replacing_id
-      pure $
-        Law
-          { lawLhs = do
-              E.setReplacedBy replaced replacing
-              getReplacedBy replaced_id,
-            lawRhs = do
-              E.setReplacedBy replaced replacing
-              (Just replacing_id <$) <$> E.getConfig replaced_id,
-            lawPrelude =
-              [ E.storeConfig $ idp & SAML.idpId .~ replaced_id
-              ],
-            lawPostlude = [] :: [Sem r ()]
-          }
diff --git a/services/spar/test/Test/Spar/Sem/NowSpec.hs b/services/spar/test/Test/Spar/Sem/NowSpec.hs
index 0c9fdacadfb..b31dae84d42 100644
--- a/services/spar/test/Test/Spar/Sem/NowSpec.hs
+++ b/services/spar/test/Test/Spar/Sem/NowSpec.hs
@@ -9,26 +9,13 @@ import Data.Time
 import Data.Time.Calendar.Julian
 import Imports
 import Polysemy
-import Polysemy.Check
 import Polysemy.Input
 import SAML2.WebSSO.Types
-import qualified Spar.Sem.Now as E
 import Spar.Sem.Now.IO
 import Spar.Sem.Now.Input
+import Spar.Sem.Now.Spec
 import Test.Hspec
 import Test.Hspec.QuickCheck
-import Test.QuickCheck
-
-deriveGenericK ''E.Now
-
-propsForInterpreter ::
-  PropConstraints r f =>
-  String ->
-  (forall a. Sem r a -> IO (f a)) ->
-  Spec
-propsForInterpreter interpreter lower = do
-  describe interpreter $ do
-    prop "now/now" $ prop_nowNow Nothing lower
 
 someTime :: Time
 someTime = Time (UTCTime (fromJulianYearAndDay 1990 209) (secondsToDiffTime 0))
@@ -38,33 +25,3 @@ spec = do
   modifyMaxSuccess (const 1000) $ do
     propsForInterpreter "nowToIO" $ fmap Identity . runM . nowToIO . runInputConst ()
     propsForInterpreter "nowToInput" $ pure . Identity . run . runInputConst someTime . nowToInput . runInputConst ()
-
--- | All the constraints we need to generalize properties in this module.
--- A regular type synonym doesn't work due to dreaded impredicative
--- polymorphism.
-class
-  (Functor f, Member E.Now r, Member (Input ()) r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
-  PropConstraints r f
-
-instance
-  (Functor f, Member E.Now r, Member (Input ()) r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
-  PropConstraints r f
-
-prop_nowNow ::
-  PropConstraints r f =>
-  Maybe (f Bool -> String) ->
-  (forall a. Sem r a -> IO (f a)) ->
-  Property
-prop_nowNow =
-  -- NOTE: This @Input ()@ effect is a workaround to an oversight in
-  -- @polysemy-check@. 'prepropLaw' wants to synthesize some actions to run
-  -- before and after its generators, and check their results for equality. We
-  -- can't use 'Now' as this effect, because 'E.get' won't return equivalent
-  -- results! And we can't keep it empty, because that triggers a crash in
-  -- @polysemy-check@. Thus @Input ()@, which isn't beautiful, but works fine.
-  prepropLaw @'[Input ()] $ do
-    pure $
-      simpleLaw
-        (liftA2 (<=) E.get E.get)
-        ( pure True
-        )
diff --git a/services/spar/test/Test/Spar/Sem/ScimExternalIdStoreSpec.hs b/services/spar/test/Test/Spar/Sem/ScimExternalIdStoreSpec.hs
index e6ccad58a4a..964eb9a74f6 100644
--- a/services/spar/test/Test/Spar/Sem/ScimExternalIdStoreSpec.hs
+++ b/services/spar/test/Test/Spar/Sem/ScimExternalIdStoreSpec.hs
@@ -1,192 +1,15 @@
-{-# LANGUAGE QuantifiedConstraints #-}
-{-# OPTIONS_GHC -Wno-orphans #-}
 {-# OPTIONS_GHC -fplugin=Polysemy.Plugin #-}
 
 module Test.Spar.Sem.ScimExternalIdStoreSpec where
 
 import Arbitrary ()
-import Data.Id
 import Imports
 import Polysemy
-import Polysemy.Check
-import qualified Spar.Sem.ScimExternalIdStore as E
 import Spar.Sem.ScimExternalIdStore.Mem
+import Spar.Sem.ScimExternalIdStore.Spec
 import Test.Hspec
 import Test.Hspec.QuickCheck
-import Test.QuickCheck
-
-deriveGenericK ''E.ScimExternalIdStore
-
-propsForInterpreter ::
-  PropConstraints r f =>
-  String ->
-  (forall a. f a -> a) ->
-  (forall a. Sem r a -> IO (f a)) ->
-  Spec
-propsForInterpreter interpreter extract lower = do
-  describe interpreter $ do
-    prop "delete/delete" $ prop_deleteDelete Nothing lower
-    prop "delete/lookup" $ prop_deleteLookup (Just $ show . (() <$) . extract) lower
-    prop "delete/insert" $ prop_deleteInsert Nothing lower
-    prop "lookup/insert" $ prop_lookupInsert Nothing lower
-    prop "insert/delete" $ prop_insertDelete Nothing lower
-    prop "insert/lookup" $ prop_insertLookup (Just $ show . (() <$) . extract) lower
-    prop "insert/insert" $ prop_insertInsert (Just $ show . (() <$) . extract) lower
 
 spec :: Spec
 spec = modifyMaxSuccess (const 1000) $ do
   propsForInterpreter "scimExternalIdStoreToMem" snd $ pure . run . scimExternalIdStoreToMem
-
--- | All the constraints we need to generalize properties in this module.
--- A regular type synonym doesn't work due to dreaded impredicative
--- polymorphism.
-class
-  (Functor f, Member E.ScimExternalIdStore r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
-  PropConstraints r f
-
-instance
-  (Functor f, Member E.ScimExternalIdStore r, forall z. Show z => Show (f z), forall z. Eq z => Eq (f z)) =>
-  PropConstraints r f
-
-prop_insertLookup ::
-  PropConstraints r f =>
-  Maybe (f (Maybe UserId) -> String) ->
-  (forall a. Sem r a -> IO (f a)) ->
-  Property
-prop_insertLookup =
-  prepropLaw @'[E.ScimExternalIdStore] $ do
-    tid <- arbitrary
-    email <- arbitrary
-    uid <- arbitrary
-    pure $
-      simpleLaw
-        ( do
-            E.insert tid email uid
-            E.lookup tid email
-        )
-        ( do
-            E.insert tid email uid
-            pure (Just uid)
-        )
-
-prop_lookupInsert ::
-  PropConstraints r f =>
-  Maybe (f () -> String) ->
-  (forall a. Sem r a -> IO (f a)) ->
-  Property
-prop_lookupInsert =
-  prepropLaw @'[E.ScimExternalIdStore] $ do
-    tid <- arbitrary
-    email <- arbitrary
-    pure $
-      simpleLaw
-        ( do
-            E.lookup tid email >>= maybe (pure ()) (E.insert tid email)
-        )
-        ( do
-            pure ()
-        )
-
-prop_insertDelete ::
-  PropConstraints r f =>
-  Maybe (f () -> String) ->
-  (forall a. Sem r a -> IO (f a)) ->
-  Property
-prop_insertDelete =
-  prepropLaw @'[E.ScimExternalIdStore] $ do
-    tid <- arbitrary
-    email <- arbitrary
-    uid <- arbitrary
-    pure $
-      simpleLaw
-        ( do
-            E.insert tid email uid
-            E.delete tid email
-        )
-        ( do
-            E.delete tid email
-        )
-
-prop_deleteInsert ::
-  PropConstraints r f =>
-  Maybe (f () -> String) ->
-  (forall a. Sem r a -> IO (f a)) ->
-  Property
-prop_deleteInsert =
-  prepropLaw @'[E.ScimExternalIdStore] $ do
-    tid <- arbitrary
-    email <- arbitrary
-    uid <- arbitrary
-    pure $
-      simpleLaw
-        ( do
-            E.delete tid email
-            E.insert tid email uid
-        )
-        ( do
-            E.insert tid email uid
-        )
-
-prop_insertInsert ::
-  PropConstraints r f =>
-  Maybe (f (Maybe UserId) -> String) ->
-  (forall a. Sem r a -> IO (f a)) ->
-  Property
-prop_insertInsert =
-  prepropLaw @'[E.ScimExternalIdStore] $ do
-    tid <- arbitrary
-    email <- arbitrary
-    uid <- arbitrary
-    uid' <- arbitrary
-    pure $
-      simpleLaw
-        ( do
-            E.insert tid email uid
-            E.insert tid email uid'
-            E.lookup tid email
-        )
-        ( do
-            E.insert tid email uid'
-            E.lookup tid email
-        )
-
-prop_deleteDelete ::
-  PropConstraints r f =>
-  Maybe (f () -> String) ->
-  (forall a. Sem r a -> IO (f a)) ->
-  Property
-prop_deleteDelete =
-  prepropLaw @'[E.ScimExternalIdStore] $ do
-    tid <- arbitrary
-    email <- arbitrary
-    pure $
-      simpleLaw
-        ( do
-            E.delete tid email
-            E.delete tid email
-        )
-        ( do
-            E.delete tid email
-        )
-
-prop_deleteLookup ::
-  PropConstraints r f =>
-  Maybe (f (Maybe UserId) -> String) ->
-  (forall a. Sem r a -> IO (f a)) ->
-  Property
-prop_deleteLookup =
-  prepropLaw @'[E.ScimExternalIdStore] $ do
-    tid <- arbitrary
-    email <- arbitrary
-    uid <- arbitrary
-    pure $
-      Law
-        { lawLhs = do
-            E.delete tid email
-            E.lookup tid email,
-          lawRhs = do
-            E.delete tid email
-            pure Nothing,
-          lawPrelude = [E.insert tid email uid],
-          lawPostlude = [] @(Sem _ ())
-        }

From 1e6843a9ef9730956adbdb575bdbeaff4ec3d054 Mon Sep 17 00:00:00 2001
From: Paolo Capriotti <paolo@capriotti.io>
Date: Wed, 22 Dec 2021 08:30:26 +0100
Subject: [PATCH 26/74] Fix cabal install script (#2007)

* Fix cabal install script

The script should create the `dist` directory, if it does not exist.
---
 changelog.d/5-internal/fix-cabal-install | 1 +
 hack/bin/cabal-install-artefacts.sh      | 2 ++
 2 files changed, 3 insertions(+)
 create mode 100644 changelog.d/5-internal/fix-cabal-install

diff --git a/changelog.d/5-internal/fix-cabal-install b/changelog.d/5-internal/fix-cabal-install
new file mode 100644
index 00000000000..f09f1ea0b38
--- /dev/null
+++ b/changelog.d/5-internal/fix-cabal-install
@@ -0,0 +1 @@
+The `cabal-install-artefacts.sh` script now creates the `dist` directory if it does not exist
diff --git a/hack/bin/cabal-install-artefacts.sh b/hack/bin/cabal-install-artefacts.sh
index c80ef37de18..5307fd30931 100755
--- a/hack/bin/cabal-install-artefacts.sh
+++ b/hack/bin/cabal-install-artefacts.sh
@@ -6,6 +6,8 @@ TOP_LEVEL="$(cd "$DIR/../.." && pwd)"
 
 DIST="$TOP_LEVEL/dist"
 
+mkdir -p "$DIST"
+
 if [[ "$1" == "all" ]]; then
   pattern='*'
 else

From b6311910b6f14cad3abdf3a168ee873caab591ec Mon Sep 17 00:00:00 2001
From: Paolo Capriotti <paolo@capriotti.io>
Date: Thu, 16 Dec 2021 11:59:42 +0100
Subject: [PATCH 27/74] Add streaming support to MultiVerb

Note that streaming is not yet supported for the client. Therefore, when
a client for an endpoint that includes a streaming response is invoked,
and a streaming response is received, the client will just fail.
---
 .../wire-api/src/Wire/API/ErrorDescription.hs |  22 +-
 .../wire-api/src/Wire/API/Routes/MultiVerb.hs | 194 +++++++++++++-----
 2 files changed, 152 insertions(+), 64 deletions(-)

diff --git a/libs/wire-api/src/Wire/API/ErrorDescription.hs b/libs/wire-api/src/Wire/API/ErrorDescription.hs
index 3b3b194ca03..30f7ebf71ba 100644
--- a/libs/wire-api/src/Wire/API/ErrorDescription.hs
+++ b/libs/wire-api/src/Wire/API/ErrorDescription.hs
@@ -2,7 +2,6 @@ module Wire.API.ErrorDescription where
 
 import Control.Lens (at, (%~), (.~), (<>~), (?~))
 import qualified Data.Aeson as A
-import qualified Data.ByteString.Lazy as LBS
 import Data.Metrics.Servant
 import Data.SOP (I (..), NP (..), NS (..))
 import Data.Schema
@@ -13,10 +12,12 @@ import qualified Data.Text as Text
 import GHC.TypeLits (KnownSymbol, Symbol, natVal, symbolVal)
 import GHC.TypeNats (Nat)
 import Imports hiding (head)
+import Network.HTTP.Types as HTTP
 import Servant hiding (Handler, addHeader, contentType, respond)
 import Servant.API (contentType)
 import Servant.API.ContentTypes (AllMimeRender, AllMimeUnrender)
 import Servant.API.Status (KnownStatus, statusVal)
+import Servant.Client.Core
 import Servant.Swagger.Internal
 import Wire.API.Routes.MultiVerb
 
@@ -113,6 +114,7 @@ instance
   IsResponse cs (ErrorDescription s label desc)
   where
   type ResponseStatus (ErrorDescription s label desc) = s
+  type ResponseBody (ErrorDescription s label desc) = LByteString
 
   responseRender = responseRender @cs @(RespondWithErrorDescription s label desc)
   responseUnrender = responseUnrender @cs @(RespondWithErrorDescription s label desc)
@@ -160,18 +162,20 @@ instance
   IsResponse cs (EmptyErrorForLegacyReasons s desc)
   where
   type ResponseStatus (EmptyErrorForLegacyReasons s desc) = s
+  type ResponseBody (EmptyErrorForLegacyReasons s desc) = ()
 
   responseRender _ () =
     pure $
-      roAddContentType
+      addContentType
         (contentType (Proxy @PlainText))
-        (RenderOutput (statusVal (Proxy @s)) mempty mempty)
-
-  responseUnrender _ output =
-    guard
-      ( LBS.null (roBody output)
-          && roStatus output == statusVal (Proxy @s)
-      )
+        Response
+          { responseStatusCode = statusVal (Proxy @s),
+            responseHeaders = mempty,
+            responseBody = (),
+            responseHttpVersion = HTTP.http11
+          }
+
+  responseUnrender _ output = guard (responseStatusCode output == statusVal (Proxy @s))
 
 instance
   (KnownStatus s, KnownSymbol desc) =>
diff --git a/libs/wire-api/src/Wire/API/Routes/MultiVerb.hs b/libs/wire-api/src/Wire/API/Routes/MultiVerb.hs
index 3c500512c88..0ce00f642ec 100644
--- a/libs/wire-api/src/Wire/API/Routes/MultiVerb.hs
+++ b/libs/wire-api/src/Wire/API/Routes/MultiVerb.hs
@@ -1,3 +1,6 @@
+{-# LANGUAGE ApplicativeDo #-}
+{-# LANGUAGE RecordWildCards #-}
+
 -- This file is part of the Wire Server implementation.
 --
 -- Copyright (C) 2021 Wire Swiss GmbH <opensource@wire.com>
@@ -20,6 +23,7 @@ module Wire.API.Routes.MultiVerb
     MultiVerb,
     Respond,
     RespondEmpty,
+    RespondStreaming,
     WithHeaders,
     DescHeader,
     AsHeaders (..),
@@ -33,16 +37,15 @@ module Wire.API.Routes.MultiVerb
     IsResponse (..),
     IsSwaggerResponse (..),
     combineResponseSwagger,
-    RenderOutput (..),
-    roAddContentType,
-    roResponse,
     ResponseTypes,
     IsResponseList (..),
+    addContentType,
   )
 where
 
 import Control.Applicative
-import Control.Lens hiding (Context)
+import Control.Lens hiding (Context, (<|))
+import Data.ByteString.Builder
 import qualified Data.ByteString.Lazy as LBS
 import qualified Data.CaseInsensitive as CI
 import Data.Containers.ListUtils
@@ -51,16 +54,18 @@ import qualified Data.HashMap.Strict.InsOrd as InsOrdHashMap
 import Data.Metrics.Servant
 import Data.Proxy
 import Data.SOP
+import Data.Sequence (Seq, (<|), pattern (:<|))
 import qualified Data.Sequence as Seq
 import qualified Data.Swagger as S
 import qualified Data.Swagger.Declare as S
 import qualified Data.Text as Text
 import qualified Data.Text.Encoding as Text
+import Data.Typeable
 import GHC.TypeLits
 import Generics.SOP as GSOP
 import Imports
 import qualified Network.HTTP.Media as M
-import Network.HTTP.Types (HeaderName, hContentType)
+import Network.HTTP.Types (hContentType)
 import qualified Network.HTTP.Types as HTTP
 import Network.HTTP.Types.Status
 import qualified Network.Wai as Wai
@@ -73,6 +78,7 @@ import Servant.Server
 import Servant.Server.Internal
 import Servant.Swagger as S
 import Servant.Swagger.Internal as S
+import Servant.Types.SourceT
 
 type Declare = S.Declare (S.Definitions S.Schema)
 
@@ -86,11 +92,11 @@ data Respond (s :: Nat) (desc :: Symbol) (a :: *)
 -- Includes status code and description.
 data RespondEmpty (s :: Nat) (desc :: Symbol)
 
-data RenderOutput = RenderOutput
-  { roStatus :: Status,
-    roBody :: LByteString,
-    roHeaders :: [(HeaderName, ByteString)]
-  }
+-- | A type to describe a streaming 'MultiVerb' response.
+--
+-- Includes status code, description, framing strategy and content type. Note
+-- that the handler return type is hardcoded to be 'SourceIO ByteString'.
+data RespondStreaming (s :: Nat) (desc :: Symbol) (framing :: *) (ct :: *)
 
 -- | The result of parsing a response as a union alternative of type 'a'.
 --
@@ -132,16 +138,18 @@ class IsSwaggerResponse a where
 
 type family ResponseType a :: *
 
-class IsResponse cs a where
+class IsWaiBody (ResponseBody a) => IsResponse cs a where
   type ResponseStatus a :: Nat
+  type ResponseBody a :: *
 
-  responseRender :: AcceptHeader -> ResponseType a -> Maybe RenderOutput
-  responseUnrender :: M.MediaType -> RenderOutput -> UnrenderResult (ResponseType a)
+  responseRender :: AcceptHeader -> ResponseType a -> Maybe (ResponseF (ResponseBody a))
+  responseUnrender :: M.MediaType -> ResponseF (ResponseBody a) -> UnrenderResult (ResponseType a)
 
 type instance ResponseType (Respond s desc a) = a
 
 instance (AllMimeRender cs a, AllMimeUnrender cs a, KnownStatus s) => IsResponse cs (Respond s desc a) where
   type ResponseStatus (Respond s desc a) = s
+  type ResponseBody (Respond s desc a) = LByteString
 
   -- Note: here it seems like we are rendering for all possible content types,
   -- only to choose the correct one afterwards. However, render results besides the
@@ -150,21 +158,22 @@ instance (AllMimeRender cs a, AllMimeUnrender cs a, KnownStatus s) => IsResponse
   responseRender (AcceptHeader acc) x =
     M.mapAcceptMedia (map (uncurry mkRenderOutput) (allMimeRender (Proxy @cs) x)) acc
     where
-      mkRenderOutput :: M.MediaType -> LByteString -> (M.MediaType, RenderOutput)
+      mkRenderOutput :: M.MediaType -> LByteString -> (M.MediaType, Response)
       mkRenderOutput c body =
-        (c,) . roAddContentType c $
-          RenderOutput
-            { roStatus = statusVal (Proxy @s),
-              roBody = body,
-              roHeaders = []
+        (c,) . addContentType c $
+          Response
+            { responseStatusCode = statusVal (Proxy @s),
+              responseBody = body,
+              responseHeaders = mempty,
+              responseHttpVersion = HTTP.http11
             }
 
   responseUnrender c output = do
-    guard (roStatus output == statusVal (Proxy @s))
+    guard (responseStatusCode output == statusVal (Proxy @s))
     let results = allMimeUnrender (Proxy @cs)
     case lookup c results of
       Nothing -> empty
-      Just f -> either UnrenderError UnrenderSuccess (f (roBody output))
+      Just f -> either UnrenderError UnrenderSuccess (f (responseBody output))
 
 instance
   (KnownStatus s, KnownSymbol desc, S.ToSchema a) =>
@@ -181,20 +190,19 @@ type instance ResponseType (RespondEmpty s desc) = ()
 
 instance KnownStatus s => IsResponse cs (RespondEmpty s desc) where
   type ResponseStatus (RespondEmpty s desc) = s
+  type ResponseBody (RespondEmpty s desc) = ()
 
   responseRender _ _ =
-    Just
-      RenderOutput
-        { roStatus = statusVal (Proxy @s),
-          roBody = mempty,
-          roHeaders = []
+    Just $
+      Response
+        { responseStatusCode = statusVal (Proxy @s),
+          responseBody = (),
+          responseHeaders = mempty,
+          responseHttpVersion = HTTP.http11
         }
 
   responseUnrender _ output =
-    guard
-      ( roStatus output == statusVal (Proxy @s)
-          && LBS.null (roBody output)
-      )
+    guard (responseStatusCode output == statusVal (Proxy @s))
 
 instance (KnownStatus s, KnownSymbol desc) => IsSwaggerResponse (RespondEmpty s desc) where
   responseSwagger =
@@ -202,6 +210,33 @@ instance (KnownStatus s, KnownSymbol desc) => IsSwaggerResponse (RespondEmpty s
       mempty
         & S.description .~ Text.pack (symbolVal (Proxy @desc))
 
+type instance ResponseType (RespondStreaming s desc framing ct) = SourceIO ByteString
+
+instance
+  (Accept ct, KnownStatus s) =>
+  IsResponse cs (RespondStreaming s desc framing ct)
+  where
+  type ResponseStatus (RespondStreaming s desc framing ct) = s
+  type ResponseBody (RespondStreaming s desc framing ct) = SourceIO ByteString
+  responseRender _ x =
+    pure . addContentType (contentType (Proxy @ct)) $
+      Response
+        { responseStatusCode = statusVal (Proxy @s),
+          responseBody = x,
+          responseHeaders = mempty,
+          responseHttpVersion = HTTP.http11
+        }
+
+  responseUnrender _ resp = do
+    guard (responseStatusCode resp == statusVal (Proxy @s))
+    pure $ responseBody resp
+
+instance (KnownStatus s, KnownSymbol desc) => IsSwaggerResponse (RespondStreaming s desc framing ct) where
+  responseSwagger =
+    pure $
+      mempty
+        & S.description .~ Text.pack (symbolVal (Proxy @desc))
+
 -- | This type adds response headers to a 'MultiVerb' response.
 --
 -- Type variables:
@@ -225,7 +260,7 @@ data DescHeader (name :: Symbol) (desc :: Symbol) (a :: *)
 
 class ServantHeaders hs xs | hs -> xs where
   constructHeaders :: NP I xs -> [HTTP.Header]
-  extractHeaders :: [HTTP.Header] -> Maybe (NP I xs)
+  extractHeaders :: Seq HTTP.Header -> Maybe (NP I xs)
 
 instance ServantHeaders '[] '[] where
   constructHeaders Nil = []
@@ -251,12 +286,14 @@ instance
     (headerName @name, toHeader x) :
     constructHeaders @hs xs
 
+  -- FUTUREWORK: should we concatenate all the matching headers instead of just
+  -- taking the first one?
   extractHeaders hs = do
     let name = headerName @name
-        (hs0, hs1) = partition (\(h, _) -> h == name) hs
+        (hs0, hs1) = Seq.partition (\(h, _) -> h == name) hs
     x <- case hs0 of
-      [] -> empty
-      ((_, h) : _) -> either (const empty) pure (parseHeader h)
+      Seq.Empty -> empty
+      ((_, h) :<| _) -> either (const empty) pure (parseHeader h)
     xs <- extractHeaders @hs hs1
     pure (I x :* xs)
 
@@ -286,15 +323,19 @@ instance
   IsResponse cs (WithHeaders hs a r)
   where
   type ResponseStatus (WithHeaders hs a r) = ResponseStatus r
+  type ResponseBody (WithHeaders hs a r) = ResponseBody r
 
   responseRender acc x = fmap addHeaders $ responseRender @cs @r acc y
     where
       (hs, y) = toHeaders @xs x
-      addHeaders r = r {roHeaders = roHeaders r ++ constructHeaders @hs hs}
+      addHeaders r =
+        r
+          { responseHeaders = responseHeaders r <> Seq.fromList (constructHeaders @hs hs)
+          }
 
   responseUnrender c output = do
     x <- responseUnrender @cs @r c output
-    case extractHeaders @hs (roHeaders output) of
+    case extractHeaders @hs (responseHeaders output) of
       Nothing -> UnrenderError "Failed to parse headers"
       Just hs -> pure $ fromHeaders @xs (hs, x)
 
@@ -315,8 +356,8 @@ type family ResponseTypes (as :: [*]) where
   ResponseTypes (a ': as) = ResponseType a ': ResponseTypes as
 
 class IsResponseList cs as where
-  responseListRender :: AcceptHeader -> Union (ResponseTypes as) -> Maybe RenderOutput
-  responseListUnrender :: M.MediaType -> RenderOutput -> UnrenderResult (Union (ResponseTypes as))
+  responseListRender :: AcceptHeader -> Union (ResponseTypes as) -> Maybe SomeResponse
+  responseListUnrender :: M.MediaType -> SomeResponse -> UnrenderResult (Union (ResponseTypes as))
 
   responseListStatuses :: [Status]
 
@@ -335,11 +376,11 @@ instance
   ) =>
   IsResponseList cs (a ': as)
   where
-  responseListRender acc (Z (I x)) = responseRender @cs @a acc x
+  responseListRender acc (Z (I x)) = fmap SomeResponse (responseRender @cs @a acc x)
   responseListRender acc (S x) = responseListRender @cs @as acc x
 
   responseListUnrender c output =
-    Z . I <$> responseUnrender @cs @a c output
+    Z . I <$> (responseUnrender @cs @a c =<< fromSomeResponse output)
       <|> S <$> responseListUnrender @cs @as c output
 
   responseListStatuses = statusVal (Proxy @(ResponseStatus a)) : responseListStatuses @cs @as
@@ -580,11 +621,56 @@ instance
       cs = allMime (Proxy @cs)
       (defs, responses) = S.runDeclare (responseListSwagger @as) mempty
 
-roResponse :: RenderOutput -> Wai.Response
-roResponse ro = Wai.responseLBS (roStatus ro) (roHeaders ro) (roBody ro)
+class Typeable a => IsWaiBody a where
+  responseToWai :: ResponseF a -> Wai.Response
+
+instance IsWaiBody LByteString where
+  responseToWai r =
+    Wai.responseLBS
+      (responseStatusCode r)
+      (toList (responseHeaders r))
+      (responseBody r)
+
+instance IsWaiBody () where
+  responseToWai r =
+    Wai.responseLBS
+      (responseStatusCode r)
+      (toList (responseHeaders r))
+      mempty
+
+instance IsWaiBody (SourceIO ByteString) where
+  responseToWai r =
+    Wai.responseStream
+      (responseStatusCode r)
+      (toList (responseHeaders r))
+      $ \output flush -> do
+        foreach
+          (const (pure ()))
+          (\chunk -> output (byteString chunk) *> flush)
+          (responseBody r)
+
+data SomeResponse = forall a. IsWaiBody a => SomeResponse (ResponseF a)
+
+addContentType :: M.MediaType -> ResponseF a -> ResponseF a
+addContentType c r = r {responseHeaders = (hContentType, M.renderHeader c) <| responseHeaders r}
 
-roAddContentType :: M.MediaType -> RenderOutput -> RenderOutput
-roAddContentType c ro = ro {roHeaders = (hContentType, M.renderHeader c) : roHeaders ro}
+setEmptyBody :: SomeResponse -> SomeResponse
+setEmptyBody (SomeResponse r) = SomeResponse (go r)
+  where
+    go :: ResponseF a -> ResponseF LByteString
+    go Response {..} = Response {responseBody = mempty, ..}
+
+someResponseToWai :: SomeResponse -> Wai.Response
+someResponseToWai (SomeResponse r) = responseToWai r
+
+fromSomeResponse :: (Alternative m, Typeable a) => SomeResponse -> m (ResponseF a)
+fromSomeResponse (SomeResponse Response {..}) = do
+  body <- maybe empty pure $ cast responseBody
+  pure $
+    Response
+      { responseBody = body,
+        ..
+      }
 
 instance
   (AllMime cs, IsResponseList cs as, AsUnion as r, ReflectMethod method) =>
@@ -607,12 +693,11 @@ instance
             `addAcceptCheck` acceptCheck (Proxy @cs) acc
     runAction action' env req k $ \output -> do
       let mresp = responseListRender @cs @as acc (toUnion @as output)
-      resp' <- case mresp of
+      someResponseToWai <$> case mresp of
         Nothing -> FailFatal err406
         Just resp
-          | allowedMethodHead method req -> pure $ resp {roBody = mempty}
+          | allowedMethodHead method req -> pure (setEmptyBody resp)
           | otherwise -> pure resp
-      pure (roResponse resp')
     where
       method = reflectMethod (Proxy @method)
 
@@ -647,16 +732,15 @@ instance
           }
 
     c <- getResponseContentType response
-    let output =
-          RenderOutput
-            { roBody = responseBody response,
-              roHeaders = toList (responseHeaders response),
-              roStatus = responseStatusCode response
-            }
-
     unless (any (M.matches c) accept) $ do
       throwClientError $ UnsupportedContentType c response
-    case responseListUnrender @cs @as c output of
+
+    -- FUTUREWORK: support streaming
+    let sresp =
+          if LBS.null (responseBody response)
+            then SomeResponse response {responseBody = ()}
+            else SomeResponse response
+    case responseListUnrender @cs @as c sresp of
       StatusMismatch -> throwClientError (DecodeFailure "Status mismatch" response)
       UnrenderError e -> throwClientError (DecodeFailure (Text.pack e) response)
       UnrenderSuccess x -> pure (fromUnion @as x)

From 3e4d728dc11a77f82154919ceeca33c35606d20d Mon Sep 17 00:00:00 2001
From: Paolo Capriotti <paolo@capriotti.io>
Date: Thu, 16 Dec 2021 13:19:18 +0100
Subject: [PATCH 28/74] Implement qualified asset download endpoint

---
 libs/wire-api/src/Wire/API/Asset.hs           | 45 +++++++++++++++
 .../src/Wire/API/Routes/Public/Cargohold.hs   | 57 ++++++++++++-------
 services/cargohold/cargohold.cabal            |  3 +-
 .../cargohold/src/CargoHold/API/Public.hs     | 18 +++++-
 services/cargohold/src/CargoHold/API/Util.hs  | 27 +++++++++
 5 files changed, 127 insertions(+), 23 deletions(-)
 create mode 100644 services/cargohold/src/CargoHold/API/Util.hs

diff --git a/libs/wire-api/src/Wire/API/Asset.hs b/libs/wire-api/src/Wire/API/Asset.hs
index 94522eba44e..e2a3e4de056 100644
--- a/libs/wire-api/src/Wire/API/Asset.hs
+++ b/libs/wire-api/src/Wire/API/Asset.hs
@@ -1,3 +1,5 @@
+{-# LANGUAGE GeneralizedNewtypeDeriving #-}
+
 -- This file is part of the Wire Server implementation.
 --
 -- Copyright (C) 2020 Wire Swiss GmbH <opensource@wire.com>
@@ -17,7 +19,50 @@
 
 module Wire.API.Asset
   ( module V3,
+    AssetLocation (..),
+    LocalOrRemoteAsset (..),
   )
 where
 
+import Data.SOP
+import qualified Data.Swagger as Swagger
+import GHC.TypeLits
+import Imports
+import Servant
 import Wire.API.Asset.V3 as V3
+import Wire.API.ErrorDescription
+import Wire.API.Routes.MultiVerb
+
+newtype AssetLocation = AssetLocation {getAssetLocation :: Text}
+  deriving newtype
+    ( ToHttpApiData,
+      FromHttpApiData,
+      Swagger.ToParamSchema
+    )
+
+instance AsHeaders '[AssetLocation] Asset (Asset, AssetLocation) where
+  toHeaders (asset, loc) = (I loc :* Nil, asset)
+  fromHeaders (I loc :* Nil, asset) = (asset, loc)
+
+-- | An asset as returned by the download API: if the asset is local, only a
+-- URL is returned, and if it is remote the content of the asset is streamed.
+data LocalOrRemoteAsset
+  = LocalAsset AssetLocation
+  | RemoteAsset (SourceIO ByteString)
+
+instance
+  ( ResponseType r0 ~ ErrorDescription code label desc,
+    ResponseType r1 ~ AssetLocation,
+    ResponseType r2 ~ SourceIO ByteString,
+    KnownSymbol desc
+  ) =>
+  AsUnion '[r0, r1, r2] (Maybe LocalOrRemoteAsset)
+  where
+  toUnion Nothing = Z (I mkErrorDescription)
+  toUnion (Just (LocalAsset loc)) = S (Z (I loc))
+  toUnion (Just (RemoteAsset asset)) = S (S (Z (I asset)))
+
+  fromUnion (Z (I _)) = Nothing
+  fromUnion (S (Z (I loc))) = Just (LocalAsset loc)
+  fromUnion (S (S (Z (I asset)))) = Just (RemoteAsset asset)
+  fromUnion (S (S (S x))) = case x of
diff --git a/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs b/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs
index f73dc764a2a..d21207b702f 100644
--- a/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs
+++ b/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs
@@ -33,6 +33,7 @@ import Wire.API.ErrorDescription
 import Wire.API.Routes.AssetBody
 import Wire.API.Routes.MultiVerb
 import Wire.API.Routes.Public
+import Wire.API.Routes.QualifiedCapture
 
 data PrincipalTag = UserPrincipalTag | BotPrincipalTag | ProviderPrincipalTag
   deriving (Eq, Show)
@@ -61,27 +62,24 @@ instance HasServer (ApplyPrincipalPath tag api) ctx => HasServer (tag :> api) ct
 instance RoutesToPaths (ApplyPrincipalPath tag api) => RoutesToPaths (tag :> api) where
   getRoutes = getRoutes @(ApplyPrincipalPath tag api)
 
-newtype AssetLocation = AssetLocation {getAssetLocation :: Text}
-  deriving newtype
-    ( ToHttpApiData,
-      FromHttpApiData,
-      Swagger.ToParamSchema
-    )
+type AssetRedirect =
+  WithHeaders
+    '[DescHeader "Location" "Asset location" AssetLocation]
+    AssetLocation
+    (RespondEmpty 302 "Asset found")
 
-instance AsHeaders '[AssetLocation] Asset (Asset, AssetLocation) where
-  toHeaders (asset, loc) = (I loc :* Nil, asset)
-  fromHeaders (I loc :* Nil, asset) = (asset, loc)
+type AssetStreaming =
+  RespondStreaming
+    200
+    "Asset returned directly with content type `application/octet-stream`"
+    NoFraming
+    OctetStream
 
 type GetAsset =
   MultiVerb
     'GET
     '[JSON]
-    '[ AssetNotFound,
-       WithHeaders
-         '[DescHeader "Location" "Asset location" AssetLocation]
-         AssetLocation
-         (RespondEmpty 302 "Asset found")
-     ]
+    '[AssetNotFound, AssetRedirect]
     (Maybe AssetLocation)
 
 type ServantAPI =
@@ -108,13 +106,14 @@ type ServantAPI =
                   '[RespondEmpty 200 "Asset token deleted"]
                   ()
          )
-    :<|> BaseAPI 'UserPrincipalTag
-    :<|> BaseAPI 'BotPrincipalTag
-    :<|> BaseAPI 'ProviderPrincipalTag
+    :<|> BaseAPIv3 'UserPrincipalTag
+    :<|> BaseAPIv3 'BotPrincipalTag
+    :<|> BaseAPIv3 'ProviderPrincipalTag
+    :<|> QualifiedAPI
     :<|> LegacyAPI
     :<|> InternalAPI
 
-type BaseAPI (tag :: PrincipalTag) =
+type BaseAPIv3 (tag :: PrincipalTag) =
   ( Summary "Upload an asset"
       :> CanThrow AssetTooLarge
       :> CanThrow InvalidLength
@@ -149,6 +148,26 @@ type BaseAPI (tag :: PrincipalTag) =
                   ()
          )
 
+type QualifiedAPI =
+  ( Summary "Download an asset"
+      :> Description
+           "**Note**: local assets result in a redirect, \
+           \while remote assets are streamed directly."
+      :> ZLocalUser
+      :> "assets"
+      :> "v4"
+      :> QualifiedCapture "key" AssetKey
+      :> Header "Asset-Token" AssetToken
+      :> MultiVerb
+           'GET
+           '[JSON]
+           '[ AssetNotFound,
+              AssetRedirect,
+              AssetStreaming
+            ]
+           (Maybe LocalOrRemoteAsset)
+  )
+
 type LegacyAPI =
   ( ZLocalUser
       :> "assets"
diff --git a/services/cargohold/cargohold.cabal b/services/cargohold/cargohold.cabal
index 778c25303a1..d254bedd2a6 100644
--- a/services/cargohold/cargohold.cabal
+++ b/services/cargohold/cargohold.cabal
@@ -4,7 +4,7 @@ cabal-version: 1.12
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: b8ba2ed196939ab2b035138d3e428c84b88ff77ff219741840e47ae8dac9de0a
+-- hash: cd2a03f62587d5c87a0542f95b7124ff553f9ac6ec40dd1ea1cbfe2fd8ace570
 
 name:           cargohold
 version:        1.5.0
@@ -29,6 +29,7 @@ library
       CargoHold.API.Federation
       CargoHold.API.Legacy
       CargoHold.API.Public
+      CargoHold.API.Util
       CargoHold.API.V3
       CargoHold.App
       CargoHold.AWS
diff --git a/services/cargohold/src/CargoHold/API/Public.hs b/services/cargohold/src/CargoHold/API/Public.hs
index 1c588ce99b0..913ec34c83c 100644
--- a/services/cargohold/src/CargoHold/API/Public.hs
+++ b/services/cargohold/src/CargoHold/API/Public.hs
@@ -18,6 +18,7 @@
 module CargoHold.API.Public (servantSitemap) where
 
 import qualified CargoHold.API.Legacy as LegacyAPI
+import CargoHold.API.Util
 import qualified CargoHold.API.V3 as V3
 import CargoHold.App
 import qualified CargoHold.Types.V3 as V3
@@ -41,16 +42,18 @@ servantSitemap =
     :<|> userAPI
     :<|> botAPI
     :<|> providerAPI
+    :<|> qualifiedAPI
     :<|> legacyAPI
     :<|> internalAPI
   where
-    userAPI :: forall tag. tag ~ 'UserPrincipalTag => ServerT (BaseAPI tag) Handler
+    userAPI :: forall tag. tag ~ 'UserPrincipalTag => ServerT (BaseAPIv3 tag) Handler
     userAPI = uploadAssetV3 @tag :<|> downloadAssetV3 @tag :<|> deleteAssetV3 @tag
-    botAPI :: forall tag. tag ~ 'BotPrincipalTag => ServerT (BaseAPI tag) Handler
+    botAPI :: forall tag. tag ~ 'BotPrincipalTag => ServerT (BaseAPIv3 tag) Handler
     botAPI = uploadAssetV3 @tag :<|> downloadAssetV3 @tag :<|> deleteAssetV3 @tag
-    providerAPI :: forall tag. tag ~ 'ProviderPrincipalTag => ServerT (BaseAPI tag) Handler
+    providerAPI :: forall tag. tag ~ 'ProviderPrincipalTag => ServerT (BaseAPIv3 tag) Handler
     providerAPI = uploadAssetV3 @tag :<|> downloadAssetV3 @tag :<|> deleteAssetV3 @tag
     legacyAPI = legacyDownloadPlain :<|> legacyDownloadPlain :<|> legacyDownloadOtr
+    qualifiedAPI = downloadAssetV4
     internalAPI = pure ()
 
 class MakePrincipal (tag :: PrincipalTag) (id :: *) | id -> tag, tag -> id where
@@ -91,6 +94,15 @@ downloadAssetV3 usr key tok1 tok2 = do
   url <- V3.download (mkPrincipal usr) key (tok1 <|> tok2)
   pure $ fmap (AssetLocation . Text.decodeUtf8With Text.lenientDecode . serializeURIRef') url
 
+downloadAssetV4 ::
+  Local UserId ->
+  Qualified AssetKey ->
+  Maybe AssetToken ->
+  Handler (Maybe LocalOrRemoteAsset)
+downloadAssetV4 usr qkey tok = do
+  key <- tUnqualified <$> ensureLocal usr qkey
+  LocalAsset <$$> downloadAssetV3 usr key tok
+
 deleteAssetV3 :: MakePrincipal tag id => id -> AssetKey -> Handler ()
 deleteAssetV3 usr key = V3.delete (mkPrincipal usr) key
 
diff --git a/services/cargohold/src/CargoHold/API/Util.hs b/services/cargohold/src/CargoHold/API/Util.hs
new file mode 100644
index 00000000000..d52407b847b
--- /dev/null
+++ b/services/cargohold/src/CargoHold/API/Util.hs
@@ -0,0 +1,27 @@
+-- This file is part of the Wire Server implementation.
+--
+-- Copyright (C) 2021 Wire Swiss GmbH <opensource@wire.com>
+--
+-- This program is free software: you can redistribute it and/or modify it under
+-- the terms of the GNU Affero General Public License as published by the Free
+-- Software Foundation, either version 3 of the License, or (at your option) any
+-- later version.
+--
+-- This program is distributed in the hope that it will be useful, but WITHOUT
+-- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+-- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+-- details.
+--
+-- You should have received a copy of the GNU Affero General Public License along
+-- with this program. If not, see <https://www.gnu.org/licenses/>.
+
+module CargoHold.API.Util (ensureLocal) where
+
+import CargoHold.App
+import Control.Error
+import Data.Qualified
+import Imports
+import Wire.API.Federation.Error
+
+ensureLocal :: Local x -> Qualified a -> Handler (Local a)
+ensureLocal loc = foldQualified loc pure (\_ -> throwE federationNotImplemented)

From 254ec8f3aeaad4c7e005f6a666500f0393ed55ee Mon Sep 17 00:00:00 2001
From: Paolo Capriotti <paolo@capriotti.io>
Date: Thu, 16 Dec 2021 14:00:01 +0100
Subject: [PATCH 29/74] Add qualified asset delete endpoint

---
 .../src/Wire/API/Routes/Public/Cargohold.hs        | 14 ++++++++++++++
 services/cargohold/src/CargoHold/API/Public.hs     |  7 ++++++-
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs b/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs
index d21207b702f..8d14b8a57c6 100644
--- a/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs
+++ b/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs
@@ -167,6 +167,20 @@ type QualifiedAPI =
             ]
            (Maybe LocalOrRemoteAsset)
   )
+    :<|> ( Summary "Delete an asset"
+             :> Description "**Note**: only local assets can be deleted."
+             :> CanThrow AssetNotFound
+             :> CanThrow Unauthorised
+             :> ZLocalUser
+             :> "assets"
+             :> "v4"
+             :> QualifiedCapture "key" AssetKey
+             :> MultiVerb
+                  'DELETE
+                  '[JSON]
+                  '[RespondEmpty 200 "Asset deleted"]
+                  ()
+         )
 
 type LegacyAPI =
   ( ZLocalUser
diff --git a/services/cargohold/src/CargoHold/API/Public.hs b/services/cargohold/src/CargoHold/API/Public.hs
index 913ec34c83c..212e6b84ef7 100644
--- a/services/cargohold/src/CargoHold/API/Public.hs
+++ b/services/cargohold/src/CargoHold/API/Public.hs
@@ -53,7 +53,7 @@ servantSitemap =
     providerAPI :: forall tag. tag ~ 'ProviderPrincipalTag => ServerT (BaseAPIv3 tag) Handler
     providerAPI = uploadAssetV3 @tag :<|> downloadAssetV3 @tag :<|> deleteAssetV3 @tag
     legacyAPI = legacyDownloadPlain :<|> legacyDownloadPlain :<|> legacyDownloadOtr
-    qualifiedAPI = downloadAssetV4
+    qualifiedAPI = downloadAssetV4 :<|> deleteAssetV4
     internalAPI = pure ()
 
 class MakePrincipal (tag :: PrincipalTag) (id :: *) | id -> tag, tag -> id where
@@ -106,6 +106,11 @@ downloadAssetV4 usr qkey tok = do
 deleteAssetV3 :: MakePrincipal tag id => id -> AssetKey -> Handler ()
 deleteAssetV3 usr key = V3.delete (mkPrincipal usr) key
 
+deleteAssetV4 :: Local UserId -> Qualified AssetKey -> Handler ()
+deleteAssetV4 usr qkey = do
+  key <- tUnqualified <$> ensureLocal usr qkey
+  V3.delete (mkPrincipal usr) key
+
 renewTokenV3 :: Local UserId -> AssetKey -> Handler NewAssetToken
 renewTokenV3 (tUnqualified -> usr) key =
   NewAssetToken <$> V3.renewToken (V3.UserPrincipal usr) key

From 5bfeed7877fc941275eee62ff0fd8162afdff0b3 Mon Sep 17 00:00:00 2001
From: Paolo Capriotti <paolo@capriotti.io>
Date: Thu, 16 Dec 2021 15:25:12 +0100
Subject: [PATCH 30/74] Add domain field to newly created assets

---
 .../cargohold-types/src/CargoHold/Types/V3.hs |   2 +-
 libs/wire-api/src/Wire/API/Asset.hs           | 333 ++++++++++++++++-
 libs/wire-api/src/Wire/API/Asset/V3.hs        | 341 ------------------
 libs/wire-api/wire-api.cabal                  |   3 +-
 .../brig/test/integration/API/User/Account.hs |  13 +-
 .../brig/test/integration/API/User/Util.hs    |  10 +-
 .../cargohold/src/CargoHold/API/Public.hs     |  10 +-
 services/cargohold/src/CargoHold/API/Util.hs  |  18 +-
 services/cargohold/src/CargoHold/API/V3.hs    |   9 +-
 services/cargohold/src/CargoHold/App.hs       |   8 +-
 services/cargohold/test/integration/API/V3.hs |  13 +-
 11 files changed, 390 insertions(+), 370 deletions(-)
 delete mode 100644 libs/wire-api/src/Wire/API/Asset/V3.hs

diff --git a/libs/cargohold-types/src/CargoHold/Types/V3.hs b/libs/cargohold-types/src/CargoHold/Types/V3.hs
index b4c3f2531ef..e0b8ee3fe1f 100644
--- a/libs/cargohold-types/src/CargoHold/Types/V3.hs
+++ b/libs/cargohold-types/src/CargoHold/Types/V3.hs
@@ -58,7 +58,7 @@ where
 import Data.ByteString.Conversion
 import Data.Id
 import Imports
-import Wire.API.Asset.V3
+import Wire.API.Asset
 
 --------------------------------------------------------------------------------
 -- Principal
diff --git a/libs/wire-api/src/Wire/API/Asset.hs b/libs/wire-api/src/Wire/API/Asset.hs
index e2a3e4de056..1e142ffe86c 100644
--- a/libs/wire-api/src/Wire/API/Asset.hs
+++ b/libs/wire-api/src/Wire/API/Asset.hs
@@ -1,4 +1,6 @@
 {-# LANGUAGE GeneralizedNewtypeDeriving #-}
+{-# LANGUAGE StrictData #-}
+{-# LANGUAGE TemplateHaskell #-}
 
 -- This file is part of the Wire Server implementation.
 --
@@ -18,21 +20,345 @@
 -- with this program. If not, see <https://www.gnu.org/licenses/>.
 
 module Wire.API.Asset
-  ( module V3,
+  ( -- * Asset
+    Asset,
+    Asset',
+    mkAsset,
+    assetKey,
+    assetExpires,
+    assetToken,
+
+    -- * AssetKey
+    AssetKey (..),
+
+    -- * AssetToken
+    AssetToken (..),
+    NewAssetToken (..),
+
+    -- * Body Construction
+    buildMultipartBody,
+    beginMultipartBody,
+    endMultipartBody,
+
+    -- * AssetHeaders
+    AssetHeaders (..),
+    mkHeaders,
+
+    -- * AssetSettings
+    AssetSettings,
+    defAssetSettings,
+    setAssetPublic,
+    setAssetRetention,
+    AssetRetention (..),
+    assetRetentionSeconds,
+    assetExpiringSeconds,
+    assetVolatileSeconds,
+    retentionToTextRep,
+
+    -- * Streaming
     AssetLocation (..),
     LocalOrRemoteAsset (..),
   )
 where
 
+import qualified Codec.MIME.Type as MIME
+import Control.Lens (makeLenses, (?~))
+import Data.Aeson (FromJSON (..), ToJSON (..))
+import qualified Data.Aeson as Aeson
+import Data.Attoparsec.ByteString.Char8 hiding (I)
+import Data.Bifunctor
+import Data.ByteString.Builder
+import Data.ByteString.Conversion
+import qualified Data.ByteString.Lazy as LBS
+import Data.Id
+import Data.Json.Util (UTCTimeMillis (fromUTCTimeMillis), toUTCTimeMillis)
+import Data.Proxy
+import Data.Qualified
 import Data.SOP
+import Data.Schema
+import qualified Data.Swagger as S
 import qualified Data.Swagger as Swagger
+import qualified Data.Text as T
+import Data.Text.Ascii (AsciiBase64Url)
+import qualified Data.Text.Encoding as T
+import Data.Time.Clock
+import qualified Data.UUID as UUID
 import GHC.TypeLits
 import Imports
 import Servant
-import Wire.API.Asset.V3 as V3
+import Wire.API.Arbitrary (Arbitrary (..), GenericUniform (..))
 import Wire.API.ErrorDescription
 import Wire.API.Routes.MultiVerb
 
+--------------------------------------------------------------------------------
+-- Asset
+
+type Asset = Asset' (Qualified AssetKey)
+
+-- | A newly uploaded asset.
+data Asset' key = Asset
+  { _assetKey :: key,
+    _assetExpires :: Maybe UTCTime,
+    _assetToken :: Maybe AssetToken
+  }
+  deriving stock (Eq, Show, Generic, Functor)
+
+deriving via Schema (Asset' key) instance ToSchema (Asset' key) => (ToJSON (Asset' key))
+
+deriving via Schema (Asset' key) instance ToSchema (Asset' key) => (FromJSON (Asset' key))
+
+deriving via Schema (Asset' key) instance ToSchema (Asset' key) => (S.ToSchema (Asset' key))
+
+-- Generate expiry time with millisecond precision
+instance Arbitrary key => Arbitrary (Asset' key) where
+  arbitrary = Asset <$> arbitrary <*> (fmap milli <$> arbitrary) <*> arbitrary
+    where
+      milli = fromUTCTimeMillis . toUTCTimeMillis
+
+mkAsset :: key -> Asset' key
+mkAsset k = Asset k Nothing Nothing
+
+instance ToSchema Asset where
+  schema =
+    object "Asset" $
+      Asset
+        <$> _assetKey
+          .= ( Qualified
+                 <$> qUnqualified .= field "key" schema
+                 <*> qDomain .= field "domain" schema
+             )
+        <*> (fmap toUTCTimeMillis . _assetExpires)
+          .= maybe_
+            (optField "expires" (fromUTCTimeMillis <$> schema))
+        <*> _assetToken .= maybe_ (optField "token" schema)
+
+--------------------------------------------------------------------------------
+-- AssetKey
+
+-- | A unique, versioned asset identifier.
+-- Note: Can be turned into a sum type with additional constructors
+-- for future versions.
+data AssetKey = AssetKeyV3 AssetId AssetRetention
+  deriving stock (Eq, Show, Generic)
+  deriving (Arbitrary) via (GenericUniform AssetKey)
+  deriving (FromJSON, ToJSON, S.ToSchema) via (Schema AssetKey)
+
+instance FromByteString AssetKey where
+  parser = do
+    v <- decimal
+    _ <- char '-'
+    case (v :: Word) of
+      3 -> parseV3
+      _ -> fail $ "Invalid asset version: " ++ show v
+    where
+      -- AssetKeyV3 ::= Retention "-" uuid
+      -- Retention  ::= decimal
+      parseV3 = do
+        r <- parser
+        _ <- char '-'
+        b <- takeByteString
+        case UUID.fromASCIIBytes b of
+          Just i -> return $! AssetKeyV3 (Id i) r
+          Nothing -> fail "Invalid asset ID"
+
+instance ToByteString AssetKey where
+  builder (AssetKeyV3 i r) =
+    builder '3'
+      <> builder '-'
+      <> builder r
+      <> builder '-'
+      <> builder (UUID.toASCIIBytes (toUUID i))
+
+instance ToSchema AssetKey where
+  schema =
+    (T.decodeUtf8 . toByteString')
+      .= parsedText "AssetKey" (runParser parser . T.encodeUtf8)
+        & doc' . S.schema . S.example ?~ toJSON ("3-1-47de4580-ae51-4650-acbb-d10c028cb0ac" :: Text)
+
+instance S.ToParamSchema AssetKey where
+  toParamSchema _ = S.toParamSchema (Proxy @Text)
+
+instance FromHttpApiData AssetKey where
+  parseUrlPiece = first T.pack . runParser parser . T.encodeUtf8
+
+--------------------------------------------------------------------------------
+-- AssetToken
+
+-- | Asset tokens are bearer tokens that grant access to a single asset.
+newtype AssetToken = AssetToken {assetTokenAscii :: AsciiBase64Url}
+  deriving stock (Eq, Show)
+  deriving newtype (FromByteString, ToByteString, Arbitrary)
+  deriving (FromJSON, ToJSON) via (Schema AssetToken)
+
+instance ToSchema AssetToken where
+  schema =
+    AssetToken <$> assetTokenAscii
+      .= schema
+        & doc' . S.schema . S.example ?~ toJSON ("aGVsbG8" :: Text)
+
+instance S.ToParamSchema AssetToken where
+  toParamSchema _ = S.toParamSchema (Proxy @Text)
+
+instance FromHttpApiData AssetToken where
+  parseUrlPiece = first T.pack . runParser parser . T.encodeUtf8
+
+-- | A newly (re)generated token for an existing asset.
+newtype NewAssetToken = NewAssetToken
+  {newAssetToken :: AssetToken}
+  deriving stock (Eq, Show)
+  deriving newtype (Arbitrary)
+  deriving (FromJSON, ToJSON, S.ToSchema) via (Schema NewAssetToken)
+
+instance ToSchema NewAssetToken where
+  schema =
+    object "NewAssetToken" $
+      NewAssetToken <$> newAssetToken .= field "token" schema
+
+--------------------------------------------------------------------------------
+-- Body Construction
+
+-- | Build a complete @multipart/mixed@ request body for a one-shot,
+-- non-resumable asset upload.
+buildMultipartBody :: AssetSettings -> MIME.Type -> LByteString -> Builder
+buildMultipartBody sets typ bs =
+  let hdrs = mkHeaders typ bs
+   in beginMultipartBody sets hdrs <> lazyByteString bs <> endMultipartBody
+
+-- | Begin building a @multipart/mixed@ request body for a non-resumable upload.
+-- The returned 'Builder' can be immediately followed by the actual asset bytes.
+beginMultipartBody :: AssetSettings -> AssetHeaders -> Builder
+beginMultipartBody sets (AssetHeaders t l) =
+  byteString
+    "--frontier\r\n\
+    \Content-Type: application/json\r\n\
+    \Content-Length: "
+    <> int64Dec (LBS.length settingsJson)
+    <> byteString
+      "\r\n\
+      \\r\n"
+    <> lazyByteString settingsJson
+    <> byteString
+      "\r\n\
+      \--frontier\r\n\
+      \Content-Type: "
+    <> byteString (T.encodeUtf8 (MIME.showType t))
+    <> byteString
+      "\r\n\
+      \Content-Length: "
+    <> wordDec l
+    <> "\r\n\
+       \\r\n"
+  where
+    settingsJson = Aeson.encode (schemaToJSON sets)
+
+-- | The trailer of a non-resumable @multipart/mixed@ request body initiated
+-- via 'beginMultipartBody'.
+endMultipartBody :: Builder
+endMultipartBody = byteString "\r\n--frontier--\r\n"
+
+--------------------------------------------------------------------------------
+-- AssetHeaders
+
+-- | Headers provided during upload.
+data AssetHeaders = AssetHeaders
+  { hdrType :: MIME.Type,
+    hdrLength :: Word
+  }
+
+mkHeaders :: MIME.Type -> LByteString -> AssetHeaders
+mkHeaders t b = AssetHeaders t (fromIntegral (LBS.length b))
+
+--------------------------------------------------------------------------------
+-- AssetSettings
+
+-- | Settings provided during upload.
+data AssetSettings = AssetSettings
+  { _setAssetPublic :: Bool,
+    _setAssetRetention :: Maybe AssetRetention
+  }
+  deriving stock (Eq, Show, Generic)
+  deriving (Arbitrary) via (GenericUniform AssetSettings)
+  deriving (FromJSON, ToJSON, S.ToSchema) via (Schema AssetSettings)
+
+defAssetSettings :: AssetSettings
+defAssetSettings = AssetSettings False Nothing
+
+instance ToSchema AssetSettings where
+  schema =
+    object "AssetSettings" $
+      AssetSettings
+        <$> _setAssetPublic .= (fromMaybe False <$> optField "public" schema)
+        <*> _setAssetRetention .= maybe_ (optField "retention" schema)
+
+--------------------------------------------------------------------------------
+-- AssetRetention
+
+-- | The desired asset retention.
+data AssetRetention
+  = -- | The asset is retained indefinitely. Typically used
+    -- for profile pictures / assets frequently accessed.
+    AssetEternal
+  | -- | DEPRECATED: should not be used by clients for new assets
+    -- The asset is retained indefinitely.
+    AssetPersistent
+  | -- | The asset is retained for a short period of time.
+    AssetVolatile
+  | -- | The asset is retained indefinitely, storage is optimised
+    -- for infrequent access
+    AssetEternalInfrequentAccess
+  | -- | The asset is retained for an extended period of time,
+    -- but not indefinitely.
+    AssetExpiring
+  deriving stock (Eq, Show, Enum, Bounded, Generic)
+  deriving (Arbitrary) via (GenericUniform AssetRetention)
+  deriving (FromJSON, ToJSON, S.ToSchema) via (Schema AssetRetention)
+
+-- | The minimum TTL in seconds corresponding to a chosen retention.
+assetRetentionSeconds :: AssetRetention -> Maybe NominalDiffTime
+assetRetentionSeconds AssetEternal = Nothing
+assetRetentionSeconds AssetPersistent = Nothing
+assetRetentionSeconds AssetVolatile = Just assetVolatileSeconds
+assetRetentionSeconds AssetEternalInfrequentAccess = Nothing
+assetRetentionSeconds AssetExpiring = Just assetExpiringSeconds
+
+assetVolatileSeconds :: NominalDiffTime
+assetVolatileSeconds = 28 * 24 * 3600 -- 28 days
+
+assetExpiringSeconds :: NominalDiffTime
+assetExpiringSeconds = 365 * 24 * 3600 -- 365 days
+
+instance ToByteString AssetRetention where
+  builder AssetEternal = builder '1'
+  builder AssetPersistent = builder '2'
+  builder AssetVolatile = builder '3'
+  builder AssetEternalInfrequentAccess = builder '4'
+  builder AssetExpiring = builder '5'
+
+-- | ByteString representation is used in AssetKey
+instance FromByteString AssetRetention where
+  parser =
+    decimal >>= \d -> case (d :: Word) of
+      1 -> return AssetEternal
+      2 -> return AssetPersistent
+      3 -> return AssetVolatile
+      4 -> return AssetEternalInfrequentAccess
+      5 -> return AssetExpiring
+      _ -> fail $ "Invalid asset retention: " ++ show d
+
+retentionToTextRep :: AssetRetention -> Text
+retentionToTextRep AssetEternal = "eternal"
+retentionToTextRep AssetPersistent = "persistent"
+retentionToTextRep AssetVolatile = "volatile"
+retentionToTextRep AssetEternalInfrequentAccess = "eternal-infrequent_access"
+retentionToTextRep AssetExpiring = "expiring"
+
+instance ToSchema AssetRetention where
+  schema =
+    enum @Text "AssetRetention" $
+      foldMap
+        (\value -> element (retentionToTextRep value) value)
+        [minBound .. maxBound]
+
 newtype AssetLocation = AssetLocation {getAssetLocation :: Text}
   deriving newtype
     ( ToHttpApiData,
@@ -66,3 +392,6 @@ instance
   fromUnion (S (Z (I loc))) = Just (LocalAsset loc)
   fromUnion (S (S (Z (I asset)))) = Just (RemoteAsset asset)
   fromUnion (S (S (S x))) = case x of
+
+makeLenses ''Asset'
+makeLenses ''AssetSettings
diff --git a/libs/wire-api/src/Wire/API/Asset/V3.hs b/libs/wire-api/src/Wire/API/Asset/V3.hs
deleted file mode 100644
index 7890b020ab9..00000000000
--- a/libs/wire-api/src/Wire/API/Asset/V3.hs
+++ /dev/null
@@ -1,341 +0,0 @@
-{-# LANGUAGE GeneralizedNewtypeDeriving #-}
-{-# LANGUAGE StrictData #-}
-{-# LANGUAGE TemplateHaskell #-}
-
--- This file is part of the Wire Server implementation.
---
--- Copyright (C) 2020 Wire Swiss GmbH <opensource@wire.com>
---
--- This program is free software: you can redistribute it and/or modify it under
--- the terms of the GNU Affero General Public License as published by the Free
--- Software Foundation, either version 3 of the License, or (at your option) any
--- later version.
---
--- This program is distributed in the hope that it will be useful, but WITHOUT
--- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
--- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
--- details.
---
--- You should have received a copy of the GNU Affero General Public License along
--- with this program. If not, see <https://www.gnu.org/licenses/>.
-
-module Wire.API.Asset.V3
-  ( -- * Asset
-    Asset,
-    mkAsset,
-    assetKey,
-    assetExpires,
-    assetToken,
-
-    -- * AssetKey
-    AssetKey (..),
-
-    -- * AssetToken
-    AssetToken (..),
-    NewAssetToken (..),
-
-    -- * Body Construction
-    buildMultipartBody,
-    beginMultipartBody,
-    endMultipartBody,
-
-    -- * AssetHeaders
-    AssetHeaders (..),
-    mkHeaders,
-
-    -- * AssetSettings
-    AssetSettings,
-    defAssetSettings,
-    setAssetPublic,
-    setAssetRetention,
-    AssetRetention (..),
-    assetRetentionSeconds,
-    assetExpiringSeconds,
-    assetVolatileSeconds,
-    retentionToTextRep,
-  )
-where
-
-import qualified Codec.MIME.Type as MIME
-import Control.Lens (makeLenses, (?~))
-import Data.Aeson (FromJSON (..), ToJSON (..))
-import qualified Data.Aeson as Aeson
-import Data.Attoparsec.ByteString.Char8
-import Data.Bifunctor
-import Data.ByteString.Builder
-import Data.ByteString.Conversion
-import qualified Data.ByteString.Lazy as LBS
-import Data.Id
-import Data.Json.Util (UTCTimeMillis (fromUTCTimeMillis), toUTCTimeMillis)
-import Data.Proxy
-import Data.Schema
-import qualified Data.Swagger as S
-import qualified Data.Text as T
-import Data.Text.Ascii (AsciiBase64Url)
-import qualified Data.Text.Encoding as T
-import Data.Time.Clock
-import qualified Data.UUID as UUID
-import Imports
-import Servant
-import Wire.API.Arbitrary (Arbitrary (..), GenericUniform (..))
-
---------------------------------------------------------------------------------
--- Asset
-
--- | A newly uploaded asset.
-data Asset = Asset
-  { _assetKey :: AssetKey,
-    _assetExpires :: Maybe UTCTime,
-    _assetToken :: Maybe AssetToken
-  }
-  deriving stock (Eq, Show, Generic)
-  deriving (FromJSON, ToJSON, S.ToSchema) via Schema Asset
-
--- Generate expiry time with millisecond precision
-instance Arbitrary Asset where
-  arbitrary = Asset <$> arbitrary <*> (fmap milli <$> arbitrary) <*> arbitrary
-    where
-      milli = fromUTCTimeMillis . toUTCTimeMillis
-
-mkAsset :: AssetKey -> Asset
-mkAsset k = Asset k Nothing Nothing
-
-instance ToSchema Asset where
-  schema =
-    object "Asset" $
-      Asset
-        <$> _assetKey .= field "key" schema
-        <*> (fmap toUTCTimeMillis . _assetExpires)
-          .= maybe_
-            (optField "expires" (fromUTCTimeMillis <$> schema))
-        <*> _assetToken .= maybe_ (optField "token" schema)
-
---------------------------------------------------------------------------------
--- AssetKey
-
--- | A unique, versioned asset identifier.
--- Note: Can be turned into a sum type with additional constructors
--- for future versions.
-data AssetKey = AssetKeyV3 AssetId AssetRetention
-  deriving stock (Eq, Show, Generic)
-  deriving (Arbitrary) via (GenericUniform AssetKey)
-  deriving (FromJSON, ToJSON, S.ToSchema) via (Schema AssetKey)
-
-instance FromByteString AssetKey where
-  parser = do
-    v <- decimal
-    _ <- char '-'
-    case (v :: Word) of
-      3 -> parseV3
-      _ -> fail $ "Invalid asset version: " ++ show v
-    where
-      -- AssetKeyV3 ::= Retention "-" uuid
-      -- Retention  ::= decimal
-      parseV3 = do
-        r <- parser
-        _ <- char '-'
-        b <- takeByteString
-        case UUID.fromASCIIBytes b of
-          Just i -> return $! AssetKeyV3 (Id i) r
-          Nothing -> fail "Invalid asset ID"
-
-instance ToByteString AssetKey where
-  builder (AssetKeyV3 i r) =
-    builder '3'
-      <> builder '-'
-      <> builder r
-      <> builder '-'
-      <> builder (UUID.toASCIIBytes (toUUID i))
-
-instance ToSchema AssetKey where
-  schema =
-    (T.decodeUtf8 . toByteString')
-      .= parsedText "AssetKey" (runParser parser . T.encodeUtf8)
-        & doc' . S.schema . S.example ?~ toJSON ("3-1-47de4580-ae51-4650-acbb-d10c028cb0ac" :: Text)
-
-instance S.ToParamSchema AssetKey where
-  toParamSchema _ = S.toParamSchema (Proxy @Text)
-
-instance FromHttpApiData AssetKey where
-  parseUrlPiece = first T.pack . runParser parser . T.encodeUtf8
-
---------------------------------------------------------------------------------
--- AssetToken
-
--- | Asset tokens are bearer tokens that grant access to a single asset.
-newtype AssetToken = AssetToken {assetTokenAscii :: AsciiBase64Url}
-  deriving stock (Eq, Show)
-  deriving newtype (FromByteString, ToByteString, Arbitrary)
-  deriving (FromJSON, ToJSON) via (Schema AssetToken)
-
-instance ToSchema AssetToken where
-  schema =
-    AssetToken <$> assetTokenAscii
-      .= schema
-        & doc' . S.schema . S.example ?~ toJSON ("aGVsbG8" :: Text)
-
-instance S.ToParamSchema AssetToken where
-  toParamSchema _ = S.toParamSchema (Proxy @Text)
-
-instance FromHttpApiData AssetToken where
-  parseUrlPiece = first T.pack . runParser parser . T.encodeUtf8
-
--- | A newly (re)generated token for an existing asset.
-newtype NewAssetToken = NewAssetToken
-  {newAssetToken :: AssetToken}
-  deriving stock (Eq, Show)
-  deriving newtype (Arbitrary)
-  deriving (FromJSON, ToJSON, S.ToSchema) via (Schema NewAssetToken)
-
-instance ToSchema NewAssetToken where
-  schema =
-    object "NewAssetToken" $
-      NewAssetToken <$> newAssetToken .= field "token" schema
-
---------------------------------------------------------------------------------
--- Body Construction
-
--- | Build a complete @multipart/mixed@ request body for a one-shot,
--- non-resumable asset upload.
-buildMultipartBody :: AssetSettings -> MIME.Type -> LByteString -> Builder
-buildMultipartBody sets typ bs =
-  let hdrs = mkHeaders typ bs
-   in beginMultipartBody sets hdrs <> lazyByteString bs <> endMultipartBody
-
--- | Begin building a @multipart/mixed@ request body for a non-resumable upload.
--- The returned 'Builder' can be immediately followed by the actual asset bytes.
-beginMultipartBody :: AssetSettings -> AssetHeaders -> Builder
-beginMultipartBody sets (AssetHeaders t l) =
-  byteString
-    "--frontier\r\n\
-    \Content-Type: application/json\r\n\
-    \Content-Length: "
-    <> int64Dec (LBS.length settingsJson)
-    <> byteString
-      "\r\n\
-      \\r\n"
-    <> lazyByteString settingsJson
-    <> byteString
-      "\r\n\
-      \--frontier\r\n\
-      \Content-Type: "
-    <> byteString (T.encodeUtf8 (MIME.showType t))
-    <> byteString
-      "\r\n\
-      \Content-Length: "
-    <> wordDec l
-    <> "\r\n\
-       \\r\n"
-  where
-    settingsJson = Aeson.encode (schemaToJSON sets)
-
--- | The trailer of a non-resumable @multipart/mixed@ request body initiated
--- via 'beginMultipartBody'.
-endMultipartBody :: Builder
-endMultipartBody = byteString "\r\n--frontier--\r\n"
-
---------------------------------------------------------------------------------
--- AssetHeaders
-
--- | Headers provided during upload.
-data AssetHeaders = AssetHeaders
-  { hdrType :: MIME.Type,
-    hdrLength :: Word
-  }
-
-mkHeaders :: MIME.Type -> LByteString -> AssetHeaders
-mkHeaders t b = AssetHeaders t (fromIntegral (LBS.length b))
-
---------------------------------------------------------------------------------
--- AssetSettings
-
--- | Settings provided during upload.
-data AssetSettings = AssetSettings
-  { _setAssetPublic :: Bool,
-    _setAssetRetention :: Maybe AssetRetention
-  }
-  deriving stock (Eq, Show, Generic)
-  deriving (Arbitrary) via (GenericUniform AssetSettings)
-  deriving (FromJSON, ToJSON, S.ToSchema) via (Schema AssetSettings)
-
-defAssetSettings :: AssetSettings
-defAssetSettings = AssetSettings False Nothing
-
-instance ToSchema AssetSettings where
-  schema =
-    object "AssetSettings" $
-      AssetSettings
-        <$> _setAssetPublic .= (fromMaybe False <$> optField "public" schema)
-        <*> _setAssetRetention .= maybe_ (optField "retention" schema)
-
---------------------------------------------------------------------------------
--- AssetRetention
-
--- | The desired asset retention.
-data AssetRetention
-  = -- | The asset is retained indefinitely. Typically used
-    -- for profile pictures / assets frequently accessed.
-    AssetEternal
-  | -- | DEPRECATED: should not be used by clients for new assets
-    -- The asset is retained indefinitely.
-    AssetPersistent
-  | -- | The asset is retained for a short period of time.
-    AssetVolatile
-  | -- | The asset is retained indefinitely, storage is optimised
-    -- for infrequent access
-    AssetEternalInfrequentAccess
-  | -- | The asset is retained for an extended period of time,
-    -- but not indefinitely.
-    AssetExpiring
-  deriving stock (Eq, Show, Enum, Bounded, Generic)
-  deriving (Arbitrary) via (GenericUniform AssetRetention)
-  deriving (FromJSON, ToJSON, S.ToSchema) via (Schema AssetRetention)
-
--- | The minimum TTL in seconds corresponding to a chosen retention.
-assetRetentionSeconds :: AssetRetention -> Maybe NominalDiffTime
-assetRetentionSeconds AssetEternal = Nothing
-assetRetentionSeconds AssetPersistent = Nothing
-assetRetentionSeconds AssetVolatile = Just assetVolatileSeconds
-assetRetentionSeconds AssetEternalInfrequentAccess = Nothing
-assetRetentionSeconds AssetExpiring = Just assetExpiringSeconds
-
-assetVolatileSeconds :: NominalDiffTime
-assetVolatileSeconds = 28 * 24 * 3600 -- 28 days
-
-assetExpiringSeconds :: NominalDiffTime
-assetExpiringSeconds = 365 * 24 * 3600 -- 365 days
-
-instance ToByteString AssetRetention where
-  builder AssetEternal = builder '1'
-  builder AssetPersistent = builder '2'
-  builder AssetVolatile = builder '3'
-  builder AssetEternalInfrequentAccess = builder '4'
-  builder AssetExpiring = builder '5'
-
--- | ByteString representation is used in AssetKey
-instance FromByteString AssetRetention where
-  parser =
-    decimal >>= \d -> case (d :: Word) of
-      1 -> return AssetEternal
-      2 -> return AssetPersistent
-      3 -> return AssetVolatile
-      4 -> return AssetEternalInfrequentAccess
-      5 -> return AssetExpiring
-      _ -> fail $ "Invalid asset retention: " ++ show d
-
-retentionToTextRep :: AssetRetention -> Text
-retentionToTextRep AssetEternal = "eternal"
-retentionToTextRep AssetPersistent = "persistent"
-retentionToTextRep AssetVolatile = "volatile"
-retentionToTextRep AssetEternalInfrequentAccess = "eternal-infrequent_access"
-retentionToTextRep AssetExpiring = "expiring"
-
-instance ToSchema AssetRetention where
-  schema =
-    enum @Text "AssetRetention" $
-      foldMap
-        (\value -> element (retentionToTextRep value) value)
-        [minBound .. maxBound]
-
-makeLenses ''Asset
-makeLenses ''AssetSettings
diff --git a/libs/wire-api/wire-api.cabal b/libs/wire-api/wire-api.cabal
index f84b7fddf85..bc4d4c1a684 100644
--- a/libs/wire-api/wire-api.cabal
+++ b/libs/wire-api/wire-api.cabal
@@ -4,7 +4,7 @@ cabal-version: 1.12
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 80606059441fcf0f725386078aef563bf04549ce657002575a6559ae37544964
+-- hash: f2aacb81c413e8753829ba09eb08d1d2524c973346739389dfeb4284d4a16ebd
 
 name:           wire-api
 version:        0.1.0
@@ -21,7 +21,6 @@ library
   exposed-modules:
       Wire.API.Arbitrary
       Wire.API.Asset
-      Wire.API.Asset.V3
       Wire.API.Call.Config
       Wire.API.Connection
       Wire.API.Conversation
diff --git a/services/brig/test/integration/API/User/Account.hs b/services/brig/test/integration/API/User/Account.hs
index 7c4959d9b92..935ef9e7af5 100644
--- a/services/brig/test/integration/API/User/Account.hs
+++ b/services/brig/test/integration/API/User/Account.hs
@@ -34,7 +34,6 @@ import Brig.Types
 import Brig.Types.Intra
 import Brig.Types.User.Auth hiding (user)
 import qualified Brig.Types.User.Auth as Auth
-import qualified CargoHold.Types.V3 as CHV3
 import Control.Arrow ((&&&))
 import Control.Exception (throw)
 import Control.Lens (ix, preview, (^.), (^?))
@@ -79,6 +78,7 @@ import UnliftIO (mapConcurrently_)
 import Util as Util
 import Util.AWS as Util
 import Web.Cookie (parseSetCookie)
+import qualified Wire.API.Asset as Asset
 import Wire.API.Federation.API.Brig (UserDeletedConnectionsNotification (..))
 import qualified Wire.API.Federation.API.Brig as FedBrig
 import Wire.API.Federation.API.Common (EmptyResponse (EmptyResponse))
@@ -1321,8 +1321,13 @@ testDeleteWithProfilePic brig cargohold = do
   uid <- userId <$> createAnonUser "anon" brig
   ast <- uploadAsset cargohold uid "this is my profile pic"
   -- Ensure that the asset is there
-  downloadAsset cargohold uid (toByteString' (ast ^. CHV3.assetKey)) !!! const 200 === statusCode
-  let newAssets = Just [ImageAsset (T.decodeLatin1 $ toByteString' (ast ^. CHV3.assetKey)) (Just AssetComplete)]
+  downloadAsset cargohold uid (ast ^. Asset.assetKey) !!! const 200 === statusCode
+  let newAssets =
+        Just
+          [ ImageAsset
+              (T.decodeLatin1 $ toByteString' (qUnqualified (ast ^. Asset.assetKey)))
+              (Just AssetComplete)
+          ]
       userUpdate = UserUpdate Nothing Nothing newAssets Nothing
       update = RequestBodyLBS . encode $ userUpdate
   -- Update profile with the uploaded asset
@@ -1330,7 +1335,7 @@ testDeleteWithProfilePic brig cargohold = do
     !!! const 200 === statusCode
   deleteUser uid Nothing brig !!! const 200 === statusCode
   -- Check that the asset gets deleted
-  downloadAsset cargohold uid (toByteString' (ast ^. CHV3.assetKey)) !!! const 404 === statusCode
+  downloadAsset cargohold uid (ast ^. Asset.assetKey) !!! const 404 === statusCode
 
 testDeleteWithRemotes :: Opt.Opts -> Brig -> Http ()
 testDeleteWithRemotes opts brig = do
diff --git a/services/brig/test/integration/API/User/Util.hs b/services/brig/test/integration/API/User/Util.hs
index 6e8087c4961..665a4351e90 100644
--- a/services/brig/test/integration/API/User/Util.hs
+++ b/services/brig/test/integration/API/User/Util.hs
@@ -53,6 +53,7 @@ import Imports
 import qualified Test.Tasty.Cannon as WS
 import Test.Tasty.HUnit
 import Util
+import Wire.API.Asset
 import qualified Wire.API.Event.Conversation as Conv
 import qualified Wire.API.Federation.API.Brig as F
 import Wire.API.Federation.Component
@@ -426,11 +427,16 @@ uploadAsset c usr dat = do
       === statusCode
   responseJsonError rsp
 
-downloadAsset :: CargoHold -> UserId -> ByteString -> (MonadIO m, MonadHttp m) => m (Response (Maybe LB.ByteString))
+downloadAsset ::
+  (MonadIO m, MonadHttp m) =>
+  CargoHold ->
+  UserId ->
+  Qualified AssetKey ->
+  m (Response (Maybe LB.ByteString))
 downloadAsset c usr ast =
   get
     ( c
-        . paths ["/assets/v3", ast]
+        . paths ["/assets/v4", toByteString' (qDomain ast), toByteString' (qUnqualified ast)]
         . zUser usr
         . zConn "conn"
     )
diff --git a/services/cargohold/src/CargoHold/API/Public.hs b/services/cargohold/src/CargoHold/API/Public.hs
index 212e6b84ef7..50b80f595ca 100644
--- a/services/cargohold/src/CargoHold/API/Public.hs
+++ b/services/cargohold/src/CargoHold/API/Public.hs
@@ -76,12 +76,14 @@ uploadAssetV3 ::
 uploadAssetV3 pid req = do
   let principal = mkPrincipal pid
   asset <- V3.upload principal (getAssetSource req)
-  let key = Text.decodeUtf8With Text.lenientDecode (toByteString' (asset ^. assetKey))
+  let key =
+        Text.decodeUtf8With Text.lenientDecode $
+          toByteString' (tUnqualified (asset ^. assetKey))
   let loc = case principal of
         V3.UserPrincipal {} -> "/assets/v3/" <> key
         V3.BotPrincipal {} -> "/bot/assets/" <> key
         V3.ProviderPrincipal {} -> "/provider/assets/" <> key
-  pure (asset, AssetLocation loc)
+  pure (fmap qUntagged asset, AssetLocation loc)
 
 downloadAssetV3 ::
   MakePrincipal tag id =>
@@ -100,7 +102,7 @@ downloadAssetV4 ::
   Maybe AssetToken ->
   Handler (Maybe LocalOrRemoteAsset)
 downloadAssetV4 usr qkey tok = do
-  key <- tUnqualified <$> ensureLocal usr qkey
+  key <- tUnqualified <$> ensureLocal qkey
   LocalAsset <$$> downloadAssetV3 usr key tok
 
 deleteAssetV3 :: MakePrincipal tag id => id -> AssetKey -> Handler ()
@@ -108,7 +110,7 @@ deleteAssetV3 usr key = V3.delete (mkPrincipal usr) key
 
 deleteAssetV4 :: Local UserId -> Qualified AssetKey -> Handler ()
 deleteAssetV4 usr qkey = do
-  key <- tUnqualified <$> ensureLocal usr qkey
+  key <- tUnqualified <$> ensureLocal qkey
   V3.delete (mkPrincipal usr) key
 
 renewTokenV3 :: Local UserId -> AssetKey -> Handler NewAssetToken
diff --git a/services/cargohold/src/CargoHold/API/Util.hs b/services/cargohold/src/CargoHold/API/Util.hs
index d52407b847b..33c30e480ff 100644
--- a/services/cargohold/src/CargoHold/API/Util.hs
+++ b/services/cargohold/src/CargoHold/API/Util.hs
@@ -15,13 +15,25 @@
 -- You should have received a copy of the GNU Affero General Public License along
 -- with this program. If not, see <https://www.gnu.org/licenses/>.
 
-module CargoHold.API.Util (ensureLocal) where
+module CargoHold.API.Util
+  ( ensureLocal,
+    qualifyLocal,
+  )
+where
 
 import CargoHold.App
 import Control.Error
+import Control.Lens
 import Data.Qualified
 import Imports
 import Wire.API.Federation.Error
 
-ensureLocal :: Local x -> Qualified a -> Handler (Local a)
-ensureLocal loc = foldQualified loc pure (\_ -> throwE federationNotImplemented)
+ensureLocal :: Qualified a -> Handler (Local a)
+ensureLocal value = do
+  loc <- view localUnit
+  foldQualified loc pure (\_ -> throwE federationNotImplemented) value
+
+qualifyLocal :: a -> Handler (Local a)
+qualifyLocal x = do
+  loc <- view localUnit
+  pure (qualifyAs loc x)
diff --git a/services/cargohold/src/CargoHold/API/V3.hs b/services/cargohold/src/CargoHold/API/V3.hs
index fcbe55d5530..07917d86b08 100644
--- a/services/cargohold/src/CargoHold/API/V3.hs
+++ b/services/cargohold/src/CargoHold/API/V3.hs
@@ -26,6 +26,7 @@ module CargoHold.API.V3
 where
 
 import CargoHold.API.Error
+import CargoHold.API.Util
 import CargoHold.App
 import qualified CargoHold.Metrics as Metrics
 import CargoHold.Options
@@ -48,6 +49,7 @@ import Data.Conduit
 import qualified Data.Conduit.Attoparsec as Conduit
 import Data.Id
 import qualified Data.List as List
+import Data.Qualified
 import qualified Data.Text.Ascii as Ascii
 import Data.Text.Encoding (decodeLatin1)
 import qualified Data.Text.Lazy as LT
@@ -57,8 +59,9 @@ import Imports hiding (take)
 import Network.HTTP.Types.Header
 import Network.Wai.Utilities (Error (..))
 import URI.ByteString
+import Wire.API.Asset
 
-upload :: V3.Principal -> ConduitM () ByteString (ResourceT IO) () -> Handler V3.Asset
+upload :: V3.Principal -> ConduitM () ByteString (ResourceT IO) () -> Handler (Asset' (Local AssetKey))
 upload own bdy = do
   (rsrc, sets) <- parseMetadata bdy assetSettings
   (src, hdrs) <- parseHeaders rsrc assetHeaders
@@ -71,8 +74,8 @@ upload own bdy = do
   ast <- liftIO $ Id <$> nextRandom
   tok <- if sets ^. V3.setAssetPublic then return Nothing else Just <$> randToken
   let ret = fromMaybe V3.AssetPersistent (sets ^. V3.setAssetRetention)
-  let key = V3.AssetKeyV3 ast ret
-  void $ S3.uploadV3 own key hdrs tok src
+  key <- qualifyLocal (V3.AssetKeyV3 ast ret)
+  void $ S3.uploadV3 own (tUnqualified key) hdrs tok src
   Metrics.s3UploadOk
   Metrics.s3UploadSize cl
   expires <- case V3.assetRetentionSeconds ret of
diff --git a/services/cargohold/src/CargoHold/App.hs b/services/cargohold/src/CargoHold/App.hs
index 79aa9dddfa5..faeeb21b9fe 100644
--- a/services/cargohold/src/CargoHold/App.hs
+++ b/services/cargohold/src/CargoHold/App.hs
@@ -30,6 +30,7 @@ module CargoHold.App
     appLogger,
     requestId,
     settings,
+    localUnit,
 
     -- * App Monad
     AppT,
@@ -56,6 +57,7 @@ import Control.Monad.Trans.Resource (ResourceT, runResourceT, transResourceT)
 import Data.Default (def)
 import Data.Metrics.Middleware (Metrics)
 import qualified Data.Metrics.Middleware as Metrics
+import Data.Qualified
 import Imports hiding (log)
 import Network.HTTP.Client (ManagerSettings (..), requestHeaders, responseTimeoutMicro)
 import Network.HTTP.Client.OpenSSL
@@ -75,7 +77,8 @@ data Env = Env
     _appLogger :: Logger,
     _httpManager :: Manager,
     _requestId :: RequestId,
-    _settings :: Opt.Settings
+    _settings :: Opt.Settings,
+    _localUnit :: Local ()
   }
 
 makeLenses ''Env
@@ -86,7 +89,8 @@ newEnv o = do
   lgr <- Log.mkLogger (o ^. optLogLevel) (o ^. optLogNetStrings) (o ^. optLogFormat)
   mgr <- initHttpManager (o ^. optAws . awsS3Compatibility)
   ama <- initAws (o ^. optAws) lgr mgr
-  return $ Env ama met lgr mgr def (o ^. optSettings)
+  let loc = toLocalUnsafe (o ^. optSettings . Opt.setFederationDomain) ()
+  return $ Env ama met lgr mgr def (o ^. optSettings) loc
 
 initAws :: AWSOpts -> Logger -> Manager -> IO AWS.Env
 initAws o l m =
diff --git a/services/cargohold/test/integration/API/V3.hs b/services/cargohold/test/integration/API/V3.hs
index f3d2a780011..750cb2d0264 100644
--- a/services/cargohold/test/integration/API/V3.hs
+++ b/services/cargohold/test/integration/API/V3.hs
@@ -30,6 +30,7 @@ import qualified Data.ByteString.Char8 as C8
 import Data.ByteString.Conversion
 import qualified Data.ByteString.Lazy as Lazy
 import Data.Id
+import Data.Qualified
 import Data.Text.Encoding (decodeLatin1)
 import Data.Time.Clock
 import Data.Time.Format
@@ -135,12 +136,12 @@ testSimpleTokens c = do
   get (c . path loc . zUser uid2 . queryItem "asset_token" "acb123" . noRedirect)
     !!! const 404 === statusCode
   -- Token renewal fails if not done by owner
-  post (c . paths ["assets", "v3", toByteString' key, "token"] . zUser uid2) !!! do
+  post (c . paths ["assets", "v3", toByteString' (qUnqualified key), "token"] . zUser uid2) !!! do
     const 403 === statusCode
     const (Just "unauthorised") === fmap label . responseJsonMaybe
   -- Token renewal succeeds if done by owner
   r2 <-
-    post (c . paths ["assets", "v3", toByteString' key, "token"] . zUser uid)
+    post (c . paths ["assets", "v3", toByteString' (qUnqualified key), "token"] . zUser uid)
       <!! const 200 === statusCode
   let Just tok' = V3.newAssetToken <$> responseJsonMaybe r2
   liftIO $ assertBool "token unchanged" (tok /= tok')
@@ -166,11 +167,11 @@ testSimpleTokens c = do
   get (c . path loc . queryItem "asset_token" (toByteString' tok') . zUser uid2 . noRedirect)
     !!! const 302 === statusCode
   -- Delete Token fails if not done by owner
-  delete (c . paths ["assets", "v3", toByteString' key, "token"] . zUser uid2) !!! do
+  delete (c . paths ["assets", "v3", toByteString' (qUnqualified key), "token"] . zUser uid2) !!! do
     const 403 === statusCode
     const (Just "unauthorised") === fmap label . responseJsonMaybe
   -- Delete Token succeeds by owner
-  delete (c . paths ["assets", "v3", toByteString' key, "token"] . zUser uid) !!! do
+  delete (c . paths ["assets", "v3", toByteString' (qUnqualified key), "token"] . zUser uid) !!! do
     const 200 === statusCode
     const Nothing === responseBody
   -- Access without token from different user (asset is now "public")
@@ -263,8 +264,8 @@ uploadRaw c usr bs =
       . content "multipart/mixed"
       . lbytes bs
 
-deleteAsset :: CargoHold -> UserId -> V3.AssetKey -> Http (Response (Maybe Lazy.ByteString))
-deleteAsset c u k = delete $ c . zUser u . paths ["assets", "v3", toByteString' k]
+deleteAsset :: CargoHold -> UserId -> Qualified V3.AssetKey -> Http (Response (Maybe Lazy.ByteString))
+deleteAsset c u k = delete $ c . zUser u . paths ["assets", "v3", toByteString' (qUnqualified k)]
 
 -- Utilities ------------------------------------------------------------------
 

From eb43734f788a12c21d86d54c35b6e80a92c4ff6b Mon Sep 17 00:00:00 2001
From: Sven Tennie <sven.tennie@wire.com>
Date: Thu, 16 Dec 2021 18:05:32 +0100
Subject: [PATCH 31/74] Fix Asset golden tests

---
 .../src/Wire/API/Routes/Public/Cargohold.hs   |   2 -
 .../Wire/API/Golden/Generated/Asset_asset.hs  |  61 ++--
 .../test/golden/testObject_Asset_asset_1.json |   1 +
 .../golden/testObject_Asset_asset_10.json     |   1 +
 .../golden/testObject_Asset_asset_11.json     |   1 +
 .../golden/testObject_Asset_asset_12.json     |   1 +
 .../golden/testObject_Asset_asset_13.json     |   1 +
 .../golden/testObject_Asset_asset_14.json     |   1 +
 .../golden/testObject_Asset_asset_15.json     |   1 +
 .../golden/testObject_Asset_asset_16.json     |   1 +
 .../golden/testObject_Asset_asset_17.json     |   1 +
 .../golden/testObject_Asset_asset_18.json     |   1 +
 .../golden/testObject_Asset_asset_19.json     |   1 +
 .../test/golden/testObject_Asset_asset_2.json |   1 +
 .../golden/testObject_Asset_asset_20.json     |   1 +
 .../test/golden/testObject_Asset_asset_3.json |   1 +
 .../test/golden/testObject_Asset_asset_4.json |   1 +
 .../test/golden/testObject_Asset_asset_5.json |   1 +
 .../test/golden/testObject_Asset_asset_6.json |   1 +
 .../test/golden/testObject_Asset_asset_7.json |   1 +
 .../test/golden/testObject_Asset_asset_8.json |   1 +
 .../test/golden/testObject_Asset_asset_9.json |   1 +
 .../testObject_UserIdentity_user_16.json      |   8 -
 .../testObject_UserIdentity_user_5.json       |   8 -
 .../testObject_UserIdentity_user_8.json       |   8 -
 .../golden/testObject_UserSSOId_user_1.json   |   4 -
 .../golden/testObject_UserSSOId_user_10.json  |   4 -
 .../golden/testObject_UserSSOId_user_11.json  |   3 -
 .../golden/testObject_UserSSOId_user_12.json  |   4 -
 .../golden/testObject_UserSSOId_user_14.json  |   4 -
 .../golden/testObject_UserSSOId_user_15.json  |   3 -
 .../golden/testObject_UserSSOId_user_16.json  |   3 -
 .../golden/testObject_UserSSOId_user_17.json  |   3 -
 .../golden/testObject_UserSSOId_user_18.json  |   3 -
 .../golden/testObject_UserSSOId_user_19.json  |   3 -
 .../golden/testObject_UserSSOId_user_20.json  |   4 -
 .../golden/testObject_UserSSOId_user_3.json   |   4 -
 .../golden/testObject_UserSSOId_user_4.json   |   4 -
 .../golden/testObject_UserSSOId_user_5.json   |   4 -
 .../golden/testObject_UserSSOId_user_6.json   |   4 -
 .../golden/testObject_UserSSOId_user_7.json   |   4 -
 .../golden/testObject_UserSSOId_user_8.json   |   4 -
 .../Test/Wire/API/Roundtrip/ByteString.hs     |   8 +-
 services/cargohold/cargohold.cabal            |   4 +-
 services/cargohold/package.yaml               |   1 +
 services/cargohold/test/integration/API/V4.hs | 282 ++++++++++++++++++
 .../lib/src/Network/Wire/Simulations.hs       |   2 +-
 47 files changed, 335 insertions(+), 131 deletions(-)
 delete mode 100644 libs/wire-api/test/golden/testObject_UserIdentity_user_16.json
 delete mode 100644 libs/wire-api/test/golden/testObject_UserIdentity_user_5.json
 delete mode 100644 libs/wire-api/test/golden/testObject_UserIdentity_user_8.json
 delete mode 100644 libs/wire-api/test/golden/testObject_UserSSOId_user_1.json
 delete mode 100644 libs/wire-api/test/golden/testObject_UserSSOId_user_10.json
 delete mode 100644 libs/wire-api/test/golden/testObject_UserSSOId_user_11.json
 delete mode 100644 libs/wire-api/test/golden/testObject_UserSSOId_user_12.json
 delete mode 100644 libs/wire-api/test/golden/testObject_UserSSOId_user_14.json
 delete mode 100644 libs/wire-api/test/golden/testObject_UserSSOId_user_15.json
 delete mode 100644 libs/wire-api/test/golden/testObject_UserSSOId_user_16.json
 delete mode 100644 libs/wire-api/test/golden/testObject_UserSSOId_user_17.json
 delete mode 100644 libs/wire-api/test/golden/testObject_UserSSOId_user_18.json
 delete mode 100644 libs/wire-api/test/golden/testObject_UserSSOId_user_19.json
 delete mode 100644 libs/wire-api/test/golden/testObject_UserSSOId_user_20.json
 delete mode 100644 libs/wire-api/test/golden/testObject_UserSSOId_user_3.json
 delete mode 100644 libs/wire-api/test/golden/testObject_UserSSOId_user_4.json
 delete mode 100644 libs/wire-api/test/golden/testObject_UserSSOId_user_5.json
 delete mode 100644 libs/wire-api/test/golden/testObject_UserSSOId_user_6.json
 delete mode 100644 libs/wire-api/test/golden/testObject_UserSSOId_user_7.json
 delete mode 100644 libs/wire-api/test/golden/testObject_UserSSOId_user_8.json
 create mode 100644 services/cargohold/test/integration/API/V4.hs

diff --git a/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs b/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs
index 8d14b8a57c6..92df6173a9c 100644
--- a/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs
+++ b/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs
@@ -1,5 +1,3 @@
-{-# LANGUAGE GeneralizedNewtypeDeriving #-}
-
 -- This file is part of the Wire Server implementation.
 --
 -- Copyright (C) 2021 Wire Swiss GmbH <opensource@wire.com>
diff --git a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/Asset_asset.hs b/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/Asset_asset.hs
index 9e74080103a..98da5bf2c18 100644
--- a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/Asset_asset.hs
+++ b/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/Asset_asset.hs
@@ -19,44 +19,31 @@
 module Test.Wire.API.Golden.Generated.Asset_asset where
 
 import Control.Lens ((.~))
+import Data.Domain
 import Data.Id (Id (Id))
+import Data.Qualified
 import Data.Text.Ascii (AsciiChars (validate))
 import qualified Data.UUID as UUID (fromString)
 import Imports (Functor (fmap), Maybe (Just, Nothing), fromJust, fromRight, read, undefined, (&))
 import Wire.API.Asset
-  ( Asset,
-    AssetKey (AssetKeyV3),
-    AssetRetention
-      ( AssetEternal,
-        AssetEternalInfrequentAccess,
-        AssetExpiring,
-        AssetPersistent,
-        AssetVolatile
-      ),
-    AssetToken (AssetToken, assetTokenAscii),
-    assetExpires,
-    assetToken,
-    mkAsset,
-  )
 
 testObject_Asset_asset_1 :: Asset
 testObject_Asset_asset_1 =
-  ( mkAsset (AssetKeyV3 (Id (fromJust (UUID.fromString "0000004b-0000-0017-0000-003e00000033"))) AssetExpiring)
-      & assetExpires .~ (fmap read (Just "1864-04-30 15:58:55.452 UTC"))
-      & assetToken .~ Just (AssetToken {assetTokenAscii = (fromRight undefined (validate ("Kun4JaxR6QuASXywDhzx")))})
-  )
+  mkAsset (Qualified (AssetKeyV3 (Id (fromJust (UUID.fromString "0000004b-0000-0017-0000-003e00000033"))) AssetExpiring) (Domain "example.com"))
+    & assetExpires .~ (fmap read (Just "1864-04-30 15:58:55.452 UTC"))
+    & assetToken .~ Just (AssetToken {assetTokenAscii = (fromRight undefined (validate ("Kun4JaxR6QuASXywDhzx")))})
 
 testObject_Asset_asset_2 :: Asset
 testObject_Asset_asset_2 =
   ( mkAsset
-      (AssetKeyV3 (Id (fromJust (UUID.fromString "00000008-0000-006c-0000-001900000036"))) AssetEternalInfrequentAccess)
+      (Qualified (AssetKeyV3 (Id (fromJust (UUID.fromString "00000008-0000-006c-0000-001900000036"))) AssetEternalInfrequentAccess) (Domain "example.com"))
       & assetExpires .~ (fmap read (Just "1864-06-04 17:39:43.924 UTC"))
       & assetToken .~ Just (AssetToken {assetTokenAscii = (fromRight undefined (validate ("mPuul678vuJVZ_u9lQ==")))})
   )
 
 testObject_Asset_asset_3 :: Asset
 testObject_Asset_asset_3 =
-  ( mkAsset (AssetKeyV3 (Id (fromJust (UUID.fromString "00000055-0000-0071-0000-002e00000020"))) AssetEternal)
+  ( mkAsset (Qualified (AssetKeyV3 (Id (fromJust (UUID.fromString "00000055-0000-0071-0000-002e00000020"))) AssetEternal) (Domain "example.com"))
       & assetExpires .~ (fmap read (Just "1864-05-18 20:18:13.438 UTC"))
       & assetToken .~ Nothing
   )
@@ -64,49 +51,49 @@ testObject_Asset_asset_3 =
 testObject_Asset_asset_4 :: Asset
 testObject_Asset_asset_4 =
   ( mkAsset
-      (AssetKeyV3 (Id (fromJust (UUID.fromString "00000063-0000-0044-0000-003000000059"))) AssetEternalInfrequentAccess)
+      (Qualified (AssetKeyV3 (Id (fromJust (UUID.fromString "00000063-0000-0044-0000-003000000059"))) AssetEternalInfrequentAccess) (Domain "example.com"))
       & assetExpires .~ (fmap read (Nothing))
       & assetToken .~ Just (AssetToken {assetTokenAscii = (fromRight undefined (validate ("IRKruiPSiANiX1fL")))})
   )
 
 testObject_Asset_asset_5 :: Asset
 testObject_Asset_asset_5 =
-  ( mkAsset (AssetKeyV3 (Id (fromJust (UUID.fromString "00000019-0000-005b-0000-001d00000056"))) AssetVolatile)
+  ( mkAsset (Qualified (AssetKeyV3 (Id (fromJust (UUID.fromString "00000019-0000-005b-0000-001d00000056"))) AssetVolatile) (Domain "example.com"))
       & assetExpires .~ (fmap read (Just "1864-05-11 14:38:25.874 UTC"))
       & assetToken .~ Just (AssetToken {assetTokenAscii = (fromRight undefined (validate ("BrbiaM1RxJlqjlqq7quuPSc=")))})
   )
 
 testObject_Asset_asset_6 :: Asset
 testObject_Asset_asset_6 =
-  ( mkAsset (AssetKeyV3 (Id (fromJust (UUID.fromString "0000000e-0000-0046-0000-00560000005e"))) AssetPersistent)
+  ( mkAsset (Qualified (AssetKeyV3 (Id (fromJust (UUID.fromString "0000000e-0000-0046-0000-00560000005e"))) AssetPersistent) (Domain "example.com"))
       & assetExpires .~ (fmap read (Just "1864-05-25 01:19:16.676 UTC"))
       & assetToken .~ Nothing
   )
 
 testObject_Asset_asset_7 :: Asset
 testObject_Asset_asset_7 =
-  ( mkAsset (AssetKeyV3 (Id (fromJust (UUID.fromString "00000013-0000-002e-0000-003000000042"))) AssetEternal)
+  ( mkAsset (Qualified (AssetKeyV3 (Id (fromJust (UUID.fromString "00000013-0000-002e-0000-003000000042"))) AssetEternal) (Domain "example.com"))
       & assetExpires .~ (fmap read (Just "1864-04-14 08:45:43.05 UTC"))
       & assetToken .~ Just (AssetToken {assetTokenAscii = (fromRight undefined (validate ("_N9ERJGmbZtd6XlW_6O12bxuNe4=")))})
   )
 
 testObject_Asset_asset_8 :: Asset
 testObject_Asset_asset_8 =
-  ( mkAsset (AssetKeyV3 (Id (fromJust (UUID.fromString "00000073-0000-003e-0000-00120000000c"))) AssetEternal)
+  ( mkAsset (Qualified (AssetKeyV3 (Id (fromJust (UUID.fromString "00000073-0000-003e-0000-00120000000c"))) AssetEternal) (Domain "example.com"))
       & assetExpires .~ (fmap read (Nothing))
       & assetToken .~ Nothing
   )
 
 testObject_Asset_asset_9 :: Asset
 testObject_Asset_asset_9 =
-  ( mkAsset (AssetKeyV3 (Id (fromJust (UUID.fromString "00000006-0000-004b-0000-004f00000025"))) AssetPersistent)
+  ( mkAsset (Qualified (AssetKeyV3 (Id (fromJust (UUID.fromString "00000006-0000-004b-0000-004f00000025"))) AssetPersistent) (Domain "example.com"))
       & assetExpires .~ (fmap read (Just "1864-05-21 01:34:09.726 UTC"))
       & assetToken .~ Nothing
   )
 
 testObject_Asset_asset_10 :: Asset
 testObject_Asset_asset_10 =
-  ( mkAsset (AssetKeyV3 (Id (fromJust (UUID.fromString "00000065-0000-0080-0000-003400000061"))) AssetEternal)
+  ( mkAsset (Qualified (AssetKeyV3 (Id (fromJust (UUID.fromString "00000065-0000-0080-0000-003400000061"))) AssetEternal) (Domain "example.com"))
       & assetExpires .~ (fmap read (Nothing))
       & assetToken .~ Nothing
   )
@@ -114,14 +101,14 @@ testObject_Asset_asset_10 =
 testObject_Asset_asset_11 :: Asset
 testObject_Asset_asset_11 =
   ( mkAsset
-      (AssetKeyV3 (Id (fromJust (UUID.fromString "00000014-0000-0077-0000-001e00000076"))) AssetEternalInfrequentAccess)
+      (Qualified (AssetKeyV3 (Id (fromJust (UUID.fromString "00000014-0000-0077-0000-001e00000076"))) AssetEternalInfrequentAccess) (Domain "example.com"))
       & assetExpires .~ (fmap read (Just "1864-05-11 16:58:59.746 UTC"))
       & assetToken .~ Just (AssetToken {assetTokenAscii = (fromRight undefined (validate ("DnlRW9Q=")))})
   )
 
 testObject_Asset_asset_12 :: Asset
 testObject_Asset_asset_12 =
-  ( mkAsset (AssetKeyV3 (Id (fromJust (UUID.fromString "0000001d-0000-0076-0000-003800000021"))) AssetPersistent)
+  ( mkAsset (Qualified (AssetKeyV3 (Id (fromJust (UUID.fromString "0000001d-0000-0076-0000-003800000021"))) AssetPersistent) (Domain "example.com"))
       & assetExpires .~ (fmap read (Nothing))
       & assetToken .~ Nothing
   )
@@ -129,7 +116,7 @@ testObject_Asset_asset_12 =
 testObject_Asset_asset_13 :: Asset
 testObject_Asset_asset_13 =
   ( mkAsset
-      (AssetKeyV3 (Id (fromJust (UUID.fromString "00000030-0000-0036-0000-003c0000000a"))) AssetEternalInfrequentAccess)
+      (Qualified (AssetKeyV3 (Id (fromJust (UUID.fromString "00000030-0000-0036-0000-003c0000000a"))) AssetEternalInfrequentAccess) (Domain "example.com"))
       & assetExpires .~ (fmap read (Just "1864-04-30 19:37:57.302 UTC"))
       & assetToken .~ Just (AssetToken {assetTokenAscii = (fromRight undefined (validate ("n7CJBcdOSKznRmOypWXsGfEE0g==")))})
   )
@@ -137,42 +124,42 @@ testObject_Asset_asset_13 =
 testObject_Asset_asset_14 :: Asset
 testObject_Asset_asset_14 =
   ( mkAsset
-      (AssetKeyV3 (Id (fromJust (UUID.fromString "00000047-0000-0012-0000-005500000062"))) AssetEternalInfrequentAccess)
+      (Qualified (AssetKeyV3 (Id (fromJust (UUID.fromString "00000047-0000-0012-0000-005500000062"))) AssetEternalInfrequentAccess) (Domain "example.com"))
       & assetExpires .~ (fmap read (Just "1864-05-06 09:09:55.146 UTC"))
       & assetToken .~ Just (AssetToken {assetTokenAscii = (fromRight undefined (validate ("LYfUg4qlMjw=")))})
   )
 
 testObject_Asset_asset_15 :: Asset
 testObject_Asset_asset_15 =
-  ( mkAsset (AssetKeyV3 (Id (fromJust (UUID.fromString "00000030-0000-0074-0000-00660000004c"))) AssetPersistent)
+  ( mkAsset (Qualified (AssetKeyV3 (Id (fromJust (UUID.fromString "00000030-0000-0074-0000-00660000004c"))) AssetPersistent) (Domain "example.com"))
       & assetExpires .~ (fmap read (Nothing))
       & assetToken .~ Nothing
   )
 
 testObject_Asset_asset_16 :: Asset
 testObject_Asset_asset_16 =
-  ( mkAsset (AssetKeyV3 (Id (fromJust (UUID.fromString "00000048-0000-0051-0000-005d00000070"))) AssetVolatile)
+  ( mkAsset (Qualified (AssetKeyV3 (Id (fromJust (UUID.fromString "00000048-0000-0051-0000-005d00000070"))) AssetVolatile) (Domain "example.com"))
       & assetExpires .~ (fmap read (Just "1864-05-04 02:19:12.52 UTC"))
       & assetToken .~ Nothing
   )
 
 testObject_Asset_asset_17 :: Asset
 testObject_Asset_asset_17 =
-  ( mkAsset (AssetKeyV3 (Id (fromJust (UUID.fromString "00000017-0000-000d-0000-00680000003e"))) AssetPersistent)
+  ( mkAsset (Qualified (AssetKeyV3 (Id (fromJust (UUID.fromString "00000017-0000-000d-0000-00680000003e"))) AssetPersistent) (Domain "example.com"))
       & assetExpires .~ (fmap read (Just "1864-04-09 17:00:39.763 UTC"))
       & assetToken .~ Nothing
   )
 
 testObject_Asset_asset_18 :: Asset
 testObject_Asset_asset_18 =
-  ( mkAsset (AssetKeyV3 (Id (fromJust (UUID.fromString "0000003e-0000-0032-0000-004d00000070"))) AssetEternal)
+  ( mkAsset (Qualified (AssetKeyV3 (Id (fromJust (UUID.fromString "0000003e-0000-0032-0000-004d00000070"))) AssetEternal) (Domain "example.com"))
       & assetExpires .~ (fmap read (Just "1864-04-12 20:53:21.25 UTC"))
       & assetToken .~ Nothing
   )
 
 testObject_Asset_asset_19 :: Asset
 testObject_Asset_asset_19 =
-  ( mkAsset (AssetKeyV3 (Id (fromJust (UUID.fromString "00000021-0000-0062-0000-002a0000006b"))) AssetVolatile)
+  ( mkAsset (Qualified (AssetKeyV3 (Id (fromJust (UUID.fromString "00000021-0000-0062-0000-002a0000006b"))) AssetVolatile) (Domain "example.com"))
       & assetExpires
       .~ (fmap read (Nothing))
       & assetToken
@@ -181,7 +168,7 @@ testObject_Asset_asset_19 =
 
 testObject_Asset_asset_20 :: Asset
 testObject_Asset_asset_20 =
-  ( mkAsset (AssetKeyV3 (Id (fromJust (UUID.fromString "00000053-0000-0072-0000-001700000047"))) AssetVolatile)
+  ( mkAsset (Qualified (AssetKeyV3 (Id (fromJust (UUID.fromString "00000053-0000-0072-0000-001700000047"))) AssetVolatile) (Domain "example.com"))
       & assetExpires .~ (fmap read (Just "1864-04-25 16:48:39.986 UTC"))
       & assetToken .~ Nothing
   )
diff --git a/libs/wire-api/test/golden/testObject_Asset_asset_1.json b/libs/wire-api/test/golden/testObject_Asset_asset_1.json
index 9bef9870da2..d4f078bbfb5 100644
--- a/libs/wire-api/test/golden/testObject_Asset_asset_1.json
+++ b/libs/wire-api/test/golden/testObject_Asset_asset_1.json
@@ -1,4 +1,5 @@
 {
+    "domain": "example.com",
     "expires": "1864-04-30T15:58:55.452Z",
     "key": "3-5-0000004b-0000-0017-0000-003e00000033",
     "token": "Kun4JaxR6QuASXywDhzx"
diff --git a/libs/wire-api/test/golden/testObject_Asset_asset_10.json b/libs/wire-api/test/golden/testObject_Asset_asset_10.json
index 1d25e3b58cd..c495e0a86cb 100644
--- a/libs/wire-api/test/golden/testObject_Asset_asset_10.json
+++ b/libs/wire-api/test/golden/testObject_Asset_asset_10.json
@@ -1,3 +1,4 @@
 {
+    "domain": "example.com",
     "key": "3-1-00000065-0000-0080-0000-003400000061"
 }
diff --git a/libs/wire-api/test/golden/testObject_Asset_asset_11.json b/libs/wire-api/test/golden/testObject_Asset_asset_11.json
index d6e74f8e6ee..2b6ee63fdd3 100644
--- a/libs/wire-api/test/golden/testObject_Asset_asset_11.json
+++ b/libs/wire-api/test/golden/testObject_Asset_asset_11.json
@@ -1,4 +1,5 @@
 {
+    "domain": "example.com",
     "expires": "1864-05-11T16:58:59.746Z",
     "key": "3-4-00000014-0000-0077-0000-001e00000076",
     "token": "DnlRW9Q="
diff --git a/libs/wire-api/test/golden/testObject_Asset_asset_12.json b/libs/wire-api/test/golden/testObject_Asset_asset_12.json
index eda1a4fdd6d..85bd8fd2660 100644
--- a/libs/wire-api/test/golden/testObject_Asset_asset_12.json
+++ b/libs/wire-api/test/golden/testObject_Asset_asset_12.json
@@ -1,3 +1,4 @@
 {
+    "domain": "example.com",
     "key": "3-2-0000001d-0000-0076-0000-003800000021"
 }
diff --git a/libs/wire-api/test/golden/testObject_Asset_asset_13.json b/libs/wire-api/test/golden/testObject_Asset_asset_13.json
index 8e07a56197e..2ac23c24eb5 100644
--- a/libs/wire-api/test/golden/testObject_Asset_asset_13.json
+++ b/libs/wire-api/test/golden/testObject_Asset_asset_13.json
@@ -1,4 +1,5 @@
 {
+    "domain": "example.com",
     "expires": "1864-04-30T19:37:57.302Z",
     "key": "3-4-00000030-0000-0036-0000-003c0000000a",
     "token": "n7CJBcdOSKznRmOypWXsGfEE0g=="
diff --git a/libs/wire-api/test/golden/testObject_Asset_asset_14.json b/libs/wire-api/test/golden/testObject_Asset_asset_14.json
index 442e5562469..a70a668bc8b 100644
--- a/libs/wire-api/test/golden/testObject_Asset_asset_14.json
+++ b/libs/wire-api/test/golden/testObject_Asset_asset_14.json
@@ -1,4 +1,5 @@
 {
+    "domain": "example.com",
     "expires": "1864-05-06T09:09:55.146Z",
     "key": "3-4-00000047-0000-0012-0000-005500000062",
     "token": "LYfUg4qlMjw="
diff --git a/libs/wire-api/test/golden/testObject_Asset_asset_15.json b/libs/wire-api/test/golden/testObject_Asset_asset_15.json
index f49cd13e46a..770067088cd 100644
--- a/libs/wire-api/test/golden/testObject_Asset_asset_15.json
+++ b/libs/wire-api/test/golden/testObject_Asset_asset_15.json
@@ -1,3 +1,4 @@
 {
+    "domain": "example.com",
     "key": "3-2-00000030-0000-0074-0000-00660000004c"
 }
diff --git a/libs/wire-api/test/golden/testObject_Asset_asset_16.json b/libs/wire-api/test/golden/testObject_Asset_asset_16.json
index 69e6e5f1816..bf6597141cf 100644
--- a/libs/wire-api/test/golden/testObject_Asset_asset_16.json
+++ b/libs/wire-api/test/golden/testObject_Asset_asset_16.json
@@ -1,4 +1,5 @@
 {
+    "domain": "example.com",
     "expires": "1864-05-04T02:19:12.520Z",
     "key": "3-3-00000048-0000-0051-0000-005d00000070"
 }
diff --git a/libs/wire-api/test/golden/testObject_Asset_asset_17.json b/libs/wire-api/test/golden/testObject_Asset_asset_17.json
index ccb77a2d1c5..5a4e7a4811f 100644
--- a/libs/wire-api/test/golden/testObject_Asset_asset_17.json
+++ b/libs/wire-api/test/golden/testObject_Asset_asset_17.json
@@ -1,4 +1,5 @@
 {
+    "domain": "example.com",
     "expires": "1864-04-09T17:00:39.763Z",
     "key": "3-2-00000017-0000-000d-0000-00680000003e"
 }
diff --git a/libs/wire-api/test/golden/testObject_Asset_asset_18.json b/libs/wire-api/test/golden/testObject_Asset_asset_18.json
index 516f95363ff..8f02aeae56c 100644
--- a/libs/wire-api/test/golden/testObject_Asset_asset_18.json
+++ b/libs/wire-api/test/golden/testObject_Asset_asset_18.json
@@ -1,4 +1,5 @@
 {
+    "domain": "example.com",
     "expires": "1864-04-12T20:53:21.250Z",
     "key": "3-1-0000003e-0000-0032-0000-004d00000070"
 }
diff --git a/libs/wire-api/test/golden/testObject_Asset_asset_19.json b/libs/wire-api/test/golden/testObject_Asset_asset_19.json
index 4b62e85e30c..c8ea25d227f 100644
--- a/libs/wire-api/test/golden/testObject_Asset_asset_19.json
+++ b/libs/wire-api/test/golden/testObject_Asset_asset_19.json
@@ -1,4 +1,5 @@
 {
+    "domain": "example.com",
     "key": "3-3-00000021-0000-0062-0000-002a0000006b",
     "token": "4wm3D03aqvZ_0oKFtwXCYnSTC7m_z1E="
 }
diff --git a/libs/wire-api/test/golden/testObject_Asset_asset_2.json b/libs/wire-api/test/golden/testObject_Asset_asset_2.json
index 3a8d556bd57..a4e0765c06c 100644
--- a/libs/wire-api/test/golden/testObject_Asset_asset_2.json
+++ b/libs/wire-api/test/golden/testObject_Asset_asset_2.json
@@ -1,4 +1,5 @@
 {
+    "domain": "example.com",
     "expires": "1864-06-04T17:39:43.924Z",
     "key": "3-4-00000008-0000-006c-0000-001900000036",
     "token": "mPuul678vuJVZ_u9lQ=="
diff --git a/libs/wire-api/test/golden/testObject_Asset_asset_20.json b/libs/wire-api/test/golden/testObject_Asset_asset_20.json
index ee08bfe6d13..3cd958cedc2 100644
--- a/libs/wire-api/test/golden/testObject_Asset_asset_20.json
+++ b/libs/wire-api/test/golden/testObject_Asset_asset_20.json
@@ -1,4 +1,5 @@
 {
+    "domain": "example.com",
     "expires": "1864-04-25T16:48:39.986Z",
     "key": "3-3-00000053-0000-0072-0000-001700000047"
 }
diff --git a/libs/wire-api/test/golden/testObject_Asset_asset_3.json b/libs/wire-api/test/golden/testObject_Asset_asset_3.json
index eb3537825f3..13b90b2b057 100644
--- a/libs/wire-api/test/golden/testObject_Asset_asset_3.json
+++ b/libs/wire-api/test/golden/testObject_Asset_asset_3.json
@@ -1,4 +1,5 @@
 {
+    "domain": "example.com",
     "expires": "1864-05-18T20:18:13.438Z",
     "key": "3-1-00000055-0000-0071-0000-002e00000020"
 }
diff --git a/libs/wire-api/test/golden/testObject_Asset_asset_4.json b/libs/wire-api/test/golden/testObject_Asset_asset_4.json
index d43de9f1101..fc65d82c3c0 100644
--- a/libs/wire-api/test/golden/testObject_Asset_asset_4.json
+++ b/libs/wire-api/test/golden/testObject_Asset_asset_4.json
@@ -1,4 +1,5 @@
 {
+    "domain": "example.com",
     "key": "3-4-00000063-0000-0044-0000-003000000059",
     "token": "IRKruiPSiANiX1fL"
 }
diff --git a/libs/wire-api/test/golden/testObject_Asset_asset_5.json b/libs/wire-api/test/golden/testObject_Asset_asset_5.json
index 0bd2857635e..37a8a6a8dc7 100644
--- a/libs/wire-api/test/golden/testObject_Asset_asset_5.json
+++ b/libs/wire-api/test/golden/testObject_Asset_asset_5.json
@@ -1,4 +1,5 @@
 {
+    "domain": "example.com",
     "expires": "1864-05-11T14:38:25.874Z",
     "key": "3-3-00000019-0000-005b-0000-001d00000056",
     "token": "BrbiaM1RxJlqjlqq7quuPSc="
diff --git a/libs/wire-api/test/golden/testObject_Asset_asset_6.json b/libs/wire-api/test/golden/testObject_Asset_asset_6.json
index 8d9571f2dc1..506b8af9ecc 100644
--- a/libs/wire-api/test/golden/testObject_Asset_asset_6.json
+++ b/libs/wire-api/test/golden/testObject_Asset_asset_6.json
@@ -1,4 +1,5 @@
 {
+    "domain": "example.com",
     "expires": "1864-05-25T01:19:16.676Z",
     "key": "3-2-0000000e-0000-0046-0000-00560000005e"
 }
diff --git a/libs/wire-api/test/golden/testObject_Asset_asset_7.json b/libs/wire-api/test/golden/testObject_Asset_asset_7.json
index b97f270a807..5d9fd890b0b 100644
--- a/libs/wire-api/test/golden/testObject_Asset_asset_7.json
+++ b/libs/wire-api/test/golden/testObject_Asset_asset_7.json
@@ -1,4 +1,5 @@
 {
+    "domain": "example.com",
     "expires": "1864-04-14T08:45:43.050Z",
     "key": "3-1-00000013-0000-002e-0000-003000000042",
     "token": "_N9ERJGmbZtd6XlW_6O12bxuNe4="
diff --git a/libs/wire-api/test/golden/testObject_Asset_asset_8.json b/libs/wire-api/test/golden/testObject_Asset_asset_8.json
index 434d93f714c..e23c34c5439 100644
--- a/libs/wire-api/test/golden/testObject_Asset_asset_8.json
+++ b/libs/wire-api/test/golden/testObject_Asset_asset_8.json
@@ -1,3 +1,4 @@
 {
+    "domain": "example.com",
     "key": "3-1-00000073-0000-003e-0000-00120000000c"
 }
diff --git a/libs/wire-api/test/golden/testObject_Asset_asset_9.json b/libs/wire-api/test/golden/testObject_Asset_asset_9.json
index 5e7097dcd98..5c33c2d979f 100644
--- a/libs/wire-api/test/golden/testObject_Asset_asset_9.json
+++ b/libs/wire-api/test/golden/testObject_Asset_asset_9.json
@@ -1,4 +1,5 @@
 {
+    "domain": "example.com",
     "expires": "1864-05-21T01:34:09.726Z",
     "key": "3-2-00000006-0000-004b-0000-004f00000025"
 }
diff --git a/libs/wire-api/test/golden/testObject_UserIdentity_user_16.json b/libs/wire-api/test/golden/testObject_UserIdentity_user_16.json
deleted file mode 100644
index 156ade504d6..00000000000
--- a/libs/wire-api/test/golden/testObject_UserIdentity_user_16.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-    "email": "%x\u0013􀔑\u0004.@G빯t.6",
-    "phone": "+298116118047",
-    "sso_id": {
-        "subject": "<NameID xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" xmlns:samla=\"urn:oasis:names:tc:SAML:2.0:assertion\" xmlns:samlm=\"urn:oasis:names:tc:SAML:2.0:metadata\" xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\" Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\" xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\">me@example.com</NameID>",
-        "tenant": "<Issuer xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" xmlns:samla=\"urn:oasis:names:tc:SAML:2.0:assertion\" xmlns:samlm=\"urn:oasis:names:tc:SAML:2.0:metadata\" xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\" xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\">http://example.com</Issuer>"
-    }
-}
diff --git a/libs/wire-api/test/golden/testObject_UserIdentity_user_5.json b/libs/wire-api/test/golden/testObject_UserIdentity_user_5.json
deleted file mode 100644
index 902e47fbe87..00000000000
--- a/libs/wire-api/test/golden/testObject_UserIdentity_user_5.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-    "email": null,
-    "phone": "+49198172826",
-    "sso_id": {
-        "subject": "<NameID xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" xmlns:samla=\"urn:oasis:names:tc:SAML:2.0:assertion\" xmlns:samlm=\"urn:oasis:names:tc:SAML:2.0:metadata\" xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\" Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\" xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\">me@example.com</NameID>",
-        "tenant": "<Issuer xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" xmlns:samla=\"urn:oasis:names:tc:SAML:2.0:assertion\" xmlns:samlm=\"urn:oasis:names:tc:SAML:2.0:metadata\" xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\" xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\">http://example.com</Issuer>"
-    }
-}
diff --git a/libs/wire-api/test/golden/testObject_UserIdentity_user_8.json b/libs/wire-api/test/golden/testObject_UserIdentity_user_8.json
deleted file mode 100644
index f9a46004b6f..00000000000
--- a/libs/wire-api/test/golden/testObject_UserIdentity_user_8.json
+++ /dev/null
@@ -1,8 +0,0 @@
-{
-    "email": null,
-    "phone": "+149548802116267",
-    "sso_id": {
-        "subject": "<NameID xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" xmlns:samla=\"urn:oasis:names:tc:SAML:2.0:assertion\" xmlns:samlm=\"urn:oasis:names:tc:SAML:2.0:metadata\" xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\" Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\" xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\">me@example.com</NameID>",
-        "tenant": "<Issuer xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" xmlns:samla=\"urn:oasis:names:tc:SAML:2.0:assertion\" xmlns:samlm=\"urn:oasis:names:tc:SAML:2.0:metadata\" xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\" xmlns=\"urn:oasis:names:tc:SAML:2.0:assertion\">http://example.com</Issuer>"
-    }
-}
diff --git a/libs/wire-api/test/golden/testObject_UserSSOId_user_1.json b/libs/wire-api/test/golden/testObject_UserSSOId_user_1.json
deleted file mode 100644
index 520bcfc7dad..00000000000
--- a/libs/wire-api/test/golden/testObject_UserSSOId_user_1.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-    "subject": "𝢱􁱝S\u0006\\\u0017\\",
-    "tenant": "#ph􀽌"
-}
diff --git a/libs/wire-api/test/golden/testObject_UserSSOId_user_10.json b/libs/wire-api/test/golden/testObject_UserSSOId_user_10.json
deleted file mode 100644
index 269300657d1..00000000000
--- a/libs/wire-api/test/golden/testObject_UserSSOId_user_10.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-    "subject": "􀞢^}Y7A\u0014󰐺\u001bF",
-    "tenant": "oo\"u/]5"
-}
diff --git a/libs/wire-api/test/golden/testObject_UserSSOId_user_11.json b/libs/wire-api/test/golden/testObject_UserSSOId_user_11.json
deleted file mode 100644
index 46b703e246b..00000000000
--- a/libs/wire-api/test/golden/testObject_UserSSOId_user_11.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-    "scim_external_id": "U㞠\u00129[𮥂z􆔇ⵍ􎹘#~􀐽D\u0003[􏈫u𦷊h똶㕠2 c4􄯇\u000e"
-}
diff --git a/libs/wire-api/test/golden/testObject_UserSSOId_user_12.json b/libs/wire-api/test/golden/testObject_UserSSOId_user_12.json
deleted file mode 100644
index db68edf1a29..00000000000
--- a/libs/wire-api/test/golden/testObject_UserSSOId_user_12.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-    "subject": "􏺁\u001bg𑄉",
-    "tenant": "\na,"
-}
diff --git a/libs/wire-api/test/golden/testObject_UserSSOId_user_14.json b/libs/wire-api/test/golden/testObject_UserSSOId_user_14.json
deleted file mode 100644
index 4d74fb56c90..00000000000
--- a/libs/wire-api/test/golden/testObject_UserSSOId_user_14.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-    "subject": "g\ta\u001d󳹝[a\u0013𢝝oA",
-    "tenant": "g􉙇)By𡑗h.\u000c\u00179@"
-}
diff --git a/libs/wire-api/test/golden/testObject_UserSSOId_user_15.json b/libs/wire-api/test/golden/testObject_UserSSOId_user_15.json
deleted file mode 100644
index 69528cc5164..00000000000
--- a/libs/wire-api/test/golden/testObject_UserSSOId_user_15.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-    "scim_external_id": "a9qᩤ󶴏nM]vM\u0012t풣_'\u0010t1MJb{󼥁\u001dZC\u0006"
-}
diff --git a/libs/wire-api/test/golden/testObject_UserSSOId_user_16.json b/libs/wire-api/test/golden/testObject_UserSSOId_user_16.json
deleted file mode 100644
index 9b9641de712..00000000000
--- a/libs/wire-api/test/golden/testObject_UserSSOId_user_16.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-    "scim_external_id": "Ltepz\u0006\u001c\u001c\u0000􇀶󽍉}𡃭N뫴7GJ"
-}
diff --git a/libs/wire-api/test/golden/testObject_UserSSOId_user_17.json b/libs/wire-api/test/golden/testObject_UserSSOId_user_17.json
deleted file mode 100644
index 830c5048c44..00000000000
--- a/libs/wire-api/test/golden/testObject_UserSSOId_user_17.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-    "scim_external_id": "qj𤂎.^"
-}
diff --git a/libs/wire-api/test/golden/testObject_UserSSOId_user_18.json b/libs/wire-api/test/golden/testObject_UserSSOId_user_18.json
deleted file mode 100644
index 764dfe765c5..00000000000
--- a/libs/wire-api/test/golden/testObject_UserSSOId_user_18.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-    "scim_external_id": "𒍧"
-}
diff --git a/libs/wire-api/test/golden/testObject_UserSSOId_user_19.json b/libs/wire-api/test/golden/testObject_UserSSOId_user_19.json
deleted file mode 100644
index f1874f30cf6..00000000000
--- a/libs/wire-api/test/golden/testObject_UserSSOId_user_19.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-    "scim_external_id": "!𛉋mᅛ\u0018\u001dA\u0010󿃯𤧇x[h\n~􋁝"
-}
diff --git a/libs/wire-api/test/golden/testObject_UserSSOId_user_20.json b/libs/wire-api/test/golden/testObject_UserSSOId_user_20.json
deleted file mode 100644
index 6476075a9dd..00000000000
--- a/libs/wire-api/test/golden/testObject_UserSSOId_user_20.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-    "subject": "\u0002b\u000e􇆽\u001b\u001d3,􅲈𠩀8𑿋",
-    "tenant": "X#\u0004 "
-}
diff --git a/libs/wire-api/test/golden/testObject_UserSSOId_user_3.json b/libs/wire-api/test/golden/testObject_UserSSOId_user_3.json
deleted file mode 100644
index 1db46e5e7f4..00000000000
--- a/libs/wire-api/test/golden/testObject_UserSSOId_user_3.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-    "subject": "𨊌4X\u0019",
-    "tenant": "i\\\u0004\r𘑍\u0015󲛚줴Vi"
-}
diff --git a/libs/wire-api/test/golden/testObject_UserSSOId_user_4.json b/libs/wire-api/test/golden/testObject_UserSSOId_user_4.json
deleted file mode 100644
index eb3dcf271d5..00000000000
--- a/libs/wire-api/test/golden/testObject_UserSSOId_user_4.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-    "subject": "􉹡0\u001b𬴯<fymc5焗i\u0018@",
-    "tenant": "0􇙊hK𤮼Rc;/[Q9s{"
-}
diff --git a/libs/wire-api/test/golden/testObject_UserSSOId_user_5.json b/libs/wire-api/test/golden/testObject_UserSSOId_user_5.json
deleted file mode 100644
index 962c32d873c..00000000000
--- a/libs/wire-api/test/golden/testObject_UserSSOId_user_5.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-    "subject": "NM&􀎴쫒",
-    "tenant": "\u0010"
-}
diff --git a/libs/wire-api/test/golden/testObject_UserSSOId_user_6.json b/libs/wire-api/test/golden/testObject_UserSSOId_user_6.json
deleted file mode 100644
index dcfd6568924..00000000000
--- a/libs/wire-api/test/golden/testObject_UserSSOId_user_6.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-    "subject": "+vR=",
-    "tenant": "􋞷빆􃚭ME+O#"
-}
diff --git a/libs/wire-api/test/golden/testObject_UserSSOId_user_7.json b/libs/wire-api/test/golden/testObject_UserSSOId_user_7.json
deleted file mode 100644
index 586b97ec300..00000000000
--- a/libs/wire-api/test/golden/testObject_UserSSOId_user_7.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-    "subject": "󵿮v",
-    "tenant": "#󱪥𪘙"
-}
diff --git a/libs/wire-api/test/golden/testObject_UserSSOId_user_8.json b/libs/wire-api/test/golden/testObject_UserSSOId_user_8.json
deleted file mode 100644
index e7659cb800c..00000000000
--- a/libs/wire-api/test/golden/testObject_UserSSOId_user_8.json
+++ /dev/null
@@ -1,4 +0,0 @@
-{
-    "subject": "C",
-    "tenant": "粻􇧟\u0000'rGF\u001b\u0010f𥷱\u0005Q"
-}
diff --git a/libs/wire-api/test/unit/Test/Wire/API/Roundtrip/ByteString.hs b/libs/wire-api/test/unit/Test/Wire/API/Roundtrip/ByteString.hs
index 05cb4d975d0..4e2fe631baf 100644
--- a/libs/wire-api/test/unit/Test/Wire/API/Roundtrip/ByteString.hs
+++ b/libs/wire-api/test/unit/Test/Wire/API/Roundtrip/ByteString.hs
@@ -23,7 +23,7 @@ import qualified Test.Tasty as T
 import Test.Tasty.QuickCheck (Arbitrary, counterexample, testProperty, (===))
 import Type.Reflection (typeRep)
 import qualified Wire.API.Arbitrary as Arbitrary ()
-import qualified Wire.API.Asset.V3 as Asset.V3
+import qualified Wire.API.Asset as Asset
 import qualified Wire.API.Call.Config as Call.Config
 import qualified Wire.API.Conversation.Code as Conversation.Code
 import qualified Wire.API.Conversation.Role as Conversation.Role
@@ -46,9 +46,9 @@ import qualified Wire.API.User.Search as User.Search
 tests :: T.TestTree
 tests =
   T.localOption (T.Timeout (60 * 1000000) "60s") . T.testGroup "ByteString roundtrip tests" $
-    [ testRoundTrip @Asset.V3.AssetKey,
-      testRoundTrip @Asset.V3.AssetRetention,
-      testRoundTrip @Asset.V3.AssetToken,
+    [ testRoundTrip @Asset.AssetKey,
+      testRoundTrip @Asset.AssetRetention,
+      testRoundTrip @Asset.AssetToken,
       testRoundTrip @Call.Config.Scheme,
       testRoundTrip @Call.Config.Transport,
       testRoundTrip @Call.Config.TurnHost,
diff --git a/services/cargohold/cargohold.cabal b/services/cargohold/cargohold.cabal
index d254bedd2a6..057edb3ebff 100644
--- a/services/cargohold/cargohold.cabal
+++ b/services/cargohold/cargohold.cabal
@@ -4,7 +4,7 @@ cabal-version: 1.12
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: cd2a03f62587d5c87a0542f95b7124ff553f9ac6ec40dd1ea1cbfe2fd8ace570
+-- hash: 253f7aaf3d9981e1ce5a3654d10d5aa926f6347fbb86c510d4eb2997e869e499
 
 name:           cargohold
 version:        1.5.0
@@ -135,6 +135,7 @@ executable cargohold-integration
   main-is: Main.hs
   other-modules:
       API.V3
+      API.V4
       Metrics
       TestSetup
       Paths_cargohold
@@ -173,5 +174,6 @@ executable cargohold-integration
     , types-common >=0.7
     , uuid >=1.3
     , wai-utilities >=0.12
+    , wire-api
     , yaml >=0.8
   default-language: Haskell2010
diff --git a/services/cargohold/package.yaml b/services/cargohold/package.yaml
index d4bd3dfbcdc..09cd81ee873 100644
--- a/services/cargohold/package.yaml
+++ b/services/cargohold/package.yaml
@@ -81,6 +81,7 @@ executables:
     - types-common >=0.7
     - uuid >=1.3
     - wai-utilities >=0.12
+    - wire-api
   cargohold:
     main: src/Main.hs
     ghc-options:
diff --git a/services/cargohold/test/integration/API/V4.hs b/services/cargohold/test/integration/API/V4.hs
new file mode 100644
index 00000000000..b9b8e556705
--- /dev/null
+++ b/services/cargohold/test/integration/API/V4.hs
@@ -0,0 +1,282 @@
+{-# OPTIONS_GHC -Wno-incomplete-uni-patterns #-}
+
+-- This file is part of the Wire Server implementation.
+--
+-- Copyright (C) 2020 Wire Swiss GmbH <opensource@wire.com>
+--
+-- This program is free software: you can redistribute it and/or modify it under
+-- the terms of the GNU Affero General Public License as published by the Free
+-- Software Foundation, either version 3 of the License, or (at your option) any
+-- later version.
+--
+-- This program is distributed in the hope that it will be useful, but WITHOUT
+-- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+-- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+-- details.
+--
+-- You should have received a copy of the GNU Affero General Public License along
+-- with this program. If not, see <https://www.gnu.org/licenses/>.
+
+module API.V4 (tests) where
+
+import Bilge hiding (body)
+import Bilge.Assert
+import qualified Codec.MIME.Parse as MIME
+import qualified Codec.MIME.Type as MIME
+import Control.Lens hiding (sets)
+import Data.ByteString.Builder
+import qualified Data.ByteString.Char8 as C8
+import Data.ByteString.Conversion
+import qualified Data.ByteString.Lazy as Lazy
+import Data.Id
+import Data.Qualified
+import Data.Text.Encoding (decodeLatin1)
+import Data.Time.Clock
+import Data.Time.Format
+import qualified Data.UUID as UUID
+import Data.UUID.V4
+import Imports hiding (head)
+import Network.HTTP.Client (parseUrlThrow)
+import Network.HTTP.Types.Header
+import Network.HTTP.Types.Method
+import Network.HTTP.Types.Status (status200)
+import Network.Wai.Utilities (Error (label))
+import Test.Tasty
+import Test.Tasty.HUnit
+import TestSetup
+import Wire.API.Asset
+
+tests :: IO TestSetup -> TestTree
+tests s =
+  testGroup
+    "API Integration v4"
+    [ testGroup
+        "simple"
+        [ test s "roundtrip" testSimpleRoundtrip,
+          test s "tokens" testSimpleTokens,
+          test s "s3-upstream-closed" testSimpleS3ClosedConnectionReuse,
+          test s "client-compatibility" testUploadCompatibility
+        ]
+    ]
+
+--------------------------------------------------------------------------------
+-- Simple (single-step) uploads
+
+testSimpleRoundtrip :: TestSignature ()
+testSimpleRoundtrip c = do
+  let def = defAssetSettings
+  let rets = [minBound ..]
+  let sets = def : map (\r -> def & setAssetRetention ?~ r) rets
+  mapM_ simpleRoundtrip sets
+  where
+    simpleRoundtrip sets = do
+      uid <- liftIO $ Id <$> nextRandom
+      uid2 <- liftIO $ Id <$> nextRandom
+      -- Initial upload
+      let bdy = (applicationText, "Hello World")
+      r1 <-
+        uploadSimple (c . path "/assets/v3") uid sets bdy
+          <!! const 201 === statusCode
+      let loc = decodeHeader "Location" r1 :: ByteString
+      let Just ast = responseJsonMaybe @Asset r1
+      let Just tok = view assetToken ast
+      -- Check mandatory Date header
+      let Just date = C8.unpack <$> lookup "Date" (responseHeaders r1)
+      let utc = parseTimeOrError False defaultTimeLocale rfc822DateFormat date :: UTCTime
+      -- Potentially check for the expires header
+      when (isJust $ join (assetRetentionSeconds <$> (sets ^. setAssetRetention))) $ do
+        liftIO $ assertBool "invalid expiration" (Just utc < view assetExpires ast)
+      -- Lookup with token and download via redirect.
+      r2 <-
+        get (c . path loc . zUser uid . header "Asset-Token" (toByteString' tok) . noRedirect) <!! do
+          const 302 === statusCode
+          const Nothing === responseBody
+      r3 <- flip get' id =<< parseUrlThrow (C8.unpack (getHeader' "Location" r2))
+      liftIO $ do
+        assertEqual "status" status200 (responseStatus r3)
+        assertEqual "content-type should always be application/octet-stream" (Just applicationOctetStream) (getContentType r3)
+        assertEqual "token mismatch" tok (decodeHeader "x-amz-meta-token" r3)
+        assertEqual "user mismatch" uid (decodeHeader "x-amz-meta-user" r3)
+        assertEqual "data mismatch" (Just "Hello World") (responseBody r3)
+      -- Delete (forbidden for other users)
+      deleteAsset c uid2 (view assetKey ast) !!! const 403 === statusCode
+      -- Delete (allowed for creator)
+      deleteAsset c uid (view assetKey ast) !!! const 200 === statusCode
+      r4 <-
+        get (c . path loc . zUser uid . header "Asset-Token" (toByteString' tok) . noRedirect)
+          <!! const 404 === statusCode
+      let Just date' = C8.unpack <$> lookup "Date" (responseHeaders r4)
+      let utc' = parseTimeOrError False defaultTimeLocale rfc822DateFormat date' :: UTCTime
+      liftIO $ assertBool "bad date" (utc' >= utc)
+
+testSimpleTokens :: TestSignature ()
+testSimpleTokens c = do
+  uid <- liftIO $ Id <$> nextRandom
+  uid2 <- liftIO $ Id <$> nextRandom
+  -- Initial upload
+  let sets = defAssetSettings & set setAssetRetention (Just AssetVolatile)
+  let bdy = (applicationText, "Hello World")
+  r1 <-
+    uploadSimple (c . path "/assets/v3") uid sets bdy
+      <!! const 201 === statusCode
+  let loc = decodeHeader "Location" r1 :: ByteString
+  let Just ast = responseJsonMaybe @Asset r1
+  let key = view assetKey ast
+  let Just tok = view assetToken ast
+  -- No access without token from other user (opaque 404)
+  get (c . path loc . zUser uid2 . noRedirect)
+    !!! const 404 === statusCode
+  -- No access with wrong token (opaque 404)
+  get (c . path loc . zUser uid2 . header "Asset-Token" "acb123" . noRedirect)
+    !!! const 404 === statusCode
+  -- Token renewal fails if not done by owner
+  post (c . paths ["assets", "v3", toByteString' (qUnqualified key), "token"] . zUser uid2) !!! do
+    const 403 === statusCode
+    const (Just "unauthorised") === fmap label . responseJsonMaybe
+  -- Token renewal succeeds if done by owner
+  r2 <-
+    post (c . paths ["assets", "v3", toByteString' (qUnqualified key), "token"] . zUser uid)
+      <!! const 200 === statusCode
+  let Just tok' = newAssetToken <$> responseJsonMaybe r2
+  liftIO $ assertBool "token unchanged" (tok /= tok')
+  -- Download by owner with new token.
+  r3 <-
+    get (c . path loc . zUser uid . header "Asset-Token" (toByteString' tok') . noRedirect) <!! do
+      const 302 === statusCode
+      const Nothing === responseBody
+  r4 <- flip get' id =<< parseUrlThrow (C8.unpack (getHeader' "Location" r3))
+  liftIO $ do
+    assertEqual "status" status200 (responseStatus r4)
+    assertEqual "content-type should always be application/octet-stream" (Just applicationOctetStream) (getContentType r4)
+    assertEqual "token mismatch" tok' (decodeHeader "x-amz-meta-token" r4)
+    assertEqual "user mismatch" uid (decodeHeader "x-amz-meta-user" r4)
+    assertEqual "data mismatch" (Just "Hello World") (responseBody r4)
+  -- Verify access without token if the request comes from the creator.
+  get (c . path loc . zUser uid . noRedirect)
+    !!! const 302 === statusCode
+  -- Verify access with new token from a different user.
+  get (c . path loc . header "Asset-Token" (toByteString' tok') . zUser uid2 . noRedirect)
+    !!! const 302 === statusCode
+  -- Delete Token fails if not done by owner
+  delete (c . paths ["assets", "v3", toByteString' (qUnqualified key), "token"] . zUser uid2) !!! do
+    const 403 === statusCode
+    const (Just "unauthorised") === fmap label . responseJsonMaybe
+  -- Delete Token succeeds by owner
+  delete (c . paths ["assets", "v3", toByteString' (qUnqualified key), "token"] . zUser uid) !!! do
+    const 200 === statusCode
+    const Nothing === responseBody
+  -- Access without token from different user (asset is now "public")
+  get (c . path loc . noRedirect . zUser uid2) !!! do
+    const 302 === statusCode
+    const Nothing === responseBody
+
+-- S3 closes idle connections after ~5 seconds, before the http-client 'Manager'
+-- does. If such a closed connection is reused for an upload, no problems should
+-- occur (i.e. the closed connection should be detected before sending any data).
+testSimpleS3ClosedConnectionReuse :: TestSignature ()
+testSimpleS3ClosedConnectionReuse c = go >> wait >> go
+  where
+    wait = liftIO $ putStrLn "Waiting for S3 idle timeout ..." >> threadDelay 7000000
+    go = do
+      uid <- liftIO $ Id <$> nextRandom
+      let sets = defAssetSettings & set setAssetRetention (Just AssetVolatile)
+      let part2 = (MIME.Type (MIME.Text "plain") [], C8.replicate 100000 'c')
+      uploadSimple (c . path "/assets/v3") uid sets part2
+        !!! const 201 === statusCode
+
+--------------------------------------------------------------------------------
+-- Client compatibility tests
+
+-- Since the other tests use functions from the server code, it can happen that
+-- an API change also changes the requests made here in the tests.
+-- This test tries to prevent us from breaking the API without noticing.
+--
+-- The body is taken directly from a request made by the web app
+-- (just replaced the content with a shorter one and updated the MD5 header).
+testUploadCompatibility :: TestSignature ()
+testUploadCompatibility c = do
+  uid <- liftIO $ Id <$> nextRandom
+  -- Initial upload
+  r1 <-
+    uploadRaw (c . path "/assets/v3") uid exampleMultipart
+      <!! const 201 === statusCode
+  let loc = decodeHeader "Location" r1 :: ByteString
+  -- Lookup and download via redirect.
+  r2 <-
+    get (c . path loc . zUser uid . noRedirect) <!! do
+      const 302 === statusCode
+      const Nothing === responseBody
+  r3 <- flip get' id =<< parseUrlThrow (C8.unpack (getHeader' "Location" r2))
+  liftIO $ do
+    assertEqual "status" status200 (responseStatus r3)
+    assertEqual "content-type mismatch" (Just applicationOctetStream) (getContentType r3)
+    assertEqual "user mismatch" uid (decodeHeader "x-amz-meta-user" r3)
+    assertEqual "data mismatch" (Just "test") (responseBody r3)
+  where
+    exampleMultipart :: LByteString
+    exampleMultipart =
+      "--FrontierIyj6RcVrqMcxNtMEWPsNpuPm325QsvWQ\r\n\
+      \Content-Type: application/json;charset=utf-8\r\n\
+      \Content-length: 37\r\n\
+      \\r\n\
+      \{\"public\":true,\"retention\":\"eternal\"}\r\n\
+      \--FrontierIyj6RcVrqMcxNtMEWPsNpuPm325QsvWQ\r\n\
+      \Content-Type: application/octet-stream\r\n\
+      \Content-length: 4\r\n\
+      \Content-MD5: CY9rzUYh03PK3k6DJie09g==\r\n\
+      \\r\n\
+      \test\r\n\
+      \--FrontierIyj6RcVrqMcxNtMEWPsNpuPm325QsvWQ--\r\n\
+      \\r\n"
+
+-- API Calls ------------------------------------------------------------------
+
+uploadSimple ::
+  CargoHold ->
+  UserId ->
+  AssetSettings ->
+  (MIME.Type, ByteString) ->
+  Http (Response (Maybe Lazy.ByteString))
+uploadSimple c usr sets (ct, bs) =
+  let mp = buildMultipartBody sets ct (Lazy.fromStrict bs)
+   in uploadRaw c usr (toLazyByteString mp)
+
+uploadRaw ::
+  CargoHold ->
+  UserId ->
+  Lazy.ByteString ->
+  Http (Response (Maybe Lazy.ByteString))
+uploadRaw c usr bs =
+  post $
+    c
+      . method POST
+      . zUser usr
+      . zConn "conn"
+      . content "multipart/mixed"
+      . lbytes bs
+
+deleteAsset :: CargoHold -> UserId -> Qualified AssetKey -> Http (Response (Maybe Lazy.ByteString))
+deleteAsset c u k = delete $ c . zUser u . paths ["assets", "v3", toByteString' (qUnqualified k)]
+
+-- Utilities ------------------------------------------------------------------
+
+decodeHeader :: FromByteString a => HeaderName -> Response b -> a
+decodeHeader h =
+  fromMaybe (error $ "decodeHeader: missing or invalid header: " ++ show h)
+    . fromByteString
+    . getHeader' h
+
+getContentType :: Response a -> Maybe MIME.Type
+getContentType = MIME.parseContentType . decodeLatin1 . getHeader' "Content-Type"
+
+applicationText :: MIME.Type
+applicationText = MIME.Type (MIME.Application "text") []
+
+applicationOctetStream :: MIME.Type
+applicationOctetStream = MIME.Type (MIME.Application "octet-stream") []
+
+zUser :: UserId -> Request -> Request
+zUser = header "Z-User" . UUID.toASCIIBytes . toUUID
+
+zConn :: ByteString -> Request -> Request
+zConn = header "Z-Connection"
diff --git a/tools/api-simulations/lib/src/Network/Wire/Simulations.hs b/tools/api-simulations/lib/src/Network/Wire/Simulations.hs
index 7a34d8280b9..f933ab94149 100644
--- a/tools/api-simulations/lib/src/Network/Wire/Simulations.hs
+++ b/tools/api-simulations/lib/src/Network/Wire/Simulations.hs
@@ -176,7 +176,7 @@ instance Serialize AssetInfo where
     AssetInfo k t <$> get
 
 mkAssetMsg :: Asset -> SymmetricKeys -> BotMessage
-mkAssetMsg a = BotAssetMessage . AssetInfo (a ^. assetKey) (a ^. assetToken)
+mkAssetMsg a = BotAssetMessage . AssetInfo (qUnqualified (a ^. assetKey)) (a ^. assetToken)
 
 mkTextMsg :: Text -> BotMessage
 mkTextMsg = BotTextMessage

From 34819f01d09257e8295e3b8280113b160b4d761a Mon Sep 17 00:00:00 2001
From: Paolo Capriotti <paolo@capriotti.io>
Date: Fri, 17 Dec 2021 11:07:17 +0100
Subject: [PATCH 32/74] Fix location url on upload

Also make `AssetLocation` type more high level.
---
 libs/wire-api/src/Wire/API/Asset.hs           | 49 ++++++++---
 .../src/Wire/API/Routes/Public/Cargohold.hs   | 27 ++++--
 .../cargohold/src/CargoHold/API/Public.hs     | 85 +++++++++++++------
 3 files changed, 120 insertions(+), 41 deletions(-)

diff --git a/libs/wire-api/src/Wire/API/Asset.hs b/libs/wire-api/src/Wire/API/Asset.hs
index 1e142ffe86c..49044a4e150 100644
--- a/libs/wire-api/src/Wire/API/Asset.hs
+++ b/libs/wire-api/src/Wire/API/Asset.hs
@@ -30,6 +30,7 @@ module Wire.API.Asset
 
     -- * AssetKey
     AssetKey (..),
+    assetKeyToText,
 
     -- * AssetToken
     AssetToken (..),
@@ -77,15 +78,16 @@ import Data.Qualified
 import Data.SOP
 import Data.Schema
 import qualified Data.Swagger as S
-import qualified Data.Swagger as Swagger
 import qualified Data.Text as T
 import Data.Text.Ascii (AsciiBase64Url)
 import qualified Data.Text.Encoding as T
+import qualified Data.Text.Encoding.Error as T
 import Data.Time.Clock
 import qualified Data.UUID as UUID
 import GHC.TypeLits
 import Imports
 import Servant
+import URI.ByteString
 import Wire.API.Arbitrary (Arbitrary (..), GenericUniform (..))
 import Wire.API.ErrorDescription
 import Wire.API.Routes.MultiVerb
@@ -169,6 +171,9 @@ instance ToByteString AssetKey where
       <> builder '-'
       <> builder (UUID.toASCIIBytes (toUUID i))
 
+assetKeyToText :: AssetKey -> Text
+assetKeyToText = T.decodeUtf8 . toByteString'
+
 instance ToSchema AssetKey where
   schema =
     (T.decodeUtf8 . toByteString')
@@ -359,26 +364,48 @@ instance ToSchema AssetRetention where
         (\value -> element (retentionToTextRep value) value)
         [minBound .. maxBound]
 
-newtype AssetLocation = AssetLocation {getAssetLocation :: Text}
-  deriving newtype
-    ( ToHttpApiData,
-      FromHttpApiData,
-      Swagger.ToParamSchema
-    )
-
-instance AsHeaders '[AssetLocation] Asset (Asset, AssetLocation) where
+-- FUTUREWORK: switch to a better URI library (e.g. modern-uri)
+--
+-- This URI type is error-prone, since its internal representation is based on
+-- ByteString, whereas URLs are defined in terms of characters, not octets (RFC
+-- 3986).
+newtype AssetLocation r = AssetLocation {getAssetLocation :: URIRef r}
+
+instance ToHttpApiData (AssetLocation r) where
+  toUrlPiece = T.decodeUtf8With T.lenientDecode . toHeader
+  toHeader = serializeURIRef' . getAssetLocation
+
+instance FromHttpApiData (AssetLocation Relative) where
+  parseUrlPiece = parseHeader . T.encodeUtf8
+  parseHeader =
+    bimap (T.pack . show) AssetLocation
+      . parseRelativeRef strictURIParserOptions
+
+instance FromHttpApiData (AssetLocation Absolute) where
+  parseUrlPiece = parseHeader . T.encodeUtf8
+  parseHeader =
+    bimap (T.pack . show) AssetLocation
+      . parseURI strictURIParserOptions
+
+instance S.ToParamSchema (AssetLocation r) where
+  toParamSchema _ =
+    mempty
+      & S.type_ ?~ S.SwaggerString
+      & S.format ?~ "url"
+
+instance AsHeaders '[AssetLocation r] Asset (Asset, AssetLocation r) where
   toHeaders (asset, loc) = (I loc :* Nil, asset)
   fromHeaders (I loc :* Nil, asset) = (asset, loc)
 
 -- | An asset as returned by the download API: if the asset is local, only a
 -- URL is returned, and if it is remote the content of the asset is streamed.
 data LocalOrRemoteAsset
-  = LocalAsset AssetLocation
+  = LocalAsset (AssetLocation Absolute)
   | RemoteAsset (SourceIO ByteString)
 
 instance
   ( ResponseType r0 ~ ErrorDescription code label desc,
-    ResponseType r1 ~ AssetLocation,
+    ResponseType r1 ~ AssetLocation Absolute,
     ResponseType r2 ~ SourceIO ByteString,
     KnownSymbol desc
   ) =>
diff --git a/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs b/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs
index 92df6173a9c..61206b38cc2 100644
--- a/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs
+++ b/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs
@@ -26,6 +26,7 @@ import Imports
 import Servant
 import Servant.Swagger.Internal
 import Servant.Swagger.Internal.Orphans ()
+import URI.ByteString
 import Wire.API.Asset
 import Wire.API.ErrorDescription
 import Wire.API.Routes.AssetBody
@@ -60,10 +61,13 @@ instance HasServer (ApplyPrincipalPath tag api) ctx => HasServer (tag :> api) ct
 instance RoutesToPaths (ApplyPrincipalPath tag api) => RoutesToPaths (tag :> api) where
   getRoutes = getRoutes @(ApplyPrincipalPath tag api)
 
+type AssetLocationHeader r =
+  '[DescHeader "Location" "Asset location" (AssetLocation r)]
+
 type AssetRedirect =
   WithHeaders
-    '[DescHeader "Location" "Asset location" AssetLocation]
-    AssetLocation
+    (AssetLocationHeader Absolute)
+    (AssetLocation Absolute)
     (RespondEmpty 302 "Asset found")
 
 type AssetStreaming =
@@ -78,7 +82,7 @@ type GetAsset =
     'GET
     '[JSON]
     '[AssetNotFound, AssetRedirect]
-    (Maybe AssetLocation)
+    (Maybe (AssetLocation Absolute))
 
 type ServantAPI =
   ( Summary "Renew an asset token"
@@ -121,11 +125,11 @@ type BaseAPIv3 (tag :: PrincipalTag) =
            'POST
            '[JSON]
            '[ WithHeaders
-                '[DescHeader "Location" "Asset location" AssetLocation]
-                (Asset, AssetLocation)
+                (AssetLocationHeader Relative)
+                (Asset, AssetLocation Relative)
                 (Respond 201 "Asset posted" Asset)
             ]
-           (Asset, AssetLocation)
+           (Asset, AssetLocation Relative)
   )
     :<|> ( Summary "Download an asset"
              :> tag
@@ -146,6 +150,17 @@ type BaseAPIv3 (tag :: PrincipalTag) =
                   ()
          )
 
+type TestAPI =
+  ( MultiVerb
+      'GET
+      '[JSON]
+      '[ AssetNotFound,
+         AssetRedirect,
+         AssetStreaming
+       ]
+      (Maybe LocalOrRemoteAsset)
+  )
+
 type QualifiedAPI =
   ( Summary "Download an asset"
       :> Description
diff --git a/services/cargohold/src/CargoHold/API/Public.hs b/services/cargohold/src/CargoHold/API/Public.hs
index 50b80f595ca..49d8df6f26c 100644
--- a/services/cargohold/src/CargoHold/API/Public.hs
+++ b/services/cargohold/src/CargoHold/API/Public.hs
@@ -23,12 +23,13 @@ import qualified CargoHold.API.V3 as V3
 import CargoHold.App
 import qualified CargoHold.Types.V3 as V3
 import Control.Lens
-import Data.ByteString.Conversion
+import Data.ByteString.Builder
+import qualified Data.ByteString.Lazy as LBS
+import Data.Domain
 import Data.Id
 import Data.Qualified
-import qualified Data.Text.Encoding as Text
-import qualified Data.Text.Encoding.Error as Text
 import Imports hiding (head)
+import qualified Network.HTTP.Types as HTTP
 import Servant ((:<|>) (..))
 import Servant.Server hiding (Handler)
 import URI.ByteString
@@ -56,7 +57,32 @@ servantSitemap =
     qualifiedAPI = downloadAssetV4 :<|> deleteAssetV4
     internalAPI = pure ()
 
-class MakePrincipal (tag :: PrincipalTag) (id :: *) | id -> tag, tag -> id where
+class HasLocation (tag :: PrincipalTag) where
+  assetLocation :: Local AssetKey -> [Text]
+
+instance HasLocation 'UserPrincipalTag where
+  assetLocation key =
+    [ "assets",
+      "v4",
+      domainText (tDomain key),
+      assetKeyToText (tUnqualified key)
+    ]
+
+instance HasLocation 'BotPrincipalTag where
+  assetLocation key =
+    [ "bot",
+      "assets",
+      assetKeyToText (tUnqualified key)
+    ]
+
+instance HasLocation 'ProviderPrincipalTag where
+  assetLocation key =
+    [ "provider",
+      "assets",
+      assetKeyToText (tUnqualified key)
+    ]
+
+class HasLocation tag => MakePrincipal (tag :: PrincipalTag) (id :: *) | id -> tag, tag -> id where
   mkPrincipal :: id -> V3.Principal
 
 instance MakePrincipal 'UserPrincipalTag (Local UserId) where
@@ -68,22 +94,36 @@ instance MakePrincipal 'BotPrincipalTag BotId where
 instance MakePrincipal 'ProviderPrincipalTag ProviderId where
   mkPrincipal = V3.ProviderPrincipal
 
+mkAssetLocation ::
+  forall (tag :: PrincipalTag).
+  HasLocation tag =>
+  Local AssetKey ->
+  AssetLocation Relative
+mkAssetLocation key =
+  AssetLocation
+    RelativeRef
+      { rrAuthority = Nothing,
+        rrPath = path,
+        rrQuery = mempty,
+        rrFragment = Nothing
+      }
+  where
+    path =
+      LBS.toStrict
+        . toLazyByteString
+        . HTTP.encodePathSegmentsRelative
+        $ assetLocation @tag key
+
 uploadAssetV3 ::
+  forall tag id.
   MakePrincipal tag id =>
   id ->
   AssetSource ->
-  Handler (Asset, AssetLocation)
+  Handler (Asset, AssetLocation Relative)
 uploadAssetV3 pid req = do
   let principal = mkPrincipal pid
   asset <- V3.upload principal (getAssetSource req)
-  let key =
-        Text.decodeUtf8With Text.lenientDecode $
-          toByteString' (tUnqualified (asset ^. assetKey))
-  let loc = case principal of
-        V3.UserPrincipal {} -> "/assets/v3/" <> key
-        V3.BotPrincipal {} -> "/bot/assets/" <> key
-        V3.ProviderPrincipal {} -> "/provider/assets/" <> key
-  pure (fmap qUntagged asset, AssetLocation loc)
+  pure (fmap qUntagged asset, mkAssetLocation @tag (asset ^. assetKey))
 
 downloadAssetV3 ::
   MakePrincipal tag id =>
@@ -91,10 +131,9 @@ downloadAssetV3 ::
   AssetKey ->
   Maybe AssetToken ->
   Maybe AssetToken ->
-  Handler (Maybe AssetLocation)
+  Handler (Maybe (AssetLocation Absolute))
 downloadAssetV3 usr key tok1 tok2 = do
-  url <- V3.download (mkPrincipal usr) key (tok1 <|> tok2)
-  pure $ fmap (AssetLocation . Text.decodeUtf8With Text.lenientDecode . serializeURIRef') url
+  AssetLocation <$$> V3.download (mkPrincipal usr) key (tok1 <|> tok2)
 
 downloadAssetV4 ::
   Local UserId ->
@@ -120,12 +159,10 @@ renewTokenV3 (tUnqualified -> usr) key =
 deleteTokenV3 :: Local UserId -> AssetKey -> Handler ()
 deleteTokenV3 (tUnqualified -> usr) key = V3.deleteToken (V3.UserPrincipal usr) key
 
-legacyDownloadPlain :: Local UserId -> ConvId -> AssetId -> Handler (Maybe AssetLocation)
-legacyDownloadPlain (tUnqualified -> usr) cnv ast = do
-  url <- LegacyAPI.download usr cnv ast
-  pure $ fmap (AssetLocation . Text.decodeUtf8With Text.lenientDecode . serializeURIRef') url
+legacyDownloadPlain :: Local UserId -> ConvId -> AssetId -> Handler (Maybe (AssetLocation Absolute))
+legacyDownloadPlain (tUnqualified -> usr) cnv ast =
+  AssetLocation <$$> LegacyAPI.download usr cnv ast
 
-legacyDownloadOtr :: Local UserId -> ConvId -> AssetId -> Handler (Maybe AssetLocation)
-legacyDownloadOtr (tUnqualified -> usr) cnv ast = do
-  url <- LegacyAPI.downloadOtr usr cnv ast
-  pure $ fmap (AssetLocation . Text.decodeUtf8With Text.lenientDecode . serializeURIRef') url
+legacyDownloadOtr :: Local UserId -> ConvId -> AssetId -> Handler (Maybe (AssetLocation Absolute))
+legacyDownloadOtr (tUnqualified -> usr) cnv ast =
+  AssetLocation <$$> LegacyAPI.downloadOtr usr cnv ast

From 15c2939c587ceac608bbea5cffe52338bf29c96e Mon Sep 17 00:00:00 2001
From: Paolo Capriotti <paolo@capriotti.io>
Date: Fri, 17 Dec 2021 11:34:58 +0100
Subject: [PATCH 33/74] Test main API and v3 version separately

---
 .../src/Wire/API/Routes/Public/Cargohold.hs   |   1 +
 services/cargohold/cargohold.cabal            |   5 +-
 .../cargohold/src/CargoHold/API/Public.hs     |   5 +-
 .../test/integration/{API/V4.hs => API.hs}    | 105 +++------
 .../cargohold/test/integration/API/Util.hs    |  93 ++++++++
 services/cargohold/test/integration/API/V3.hs | 218 ++----------------
 services/cargohold/test/integration/Main.hs   |   4 +-
 7 files changed, 144 insertions(+), 287 deletions(-)
 rename services/cargohold/test/integration/{API/V4.hs => API.hs} (76%)
 create mode 100644 services/cargohold/test/integration/API/Util.hs

diff --git a/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs b/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs
index 61206b38cc2..26795c1f46d 100644
--- a/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs
+++ b/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs
@@ -171,6 +171,7 @@ type QualifiedAPI =
       :> "v4"
       :> QualifiedCapture "key" AssetKey
       :> Header "Asset-Token" AssetToken
+      :> QueryParam "asset_token" AssetToken
       :> MultiVerb
            'GET
            '[JSON]
diff --git a/services/cargohold/cargohold.cabal b/services/cargohold/cargohold.cabal
index 057edb3ebff..26330a6c3c2 100644
--- a/services/cargohold/cargohold.cabal
+++ b/services/cargohold/cargohold.cabal
@@ -4,7 +4,7 @@ cabal-version: 1.12
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 253f7aaf3d9981e1ce5a3654d10d5aa926f6347fbb86c510d4eb2997e869e499
+-- hash: 3633e0db5e928a51056ef8474859ed8f6edf06bc84b9ade6db39f62c48bfce07
 
 name:           cargohold
 version:        1.5.0
@@ -134,8 +134,9 @@ executable cargohold
 executable cargohold-integration
   main-is: Main.hs
   other-modules:
+      API
+      API.Util
       API.V3
-      API.V4
       Metrics
       TestSetup
       Paths_cargohold
diff --git a/services/cargohold/src/CargoHold/API/Public.hs b/services/cargohold/src/CargoHold/API/Public.hs
index 49d8df6f26c..81e3d249109 100644
--- a/services/cargohold/src/CargoHold/API/Public.hs
+++ b/services/cargohold/src/CargoHold/API/Public.hs
@@ -139,10 +139,11 @@ downloadAssetV4 ::
   Local UserId ->
   Qualified AssetKey ->
   Maybe AssetToken ->
+  Maybe AssetToken ->
   Handler (Maybe LocalOrRemoteAsset)
-downloadAssetV4 usr qkey tok = do
+downloadAssetV4 usr qkey tok1 tok2 = do
   key <- tUnqualified <$> ensureLocal qkey
-  LocalAsset <$$> downloadAssetV3 usr key tok
+  LocalAsset <$$> downloadAssetV3 usr key tok1 tok2
 
 deleteAssetV3 :: MakePrincipal tag id => id -> AssetKey -> Handler ()
 deleteAssetV3 usr key = V3.delete (mkPrincipal usr) key
diff --git a/services/cargohold/test/integration/API/V4.hs b/services/cargohold/test/integration/API.hs
similarity index 76%
rename from services/cargohold/test/integration/API/V4.hs
rename to services/cargohold/test/integration/API.hs
index b9b8e556705..0ad220ce526 100644
--- a/services/cargohold/test/integration/API/V4.hs
+++ b/services/cargohold/test/integration/API.hs
@@ -2,7 +2,7 @@
 
 -- This file is part of the Wire Server implementation.
 --
--- Copyright (C) 2020 Wire Swiss GmbH <opensource@wire.com>
+-- Copyright (C) 2021 Wire Swiss GmbH <opensource@wire.com>
 --
 -- This program is free software: you can redistribute it and/or modify it under
 -- the terms of the GNU Affero General Public License as published by the Free
@@ -17,39 +17,33 @@
 -- You should have received a copy of the GNU Affero General Public License along
 -- with this program. If not, see <https://www.gnu.org/licenses/>.
 
-module API.V4 (tests) where
+module API (tests) where
 
+import API.Util
 import Bilge hiding (body)
 import Bilge.Assert
-import qualified Codec.MIME.Parse as MIME
+import qualified CargoHold.Types.V3 as V3
 import qualified Codec.MIME.Type as MIME
 import Control.Lens hiding (sets)
-import Data.ByteString.Builder
 import qualified Data.ByteString.Char8 as C8
 import Data.ByteString.Conversion
-import qualified Data.ByteString.Lazy as Lazy
 import Data.Id
 import Data.Qualified
-import Data.Text.Encoding (decodeLatin1)
 import Data.Time.Clock
 import Data.Time.Format
-import qualified Data.UUID as UUID
 import Data.UUID.V4
 import Imports hiding (head)
 import Network.HTTP.Client (parseUrlThrow)
-import Network.HTTP.Types.Header
-import Network.HTTP.Types.Method
 import Network.HTTP.Types.Status (status200)
 import Network.Wai.Utilities (Error (label))
 import Test.Tasty
 import Test.Tasty.HUnit
 import TestSetup
-import Wire.API.Asset
 
 tests :: IO TestSetup -> TestTree
 tests s =
   testGroup
-    "API Integration v4"
+    "API Integration"
     [ testGroup
         "simple"
         [ test s "roundtrip" testSimpleRoundtrip,
@@ -64,9 +58,9 @@ tests s =
 
 testSimpleRoundtrip :: TestSignature ()
 testSimpleRoundtrip c = do
-  let def = defAssetSettings
+  let def = V3.defAssetSettings
   let rets = [minBound ..]
-  let sets = def : map (\r -> def & setAssetRetention ?~ r) rets
+  let sets = def : map (\r -> def & V3.setAssetRetention ?~ r) rets
   mapM_ simpleRoundtrip sets
   where
     simpleRoundtrip sets = do
@@ -78,14 +72,14 @@ testSimpleRoundtrip c = do
         uploadSimple (c . path "/assets/v3") uid sets bdy
           <!! const 201 === statusCode
       let loc = decodeHeader "Location" r1 :: ByteString
-      let Just ast = responseJsonMaybe @Asset r1
-      let Just tok = view assetToken ast
+      let Just ast = responseJsonMaybe @V3.Asset r1
+      let Just tok = view V3.assetToken ast
       -- Check mandatory Date header
       let Just date = C8.unpack <$> lookup "Date" (responseHeaders r1)
       let utc = parseTimeOrError False defaultTimeLocale rfc822DateFormat date :: UTCTime
       -- Potentially check for the expires header
-      when (isJust $ join (assetRetentionSeconds <$> (sets ^. setAssetRetention))) $ do
-        liftIO $ assertBool "invalid expiration" (Just utc < view assetExpires ast)
+      when (isJust $ join (V3.assetRetentionSeconds <$> (sets ^. V3.setAssetRetention))) $ do
+        liftIO $ assertBool "invalid expiration" (Just utc < view V3.assetExpires ast)
       -- Lookup with token and download via redirect.
       r2 <-
         get (c . path loc . zUser uid . header "Asset-Token" (toByteString' tok) . noRedirect) <!! do
@@ -99,9 +93,9 @@ testSimpleRoundtrip c = do
         assertEqual "user mismatch" uid (decodeHeader "x-amz-meta-user" r3)
         assertEqual "data mismatch" (Just "Hello World") (responseBody r3)
       -- Delete (forbidden for other users)
-      deleteAsset c uid2 (view assetKey ast) !!! const 403 === statusCode
+      deleteAsset c uid2 (view V3.assetKey ast) !!! const 403 === statusCode
       -- Delete (allowed for creator)
-      deleteAsset c uid (view assetKey ast) !!! const 200 === statusCode
+      deleteAsset c uid (view V3.assetKey ast) !!! const 200 === statusCode
       r4 <-
         get (c . path loc . zUser uid . header "Asset-Token" (toByteString' tok) . noRedirect)
           <!! const 404 === statusCode
@@ -114,21 +108,27 @@ testSimpleTokens c = do
   uid <- liftIO $ Id <$> nextRandom
   uid2 <- liftIO $ Id <$> nextRandom
   -- Initial upload
-  let sets = defAssetSettings & set setAssetRetention (Just AssetVolatile)
+  let sets = V3.defAssetSettings & set V3.setAssetRetention (Just V3.AssetVolatile)
   let bdy = (applicationText, "Hello World")
   r1 <-
     uploadSimple (c . path "/assets/v3") uid sets bdy
       <!! const 201 === statusCode
   let loc = decodeHeader "Location" r1 :: ByteString
-  let Just ast = responseJsonMaybe @Asset r1
-  let key = view assetKey ast
-  let Just tok = view assetToken ast
+  let Just ast = responseJsonMaybe @V3.Asset r1
+  let key = view V3.assetKey ast
+  let Just tok = view V3.assetToken ast
   -- No access without token from other user (opaque 404)
   get (c . path loc . zUser uid2 . noRedirect)
     !!! const 404 === statusCode
+  -- No access with empty token query parameter from other user (opaque 404)
+  get (c . path loc . zUser uid2 . queryItem' "asset_token" Nothing . noRedirect)
+    !!! const 404 === statusCode
   -- No access with wrong token (opaque 404)
   get (c . path loc . zUser uid2 . header "Asset-Token" "acb123" . noRedirect)
     !!! const 404 === statusCode
+  -- No access with wrong token as query parameter (opaque 404)
+  get (c . path loc . zUser uid2 . queryItem "asset_token" "acb123" . noRedirect)
+    !!! const 404 === statusCode
   -- Token renewal fails if not done by owner
   post (c . paths ["assets", "v3", toByteString' (qUnqualified key), "token"] . zUser uid2) !!! do
     const 403 === statusCode
@@ -137,7 +137,7 @@ testSimpleTokens c = do
   r2 <-
     post (c . paths ["assets", "v3", toByteString' (qUnqualified key), "token"] . zUser uid)
       <!! const 200 === statusCode
-  let Just tok' = newAssetToken <$> responseJsonMaybe r2
+  let Just tok' = V3.newAssetToken <$> responseJsonMaybe r2
   liftIO $ assertBool "token unchanged" (tok /= tok')
   -- Download by owner with new token.
   r3 <-
@@ -157,6 +157,9 @@ testSimpleTokens c = do
   -- Verify access with new token from a different user.
   get (c . path loc . header "Asset-Token" (toByteString' tok') . zUser uid2 . noRedirect)
     !!! const 302 === statusCode
+  -- Verify access with new token as query parameter from a different user
+  get (c . path loc . queryItem "asset_token" (toByteString' tok') . zUser uid2 . noRedirect)
+    !!! const 302 === statusCode
   -- Delete Token fails if not done by owner
   delete (c . paths ["assets", "v3", toByteString' (qUnqualified key), "token"] . zUser uid2) !!! do
     const 403 === statusCode
@@ -179,7 +182,7 @@ testSimpleS3ClosedConnectionReuse c = go >> wait >> go
     wait = liftIO $ putStrLn "Waiting for S3 idle timeout ..." >> threadDelay 7000000
     go = do
       uid <- liftIO $ Id <$> nextRandom
-      let sets = defAssetSettings & set setAssetRetention (Just AssetVolatile)
+      let sets = V3.defAssetSettings & set V3.setAssetRetention (Just V3.AssetVolatile)
       let part2 = (MIME.Type (MIME.Text "plain") [], C8.replicate 100000 'c')
       uploadSimple (c . path "/assets/v3") uid sets part2
         !!! const 201 === statusCode
@@ -228,55 +231,3 @@ testUploadCompatibility c = do
       \test\r\n\
       \--FrontierIyj6RcVrqMcxNtMEWPsNpuPm325QsvWQ--\r\n\
       \\r\n"
-
--- API Calls ------------------------------------------------------------------
-
-uploadSimple ::
-  CargoHold ->
-  UserId ->
-  AssetSettings ->
-  (MIME.Type, ByteString) ->
-  Http (Response (Maybe Lazy.ByteString))
-uploadSimple c usr sets (ct, bs) =
-  let mp = buildMultipartBody sets ct (Lazy.fromStrict bs)
-   in uploadRaw c usr (toLazyByteString mp)
-
-uploadRaw ::
-  CargoHold ->
-  UserId ->
-  Lazy.ByteString ->
-  Http (Response (Maybe Lazy.ByteString))
-uploadRaw c usr bs =
-  post $
-    c
-      . method POST
-      . zUser usr
-      . zConn "conn"
-      . content "multipart/mixed"
-      . lbytes bs
-
-deleteAsset :: CargoHold -> UserId -> Qualified AssetKey -> Http (Response (Maybe Lazy.ByteString))
-deleteAsset c u k = delete $ c . zUser u . paths ["assets", "v3", toByteString' (qUnqualified k)]
-
--- Utilities ------------------------------------------------------------------
-
-decodeHeader :: FromByteString a => HeaderName -> Response b -> a
-decodeHeader h =
-  fromMaybe (error $ "decodeHeader: missing or invalid header: " ++ show h)
-    . fromByteString
-    . getHeader' h
-
-getContentType :: Response a -> Maybe MIME.Type
-getContentType = MIME.parseContentType . decodeLatin1 . getHeader' "Content-Type"
-
-applicationText :: MIME.Type
-applicationText = MIME.Type (MIME.Application "text") []
-
-applicationOctetStream :: MIME.Type
-applicationOctetStream = MIME.Type (MIME.Application "octet-stream") []
-
-zUser :: UserId -> Request -> Request
-zUser = header "Z-User" . UUID.toASCIIBytes . toUUID
-
-zConn :: ByteString -> Request -> Request
-zConn = header "Z-Connection"
diff --git a/services/cargohold/test/integration/API/Util.hs b/services/cargohold/test/integration/API/Util.hs
new file mode 100644
index 00000000000..df2e708ecff
--- /dev/null
+++ b/services/cargohold/test/integration/API/Util.hs
@@ -0,0 +1,93 @@
+-- This file is part of the Wire Server implementation.
+--
+-- Copyright (C) 2020 Wire Swiss GmbH <opensource@wire.com>
+--
+-- This program is free software: you can redistribute it and/or modify it under
+-- the terms of the GNU Affero General Public License as published by the Free
+-- Software Foundation, either version 3 of the License, or (at your option) any
+-- later version.
+--
+-- This program is distributed in the hope that it will be useful, but WITHOUT
+-- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+-- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+-- details.
+--
+-- You should have received a copy of the GNU Affero General Public License along
+-- with this program. If not, see <https://www.gnu.org/licenses/>.
+
+module API.Util where
+
+import Bilge hiding (body)
+import qualified CargoHold.Types.V3 as V3
+import qualified Codec.MIME.Parse as MIME
+import qualified Codec.MIME.Type as MIME
+import Data.ByteString.Builder
+import Data.ByteString.Conversion
+import qualified Data.ByteString.Lazy as Lazy
+import Data.Id
+import Data.Qualified
+import Data.Text.Encoding (decodeLatin1)
+import qualified Data.UUID as UUID
+import Imports hiding (head)
+import Network.HTTP.Types.Header
+import Network.HTTP.Types.Method
+import TestSetup
+
+uploadSimple ::
+  CargoHold ->
+  UserId ->
+  V3.AssetSettings ->
+  (MIME.Type, ByteString) ->
+  Http (Response (Maybe Lazy.ByteString))
+uploadSimple c usr sets (ct, bs) =
+  let mp = V3.buildMultipartBody sets ct (Lazy.fromStrict bs)
+   in uploadRaw c usr (toLazyByteString mp)
+
+decodeHeader :: FromByteString a => HeaderName -> Response b -> a
+decodeHeader h =
+  fromMaybe (error $ "decodeHeader: missing or invalid header: " ++ show h)
+    . fromByteString
+    . getHeader' h
+
+uploadRaw ::
+  CargoHold ->
+  UserId ->
+  Lazy.ByteString ->
+  Http (Response (Maybe Lazy.ByteString))
+uploadRaw c usr bs =
+  post $
+    c
+      . method POST
+      . zUser usr
+      . zConn "conn"
+      . content "multipart/mixed"
+      . lbytes bs
+
+getContentType :: Response a -> Maybe MIME.Type
+getContentType = MIME.parseContentType . decodeLatin1 . getHeader' "Content-Type"
+
+applicationText :: MIME.Type
+applicationText = MIME.Type (MIME.Application "text") []
+
+applicationOctetStream :: MIME.Type
+applicationOctetStream = MIME.Type (MIME.Application "octet-stream") []
+
+zUser :: UserId -> Request -> Request
+zUser = header "Z-User" . UUID.toASCIIBytes . toUUID
+
+zConn :: ByteString -> Request -> Request
+zConn = header "Z-Connection"
+
+deleteAssetV3 :: CargoHold -> UserId -> Qualified V3.AssetKey -> Http (Response (Maybe Lazy.ByteString))
+deleteAssetV3 c u k = delete $ c . zUser u . paths ["assets", "v3", toByteString' (qUnqualified k)]
+
+deleteAsset :: CargoHold -> UserId -> Qualified V3.AssetKey -> Http (Response (Maybe Lazy.ByteString))
+deleteAsset c u k =
+  delete $
+    c . zUser u
+      . paths
+        [ "assets",
+          "v4",
+          toByteString' (qDomain k),
+          toByteString' (qUnqualified k)
+        ]
diff --git a/services/cargohold/test/integration/API/V3.hs b/services/cargohold/test/integration/API/V3.hs
index 750cb2d0264..323be274205 100644
--- a/services/cargohold/test/integration/API/V3.hs
+++ b/services/cargohold/test/integration/API/V3.hs
@@ -19,32 +19,24 @@
 
 module API.V3 (tests) where
 
+import API.Util
 import Bilge hiding (body)
 import Bilge.Assert
-import qualified CargoHold.Types.V3 as V3
-import qualified Codec.MIME.Parse as MIME
-import qualified Codec.MIME.Type as MIME
 import Control.Lens hiding (sets)
-import Data.ByteString.Builder
 import qualified Data.ByteString.Char8 as C8
 import Data.ByteString.Conversion
-import qualified Data.ByteString.Lazy as Lazy
 import Data.Id
 import Data.Qualified
-import Data.Text.Encoding (decodeLatin1)
 import Data.Time.Clock
 import Data.Time.Format
-import qualified Data.UUID as UUID
 import Data.UUID.V4
 import Imports hiding (head)
 import Network.HTTP.Client (parseUrlThrow)
-import Network.HTTP.Types.Header
-import Network.HTTP.Types.Method
 import Network.HTTP.Types.Status (status200)
-import Network.Wai.Utilities (Error (label))
 import Test.Tasty
 import Test.Tasty.HUnit
 import TestSetup
+import Wire.API.Asset
 
 tests :: IO TestSetup -> TestTree
 tests s =
@@ -52,11 +44,7 @@ tests s =
     "API Integration v3"
     [ testGroup
         "simple"
-        [ test s "roundtrip" testSimpleRoundtrip,
-          test s "tokens" testSimpleTokens,
-          test s "s3-upstream-closed" testSimpleS3ClosedConnectionReuse,
-          test s "client-compatibility" testUploadCompatibility
-        ]
+        [test s "roundtrip using v3 API" testSimpleRoundtrip]
     ]
 
 --------------------------------------------------------------------------------
@@ -64,9 +52,9 @@ tests s =
 
 testSimpleRoundtrip :: TestSignature ()
 testSimpleRoundtrip c = do
-  let def = V3.defAssetSettings
+  let def = defAssetSettings
   let rets = [minBound ..]
-  let sets = def : map (\r -> def & V3.setAssetRetention ?~ r) rets
+  let sets = def : map (\r -> def & setAssetRetention ?~ r) rets
   mapM_ simpleRoundtrip sets
   where
     simpleRoundtrip sets = do
@@ -77,15 +65,16 @@ testSimpleRoundtrip c = do
       r1 <-
         uploadSimple (c . path "/assets/v3") uid sets bdy
           <!! const 201 === statusCode
-      let loc = decodeHeader "Location" r1 :: ByteString
-      let Just ast = responseJsonMaybe @V3.Asset r1
-      let Just tok = view V3.assetToken ast
+      -- use v3 path instead of the one returned in the header
+      let Just ast = responseJsonMaybe @Asset r1
+      let loc = "/assets/v3/" <> toByteString' (qUnqualified (ast ^. assetKey))
+      let Just tok = view assetToken ast
       -- Check mandatory Date header
       let Just date = C8.unpack <$> lookup "Date" (responseHeaders r1)
       let utc = parseTimeOrError False defaultTimeLocale rfc822DateFormat date :: UTCTime
       -- Potentially check for the expires header
-      when (isJust $ join (V3.assetRetentionSeconds <$> (sets ^. V3.setAssetRetention))) $ do
-        liftIO $ assertBool "invalid expiration" (Just utc < view V3.assetExpires ast)
+      when (isJust $ join (assetRetentionSeconds <$> (sets ^. setAssetRetention))) $ do
+        liftIO $ assertBool "invalid expiration" (Just utc < view assetExpires ast)
       -- Lookup with token and download via redirect.
       r2 <-
         get (c . path loc . zUser uid . header "Asset-Token" (toByteString' tok) . noRedirect) <!! do
@@ -99,193 +88,12 @@ testSimpleRoundtrip c = do
         assertEqual "user mismatch" uid (decodeHeader "x-amz-meta-user" r3)
         assertEqual "data mismatch" (Just "Hello World") (responseBody r3)
       -- Delete (forbidden for other users)
-      deleteAsset c uid2 (view V3.assetKey ast) !!! const 403 === statusCode
+      deleteAssetV3 c uid2 (view assetKey ast) !!! const 403 === statusCode
       -- Delete (allowed for creator)
-      deleteAsset c uid (view V3.assetKey ast) !!! const 200 === statusCode
+      deleteAssetV3 c uid (view assetKey ast) !!! const 200 === statusCode
       r4 <-
         get (c . path loc . zUser uid . header "Asset-Token" (toByteString' tok) . noRedirect)
           <!! const 404 === statusCode
       let Just date' = C8.unpack <$> lookup "Date" (responseHeaders r4)
       let utc' = parseTimeOrError False defaultTimeLocale rfc822DateFormat date' :: UTCTime
       liftIO $ assertBool "bad date" (utc' >= utc)
-
-testSimpleTokens :: TestSignature ()
-testSimpleTokens c = do
-  uid <- liftIO $ Id <$> nextRandom
-  uid2 <- liftIO $ Id <$> nextRandom
-  -- Initial upload
-  let sets = V3.defAssetSettings & set V3.setAssetRetention (Just V3.AssetVolatile)
-  let bdy = (applicationText, "Hello World")
-  r1 <-
-    uploadSimple (c . path "/assets/v3") uid sets bdy
-      <!! const 201 === statusCode
-  let loc = decodeHeader "Location" r1 :: ByteString
-  let Just ast = responseJsonMaybe @V3.Asset r1
-  let key = view V3.assetKey ast
-  let Just tok = view V3.assetToken ast
-  -- No access without token from other user (opaque 404)
-  get (c . path loc . zUser uid2 . noRedirect)
-    !!! const 404 === statusCode
-  -- No access with empty token query parameter from other user (opaque 404)
-  get (c . path loc . zUser uid2 . queryItem' "asset_token" Nothing . noRedirect)
-    !!! const 404 === statusCode
-  -- No access with wrong token (opaque 404)
-  get (c . path loc . zUser uid2 . header "Asset-Token" "acb123" . noRedirect)
-    !!! const 404 === statusCode
-  -- No access with wrong token as query parameter (opaque 404)
-  get (c . path loc . zUser uid2 . queryItem "asset_token" "acb123" . noRedirect)
-    !!! const 404 === statusCode
-  -- Token renewal fails if not done by owner
-  post (c . paths ["assets", "v3", toByteString' (qUnqualified key), "token"] . zUser uid2) !!! do
-    const 403 === statusCode
-    const (Just "unauthorised") === fmap label . responseJsonMaybe
-  -- Token renewal succeeds if done by owner
-  r2 <-
-    post (c . paths ["assets", "v3", toByteString' (qUnqualified key), "token"] . zUser uid)
-      <!! const 200 === statusCode
-  let Just tok' = V3.newAssetToken <$> responseJsonMaybe r2
-  liftIO $ assertBool "token unchanged" (tok /= tok')
-  -- Download by owner with new token.
-  r3 <-
-    get (c . path loc . zUser uid . header "Asset-Token" (toByteString' tok') . noRedirect) <!! do
-      const 302 === statusCode
-      const Nothing === responseBody
-  r4 <- flip get' id =<< parseUrlThrow (C8.unpack (getHeader' "Location" r3))
-  liftIO $ do
-    assertEqual "status" status200 (responseStatus r4)
-    assertEqual "content-type should always be application/octet-stream" (Just applicationOctetStream) (getContentType r4)
-    assertEqual "token mismatch" tok' (decodeHeader "x-amz-meta-token" r4)
-    assertEqual "user mismatch" uid (decodeHeader "x-amz-meta-user" r4)
-    assertEqual "data mismatch" (Just "Hello World") (responseBody r4)
-  -- Verify access without token if the request comes from the creator.
-  get (c . path loc . zUser uid . noRedirect)
-    !!! const 302 === statusCode
-  -- Verify access with new token from a different user.
-  get (c . path loc . header "Asset-Token" (toByteString' tok') . zUser uid2 . noRedirect)
-    !!! const 302 === statusCode
-  -- Verify access with new token as query parameter from a different user
-  get (c . path loc . queryItem "asset_token" (toByteString' tok') . zUser uid2 . noRedirect)
-    !!! const 302 === statusCode
-  -- Delete Token fails if not done by owner
-  delete (c . paths ["assets", "v3", toByteString' (qUnqualified key), "token"] . zUser uid2) !!! do
-    const 403 === statusCode
-    const (Just "unauthorised") === fmap label . responseJsonMaybe
-  -- Delete Token succeeds by owner
-  delete (c . paths ["assets", "v3", toByteString' (qUnqualified key), "token"] . zUser uid) !!! do
-    const 200 === statusCode
-    const Nothing === responseBody
-  -- Access without token from different user (asset is now "public")
-  get (c . path loc . noRedirect . zUser uid2) !!! do
-    const 302 === statusCode
-    const Nothing === responseBody
-
--- S3 closes idle connections after ~5 seconds, before the http-client 'Manager'
--- does. If such a closed connection is reused for an upload, no problems should
--- occur (i.e. the closed connection should be detected before sending any data).
-testSimpleS3ClosedConnectionReuse :: TestSignature ()
-testSimpleS3ClosedConnectionReuse c = go >> wait >> go
-  where
-    wait = liftIO $ putStrLn "Waiting for S3 idle timeout ..." >> threadDelay 7000000
-    go = do
-      uid <- liftIO $ Id <$> nextRandom
-      let sets = V3.defAssetSettings & set V3.setAssetRetention (Just V3.AssetVolatile)
-      let part2 = (MIME.Type (MIME.Text "plain") [], C8.replicate 100000 'c')
-      uploadSimple (c . path "/assets/v3") uid sets part2
-        !!! const 201 === statusCode
-
---------------------------------------------------------------------------------
--- Client compatibility tests
-
--- Since the other tests use functions from the server code, it can happen that
--- an API change also changes the requests made here in the tests.
--- This test tries to prevent us from breaking the API without noticing.
---
--- The body is taken directly from a request made by the web app
--- (just replaced the content with a shorter one and updated the MD5 header).
-testUploadCompatibility :: TestSignature ()
-testUploadCompatibility c = do
-  uid <- liftIO $ Id <$> nextRandom
-  -- Initial upload
-  r1 <-
-    uploadRaw (c . path "/assets/v3") uid exampleMultipart
-      <!! const 201 === statusCode
-  let loc = decodeHeader "Location" r1 :: ByteString
-  -- Lookup and download via redirect.
-  r2 <-
-    get (c . path loc . zUser uid . noRedirect) <!! do
-      const 302 === statusCode
-      const Nothing === responseBody
-  r3 <- flip get' id =<< parseUrlThrow (C8.unpack (getHeader' "Location" r2))
-  liftIO $ do
-    assertEqual "status" status200 (responseStatus r3)
-    assertEqual "content-type mismatch" (Just applicationOctetStream) (getContentType r3)
-    assertEqual "user mismatch" uid (decodeHeader "x-amz-meta-user" r3)
-    assertEqual "data mismatch" (Just "test") (responseBody r3)
-  where
-    exampleMultipart :: LByteString
-    exampleMultipart =
-      "--FrontierIyj6RcVrqMcxNtMEWPsNpuPm325QsvWQ\r\n\
-      \Content-Type: application/json;charset=utf-8\r\n\
-      \Content-length: 37\r\n\
-      \\r\n\
-      \{\"public\":true,\"retention\":\"eternal\"}\r\n\
-      \--FrontierIyj6RcVrqMcxNtMEWPsNpuPm325QsvWQ\r\n\
-      \Content-Type: application/octet-stream\r\n\
-      \Content-length: 4\r\n\
-      \Content-MD5: CY9rzUYh03PK3k6DJie09g==\r\n\
-      \\r\n\
-      \test\r\n\
-      \--FrontierIyj6RcVrqMcxNtMEWPsNpuPm325QsvWQ--\r\n\
-      \\r\n"
-
--- API Calls ------------------------------------------------------------------
-
-uploadSimple ::
-  CargoHold ->
-  UserId ->
-  V3.AssetSettings ->
-  (MIME.Type, ByteString) ->
-  Http (Response (Maybe Lazy.ByteString))
-uploadSimple c usr sets (ct, bs) =
-  let mp = V3.buildMultipartBody sets ct (Lazy.fromStrict bs)
-   in uploadRaw c usr (toLazyByteString mp)
-
-uploadRaw ::
-  CargoHold ->
-  UserId ->
-  Lazy.ByteString ->
-  Http (Response (Maybe Lazy.ByteString))
-uploadRaw c usr bs =
-  post $
-    c
-      . method POST
-      . zUser usr
-      . zConn "conn"
-      . content "multipart/mixed"
-      . lbytes bs
-
-deleteAsset :: CargoHold -> UserId -> Qualified V3.AssetKey -> Http (Response (Maybe Lazy.ByteString))
-deleteAsset c u k = delete $ c . zUser u . paths ["assets", "v3", toByteString' (qUnqualified k)]
-
--- Utilities ------------------------------------------------------------------
-
-decodeHeader :: FromByteString a => HeaderName -> Response b -> a
-decodeHeader h =
-  fromMaybe (error $ "decodeHeader: missing or invalid header: " ++ show h)
-    . fromByteString
-    . getHeader' h
-
-getContentType :: Response a -> Maybe MIME.Type
-getContentType = MIME.parseContentType . decodeLatin1 . getHeader' "Content-Type"
-
-applicationText :: MIME.Type
-applicationText = MIME.Type (MIME.Application "text") []
-
-applicationOctetStream :: MIME.Type
-applicationOctetStream = MIME.Type (MIME.Application "octet-stream") []
-
-zUser :: UserId -> Request -> Request
-zUser = header "Z-User" . UUID.toASCIIBytes . toUUID
-
-zConn :: ByteString -> Request -> Request
-zConn = header "Z-Connection"
diff --git a/services/cargohold/test/integration/Main.hs b/services/cargohold/test/integration/Main.hs
index 21e1e336102..9301e222c58 100644
--- a/services/cargohold/test/integration/Main.hs
+++ b/services/cargohold/test/integration/Main.hs
@@ -20,6 +20,7 @@ module Main
   )
 where
 
+import qualified API
 import qualified API.V3
 import Bilge hiding (body, header)
 import Data.Proxy
@@ -81,7 +82,8 @@ main = runTests go
     go c i = withResource (getOpts c i) releaseOpts $ \opts ->
       testGroup
         "Cargohold"
-        [ API.V3.tests opts,
+        [ API.tests opts,
+          API.V3.tests opts,
           Metrics.tests opts
         ]
     getOpts _ i = do

From 6c900994cd2a46726805056dfad2d6a92b05ec52 Mon Sep 17 00:00:00 2001
From: Paolo Capriotti <paolo@capriotti.io>
Date: Fri, 17 Dec 2021 12:19:13 +0100
Subject: [PATCH 34/74] Add CHANGELOG entry

---
 changelog.d/1-api-changes/qualified-assets | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 changelog.d/1-api-changes/qualified-assets

diff --git a/changelog.d/1-api-changes/qualified-assets b/changelog.d/1-api-changes/qualified-assets
new file mode 100644
index 00000000000..62e988dde3e
--- /dev/null
+++ b/changelog.d/1-api-changes/qualified-assets
@@ -0,0 +1 @@
+Add qualified v4 endpoints for downloading and deleting assets. The upload API is still on the same path, but the asset object it returns now contains a `domain` field. Note that federated behaviour is still not implemented.

From 31f2de42d906ff47b19a0f1667809f3b3f8bbc6e Mon Sep 17 00:00:00 2001
From: Paolo Capriotti <paolo@capriotti.io>
Date: Mon, 20 Dec 2021 10:25:53 +0100
Subject: [PATCH 35/74] Remove leftover debug definition

---
 libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs b/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs
index 26795c1f46d..f08fdf1c3c5 100644
--- a/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs
+++ b/libs/wire-api/src/Wire/API/Routes/Public/Cargohold.hs
@@ -150,17 +150,6 @@ type BaseAPIv3 (tag :: PrincipalTag) =
                   ()
          )
 
-type TestAPI =
-  ( MultiVerb
-      'GET
-      '[JSON]
-      '[ AssetNotFound,
-         AssetRedirect,
-         AssetStreaming
-       ]
-      (Maybe LocalOrRemoteAsset)
-  )
-
 type QualifiedAPI =
   ( Summary "Download an asset"
       :> Description

From 6c3fbf95d0f83199ac5d58b9dec107f97a1a44ec Mon Sep 17 00:00:00 2001
From: Sven Tennie <sven.tennie@wire.com>
Date: Thu, 23 Dec 2021 19:17:38 +0100
Subject: [PATCH 36/74] Fix doubtless HLint issues in Federator

---
 changelog.d/5-internal/hlint-federator            |  1 +
 .../federator/src/Federator/ExternalServer.hs     |  4 ++--
 .../federator/src/Federator/InternalServer.hs     |  2 +-
 services/federator/src/Federator/MockServer.hs    |  4 ++--
 .../federator/src/Federator/Monitor/Internal.hs   |  2 +-
 .../integration/Test/Federator/IngressSpec.hs     |  9 ++++++---
 .../federator/test/unit/Test/Federator/Client.hs  | 15 +++++++--------
 .../test/unit/Test/Federator/InternalServer.hs    |  3 ++-
 .../federator/test/unit/Test/Federator/Util.hs    |  7 +++----
 .../test/unit/Test/Federator/Validation.hs        |  9 ++++++---
 10 files changed, 31 insertions(+), 25 deletions(-)
 create mode 100644 changelog.d/5-internal/hlint-federator

diff --git a/changelog.d/5-internal/hlint-federator b/changelog.d/5-internal/hlint-federator
new file mode 100644
index 00000000000..96c1fac4dc7
--- /dev/null
+++ b/changelog.d/5-internal/hlint-federator
@@ -0,0 +1 @@
+Fix non-controversial HLint issues in federator to improve code quality
diff --git a/services/federator/src/Federator/ExternalServer.hs b/services/federator/src/Federator/ExternalServer.hs
index b81c7b18691..092c1a31aff 100644
--- a/services/federator/src/Federator/ExternalServer.hs
+++ b/services/federator/src/Federator/ExternalServer.hs
@@ -107,14 +107,14 @@ parseRequestData req = do
   when (Wai.requestMethod req /= HTTP.methodPost) $
     throw InvalidRoute
   -- No query parameters are allowed
-  when (not . BS.null . Wai.rawQueryString $ req) $
+  unless (BS.null . Wai.rawQueryString $ req) $
     throw InvalidRoute
   -- check that the path has the expected form
   (componentSeg, rpcPath) <- case Wai.pathInfo req of
     ["federation", comp, rpc] -> pure (comp, rpc)
     _ -> throw InvalidRoute
 
-  when (not (Text.all isAllowedRPCChar rpcPath)) $
+  unless (Text.all isAllowedRPCChar rpcPath) $
     throw InvalidRoute
 
   when (Text.null rpcPath) $
diff --git a/services/federator/src/Federator/InternalServer.hs b/services/federator/src/Federator/InternalServer.hs
index 5493448f32b..c9aeace7b55 100644
--- a/services/federator/src/Federator/InternalServer.hs
+++ b/services/federator/src/Federator/InternalServer.hs
@@ -90,7 +90,7 @@ parseRequestData req = do
   when (Wai.requestMethod req /= HTTP.methodPost) $
     throw InvalidRoute
   -- No query parameters are allowed
-  when (not . BS.null . Wai.rawQueryString $ req) $
+  unless (BS.null . Wai.rawQueryString $ req) $
     throw InvalidRoute
   -- check that the path has the expected form
   (domain, componentSeg, rpcPath) <- case Wai.pathInfo req of
diff --git a/services/federator/src/Federator/MockServer.hs b/services/federator/src/Federator/MockServer.hs
index ec28270ca9f..1284e2e2817 100644
--- a/services/federator/src/Federator/MockServer.hs
+++ b/services/federator/src/Federator/MockServer.hs
@@ -53,7 +53,7 @@ import Wire.API.Federation.Domain
 
 -- | Thrown in IO by mock federator if the server could not be started after 10
 -- seconds.
-data MockTimeout = MockTimeout Warp.Port
+newtype MockTimeout = MockTimeout Warp.Port
   deriving (Eq, Show, Typeable)
 
 instance Exception MockTimeout
@@ -159,7 +159,7 @@ withTempMockFederator headers resp action = do
                           frBody = rdBody
                         }
                     )
-              embed @IO $ modifyIORef remoteCalls $ (<> [fedRequest])
+              embed @IO $ modifyIORef remoteCalls (<> [fedRequest])
               body <-
                 fromException @MockException
                   . handle (throw . handleException)
diff --git a/services/federator/src/Federator/Monitor/Internal.hs b/services/federator/src/Federator/Monitor/Internal.hs
index 28351d384db..9833077cdfe 100644
--- a/services/federator/src/Federator/Monitor/Internal.hs
+++ b/services/federator/src/Federator/Monitor/Internal.hs
@@ -72,7 +72,7 @@ data WatchedPath
   deriving stock (Eq, Ord, Show, Generic)
   deriving (Arbitrary) via (GenericUniform WatchedPath)
 
-mergePaths :: [WatchedPath] -> (Set WatchedPath)
+mergePaths :: [WatchedPath] -> Set WatchedPath
 mergePaths = Set.fromList . merge . sort
   where
     merge [] = []
diff --git a/services/federator/test/integration/Test/Federator/IngressSpec.hs b/services/federator/test/integration/Test/Federator/IngressSpec.hs
index 34b6af1d327..f1b2b891bf3 100644
--- a/services/federator/test/integration/Test/Federator/IngressSpec.hs
+++ b/services/federator/test/integration/Test/Federator/IngressSpec.hs
@@ -62,13 +62,14 @@ spec env = do
         resp <-
           runTestSem
             . assertNoError @RemoteError
-            $ inwardBrigCallViaIngress "get-user-by-handle" $
+            $ inwardBrigCallViaIngress
+              "get-user-by-handle"
               (Aeson.fromEncoding (Aeson.toEncoding hdl))
         liftIO $ do
           bdy <- streamingResponseStrictBody resp
           let actualProfile = Aeson.decode (toLazyByteString bdy)
           responseStatusCode resp `shouldBe` HTTP.status200
-          actualProfile `shouldBe` (Just expectedProfile)
+          actualProfile `shouldBe` Just expectedProfile
 
   -- @SF.Federation @TSFI.RESTfulAPI @S2 @S3 @S7
   --
@@ -96,7 +97,9 @@ spec env = do
       r <-
         runTestSem
           . runError @RemoteError
-          $ inwardBrigCallViaIngressWithSettings tlsSettings "get-user-by-handle" $
+          $ inwardBrigCallViaIngressWithSettings
+            tlsSettings
+            "get-user-by-handle"
             (Aeson.fromEncoding (Aeson.toEncoding hdl))
       liftIO $ case r of
         Right _ -> expectationFailure "Expected client certificate error, got response"
diff --git a/services/federator/test/unit/Test/Federator/Client.hs b/services/federator/test/unit/Test/Federator/Client.hs
index 854ac570874..13d92f5cd33 100644
--- a/services/federator/test/unit/Test/Federator/Client.hs
+++ b/services/federator/test/unit/Test/Federator/Client.hs
@@ -131,13 +131,12 @@ testClientStreaming = withInfiniteMockServer $ \port -> do
             ceFederator = Endpoint "127.0.0.1" (fromIntegral port)
           }
   let c = clientIn (Proxy @StreamingAPI) (Proxy @(FederatorClient 'Brig))
-  runCodensity (runFederatorClientToCodensity env c) $ \eout ->
-    case eout of
-      Left err -> assertFailure $ "Unexpected error: " <> displayException err
-      Right out -> do
-        let expected = mconcat (replicate 500 "Hello")
-        actual <- takeSourceT (fromIntegral (LBS.length expected)) (fmap Text.encodeUtf8 out)
-        actual @?= expected
+  runCodensity (runFederatorClientToCodensity env c) $ \case
+    Left err -> assertFailure $ "Unexpected error: " <> displayException err
+    Right out -> do
+      let expected = mconcat (replicate 500 "Hello")
+      actual <- takeSourceT (fromIntegral (LBS.length expected)) (fmap Text.encodeUtf8 out)
+      actual @?= expected
 
 testClientFailure :: IO ()
 testClientFailure = do
@@ -232,7 +231,7 @@ withInfiniteMockServer k = bracket (startMockServer Nothing app) fst (k . snd)
     app _ respond = respond $
       Wai.responseStream HTTP.ok200 mempty $ \write flush ->
         let go n = do
-              when (n == 0) $ flush
+              when (n == 0) flush
               write (byteString "Hello\n") *> go (if n == 0 then 100 else n - 1)
          in go (1000 :: Int)
 
diff --git a/services/federator/test/unit/Test/Federator/InternalServer.hs b/services/federator/test/unit/Test/Federator/InternalServer.hs
index b384d0b88fc..55452911f4b 100644
--- a/services/federator/test/unit/Test/Federator/InternalServer.hs
+++ b/services/federator/test/unit/Test/Federator/InternalServer.hs
@@ -49,7 +49,8 @@ tests :: TestTree
 tests =
   testGroup
     "Federate"
-    [ testGroup "with remote" $
+    [ testGroup
+        "with remote"
         [ federatedRequestSuccess,
           federatedRequestFailureAllowList
         ]
diff --git a/services/federator/test/unit/Test/Federator/Util.hs b/services/federator/test/unit/Test/Federator/Util.hs
index a299276c396..ff8acc1be24 100644
--- a/services/federator/test/unit/Test/Federator/Util.hs
+++ b/services/federator/test/unit/Test/Federator/Util.hs
@@ -62,10 +62,9 @@ testRequest tr = do
   pure . flip Wai.setPath (trPath tr) $
     Wai.defaultRequest
       { Wai.requestMethod = trMethod tr,
-        Wai.requestBody = atomicModifyIORef refChunks $ \bss ->
-          case bss of
-            [] -> ([], mempty)
-            x : y -> (y, x),
+        Wai.requestBody = atomicModifyIORef refChunks $ \case
+          [] -> ([], mempty)
+          x : y -> (y, x),
         Wai.requestHeaders =
           [("X-SSL-Certificate", HTTP.urlEncode True h) | h <- toList (trCertificateHeader tr)]
             <> [(originDomainHeaderName, h) | h <- toList (trDomainHeader tr)]
diff --git a/services/federator/test/unit/Test/Federator/Validation.hs b/services/federator/test/unit/Test/Federator/Validation.hs
index 785757927fb..012ab593083 100644
--- a/services/federator/test/unit/Test/Federator/Validation.hs
+++ b/services/federator/test/unit/Test/Federator/Validation.hs
@@ -60,12 +60,15 @@ mockDiscoveryFailure = Polysemy.interpret $ \case
 
 tests :: TestTree
 tests =
-  testGroup "Validation" $
-    [ testGroup "federateWith" $
+  testGroup
+    "Validation"
+    [ testGroup
+        "federateWith"
         [ federateWithAllowListSuccess,
           federateWithAllowListFail
         ],
-      testGroup "validateDomain" $
+      testGroup
+        "validateDomain"
         [ validateDomainAllowListFailSemantic,
           validateDomainAllowListFail,
           validateDomainAllowListSuccess,

From b358b0b7135707d421f54b2dc1e65b2f597a73df Mon Sep 17 00:00:00 2001
From: Sven Tennie <sven.tennie@wire.com>
Date: Mon, 27 Dec 2021 14:28:28 +0100
Subject: [PATCH 37/74] Rename decodeHeader to decodeHeaderOrFail and introduce
 HasCallStack constraint

The HasCallStack constraint leads to more descriptive stacktraces.
The new name reflects better, that this function may fail/throw.
---
 services/cargohold/test/integration/API.hs      | 16 ++++++++--------
 services/cargohold/test/integration/API/Util.hs |  6 +++---
 services/cargohold/test/integration/API/V3.hs   |  4 ++--
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/services/cargohold/test/integration/API.hs b/services/cargohold/test/integration/API.hs
index 0ad220ce526..51f60a757ba 100644
--- a/services/cargohold/test/integration/API.hs
+++ b/services/cargohold/test/integration/API.hs
@@ -71,7 +71,7 @@ testSimpleRoundtrip c = do
       r1 <-
         uploadSimple (c . path "/assets/v3") uid sets bdy
           <!! const 201 === statusCode
-      let loc = decodeHeader "Location" r1 :: ByteString
+      let loc = decodeHeaderOrFail "Location" r1 :: ByteString
       let Just ast = responseJsonMaybe @V3.Asset r1
       let Just tok = view V3.assetToken ast
       -- Check mandatory Date header
@@ -89,8 +89,8 @@ testSimpleRoundtrip c = do
       liftIO $ do
         assertEqual "status" status200 (responseStatus r3)
         assertEqual "content-type should always be application/octet-stream" (Just applicationOctetStream) (getContentType r3)
-        assertEqual "token mismatch" tok (decodeHeader "x-amz-meta-token" r3)
-        assertEqual "user mismatch" uid (decodeHeader "x-amz-meta-user" r3)
+        assertEqual "token mismatch" tok (decodeHeaderOrFail "x-amz-meta-token" r3)
+        assertEqual "user mismatch" uid (decodeHeaderOrFail "x-amz-meta-user" r3)
         assertEqual "data mismatch" (Just "Hello World") (responseBody r3)
       -- Delete (forbidden for other users)
       deleteAsset c uid2 (view V3.assetKey ast) !!! const 403 === statusCode
@@ -113,7 +113,7 @@ testSimpleTokens c = do
   r1 <-
     uploadSimple (c . path "/assets/v3") uid sets bdy
       <!! const 201 === statusCode
-  let loc = decodeHeader "Location" r1 :: ByteString
+  let loc = decodeHeaderOrFail "Location" r1 :: ByteString
   let Just ast = responseJsonMaybe @V3.Asset r1
   let key = view V3.assetKey ast
   let Just tok = view V3.assetToken ast
@@ -148,8 +148,8 @@ testSimpleTokens c = do
   liftIO $ do
     assertEqual "status" status200 (responseStatus r4)
     assertEqual "content-type should always be application/octet-stream" (Just applicationOctetStream) (getContentType r4)
-    assertEqual "token mismatch" tok' (decodeHeader "x-amz-meta-token" r4)
-    assertEqual "user mismatch" uid (decodeHeader "x-amz-meta-user" r4)
+    assertEqual "token mismatch" tok' (decodeHeaderOrFail "x-amz-meta-token" r4)
+    assertEqual "user mismatch" uid (decodeHeaderOrFail "x-amz-meta-user" r4)
     assertEqual "data mismatch" (Just "Hello World") (responseBody r4)
   -- Verify access without token if the request comes from the creator.
   get (c . path loc . zUser uid . noRedirect)
@@ -203,7 +203,7 @@ testUploadCompatibility c = do
   r1 <-
     uploadRaw (c . path "/assets/v3") uid exampleMultipart
       <!! const 201 === statusCode
-  let loc = decodeHeader "Location" r1 :: ByteString
+  let loc = decodeHeaderOrFail "Location" r1 :: ByteString
   -- Lookup and download via redirect.
   r2 <-
     get (c . path loc . zUser uid . noRedirect) <!! do
@@ -213,7 +213,7 @@ testUploadCompatibility c = do
   liftIO $ do
     assertEqual "status" status200 (responseStatus r3)
     assertEqual "content-type mismatch" (Just applicationOctetStream) (getContentType r3)
-    assertEqual "user mismatch" uid (decodeHeader "x-amz-meta-user" r3)
+    assertEqual "user mismatch" uid (decodeHeaderOrFail "x-amz-meta-user" r3)
     assertEqual "data mismatch" (Just "test") (responseBody r3)
   where
     exampleMultipart :: LByteString
diff --git a/services/cargohold/test/integration/API/Util.hs b/services/cargohold/test/integration/API/Util.hs
index df2e708ecff..2cf1b68b23c 100644
--- a/services/cargohold/test/integration/API/Util.hs
+++ b/services/cargohold/test/integration/API/Util.hs
@@ -43,9 +43,9 @@ uploadSimple c usr sets (ct, bs) =
   let mp = V3.buildMultipartBody sets ct (Lazy.fromStrict bs)
    in uploadRaw c usr (toLazyByteString mp)
 
-decodeHeader :: FromByteString a => HeaderName -> Response b -> a
-decodeHeader h =
-  fromMaybe (error $ "decodeHeader: missing or invalid header: " ++ show h)
+decodeHeaderOrFail :: (HasCallStack, FromByteString a) => HeaderName -> Response b -> a
+decodeHeaderOrFail h =
+  fromMaybe (error $ "decodeHeaderOrFail: missing or invalid header: " ++ show h)
     . fromByteString
     . getHeader' h
 
diff --git a/services/cargohold/test/integration/API/V3.hs b/services/cargohold/test/integration/API/V3.hs
index 323be274205..1b4faaabd54 100644
--- a/services/cargohold/test/integration/API/V3.hs
+++ b/services/cargohold/test/integration/API/V3.hs
@@ -84,8 +84,8 @@ testSimpleRoundtrip c = do
       liftIO $ do
         assertEqual "status" status200 (responseStatus r3)
         assertEqual "content-type should always be application/octet-stream" (Just applicationOctetStream) (getContentType r3)
-        assertEqual "token mismatch" tok (decodeHeader "x-amz-meta-token" r3)
-        assertEqual "user mismatch" uid (decodeHeader "x-amz-meta-user" r3)
+        assertEqual "token mismatch" tok (decodeHeaderOrFail "x-amz-meta-token" r3)
+        assertEqual "user mismatch" uid (decodeHeaderOrFail "x-amz-meta-user" r3)
         assertEqual "data mismatch" (Just "Hello World") (responseBody r3)
       -- Delete (forbidden for other users)
       deleteAssetV3 c uid2 (view assetKey ast) !!! const 403 === statusCode

From de7aa833f8a9d4b83cc5d0ad5169835006124e28 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marko=20Dimja=C5=A1evi=C4=87?= <marko.dimjasevic@wire.com>
Date: Tue, 28 Dec 2021 14:58:26 +0100
Subject: [PATCH 38/74] FS-266: Add sft_servers_all to calls/config/v2 (#2012)

* Add two SFT parameters to a Brig template configmap.yaml
* Introduce a new DNS action
* Extend the DNS interpreters
* Propagate new SFT parameters from options to environments
* Perform lookupA actions
* Extend the return type of newConfig to include all SFT servers
* Test fixing
* Fix an assertion message in a Brig calling unit test
   (This is not related to the PR, but it is a single line fix)
* Add a couple of unit tests
* Expand an integration test
* Add a change log
---
 changelog.d/6-federation/sft-servers-all      |  1 +
 charts/brig/templates/configmap.yaml          |  2 +
 libs/dns-util/dns-util.cabal                  |  5 +-
 libs/dns-util/package.yaml                    |  1 +
 libs/dns-util/src/Wire/Network/DNS/A.hs       | 32 ++++++++
 libs/dns-util/src/Wire/Network/DNS/Effect.hs  | 23 ++++--
 libs/wire-api/src/Wire/API/Call/Config.hs     | 28 ++++++-
 .../Golden/Generated/RTCConfiguration_user.hs |  6 ++
 services/brig/brig.cabal                      |  4 +-
 services/brig/package.yaml                    |  2 +
 services/brig/src/Brig/Calling.hs             | 18 ++++-
 services/brig/src/Brig/Calling/API.hs         | 56 +++++++++++--
 services/brig/src/Brig/Options.hs             |  8 +-
 services/brig/test/integration/API/Calling.hs | 10 ++-
 services/brig/test/unit/Test/Brig/Calling.hs  | 79 ++++++++++++++-----
 15 files changed, 228 insertions(+), 47 deletions(-)
 create mode 100644 changelog.d/6-federation/sft-servers-all
 create mode 100644 libs/dns-util/src/Wire/Network/DNS/A.hs

diff --git a/changelog.d/6-federation/sft-servers-all b/changelog.d/6-federation/sft-servers-all
new file mode 100644
index 00000000000..ec9339bdca7
--- /dev/null
+++ b/changelog.d/6-federation/sft-servers-all
@@ -0,0 +1 @@
+Extend GET /calls/config/v2 to include all SFT servers in federation
diff --git a/charts/brig/templates/configmap.yaml b/charts/brig/templates/configmap.yaml
index e01d29bd9a7..967217453d1 100644
--- a/charts/brig/templates/configmap.yaml
+++ b/charts/brig/templates/configmap.yaml
@@ -175,6 +175,8 @@ data:
       {{- if .sftDiscoveryIntervalSeconds }}
       sftDiscoveryIntervalSeconds: {{ .sftDiscoveryIntervalSeconds }}
       {{- end }}
+      sftLookupDomain: {{ required "Missing value: .sft.sftLookupDomain" .sftLookupDomain }}
+      sftLookupPort: {{ required "Missing value: .sft.sftLookupPort" .sftLookupPort }}
     {{- end }}
     {{- end }}
 
diff --git a/libs/dns-util/dns-util.cabal b/libs/dns-util/dns-util.cabal
index 023ad5af62f..63bc4a8e470 100644
--- a/libs/dns-util/dns-util.cabal
+++ b/libs/dns-util/dns-util.cabal
@@ -4,7 +4,7 @@ cabal-version: 1.12
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: eb1c3d83585fec582c135dbe676c68498f2546468581882f07fdba8f0d16aec3
+-- hash: d71d0f07f44620f73670692eb75544d71d97efd5ddfd25d72388d073f8cf2494
 
 name:           dns-util
 version:        0.1.0
@@ -20,6 +20,7 @@ build-type:     Simple
 
 library
   exposed-modules:
+      Wire.Network.DNS.A
       Wire.Network.DNS.Effect
       Wire.Network.DNS.Helper
       Wire.Network.DNS.SRV
@@ -33,6 +34,7 @@ library
       base >=4.6 && <5.0
     , dns
     , imports
+    , iproute
     , polysemy
     , random
   default-language: Haskell2010
@@ -55,6 +57,7 @@ test-suite spec
     , dns-util
     , hspec
     , imports
+    , iproute
     , polysemy
     , random
   default-language: Haskell2010
diff --git a/libs/dns-util/package.yaml b/libs/dns-util/package.yaml
index 2a5cb7b9cc2..b0f2b30d5a6 100644
--- a/libs/dns-util/package.yaml
+++ b/libs/dns-util/package.yaml
@@ -14,6 +14,7 @@ dependencies:
 - dns
 - random
 - imports
+- iproute
 - polysemy
 library:
   source-dirs: src
diff --git a/libs/dns-util/src/Wire/Network/DNS/A.hs b/libs/dns-util/src/Wire/Network/DNS/A.hs
new file mode 100644
index 00000000000..ecac28be2cf
--- /dev/null
+++ b/libs/dns-util/src/Wire/Network/DNS/A.hs
@@ -0,0 +1,32 @@
+-- This file is part of the Wire Server implementation.
+--
+-- Copyright (C) 2021 Wire Swiss GmbH <opensource@wire.com>
+--
+-- This program is free software: you can redistribute it and/or modify it under
+-- the terms of the GNU Affero General Public License as published by the Free
+-- Software Foundation, either version 3 of the License, or (at your option) any
+-- later version.
+--
+-- This program is distributed in the hope that it will be useful, but WITHOUT
+-- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+-- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+-- details.
+--
+-- You should have received a copy of the GNU Affero General Public License along
+-- with this program. If not, see <https://www.gnu.org/licenses/>.
+
+module Wire.Network.DNS.A where
+
+import Data.IP
+import Imports
+import Network.DNS
+
+-- | A response to lookupA, i.e., a reponse to a lookup of IPv4 addresses of a
+-- domain.
+data AResponse
+  = AIPv4s [IPv4]
+  | AResponseError DNSError
+  deriving (Eq)
+
+interpretResponse :: Either DNSError [IPv4] -> AResponse
+interpretResponse = either AResponseError AIPv4s
diff --git a/libs/dns-util/src/Wire/Network/DNS/Effect.hs b/libs/dns-util/src/Wire/Network/DNS/Effect.hs
index 5484d971d12..b7e3bafd23c 100644
--- a/libs/dns-util/src/Wire/Network/DNS/Effect.hs
+++ b/libs/dns-util/src/Wire/Network/DNS/Effect.hs
@@ -21,20 +21,29 @@ import Imports
 import Network.DNS (Domain, Resolver)
 import qualified Network.DNS as DNS
 import Polysemy
-import Wire.Network.DNS.SRV
+import qualified Wire.Network.DNS.A as A
+import qualified Wire.Network.DNS.SRV as SRV
 
 data DNSLookup m a where
-  LookupSRV :: Domain -> DNSLookup m SrvResponse
+  LookupSRV :: Domain -> DNSLookup m SRV.SrvResponse
+  LookupA :: Domain -> DNSLookup m A.AResponse
 
 makeSem ''DNSLookup
 
 runDNSLookupDefault :: Member (Embed IO) r => Sem (DNSLookup ': r) a -> Sem r a
 runDNSLookupDefault =
-  interpret $ \(LookupSRV domain) -> embed $ do
-    rs <- DNS.makeResolvSeed DNS.defaultResolvConf
-    DNS.withResolver rs $ \resolver ->
-      interpretResponse <$> DNS.lookupSRV resolver domain
+  interpret $ \case
+    LookupSRV domain -> embed $ do
+      rs <- DNS.makeResolvSeed DNS.defaultResolvConf
+      DNS.withResolver rs $ \resolver ->
+        SRV.interpretResponse <$> DNS.lookupSRV resolver domain
+    LookupA domain -> embed $ do
+      rs <- DNS.makeResolvSeed DNS.defaultResolvConf
+      DNS.withResolver rs $ \resolver ->
+        A.interpretResponse <$> DNS.lookupA resolver domain
 
 runDNSLookupWithResolver :: Member (Embed IO) r => Resolver -> Sem (DNSLookup ': r) a -> Sem r a
 runDNSLookupWithResolver resolver =
-  interpret $ \(LookupSRV domain) -> embed (interpretResponse <$> DNS.lookupSRV resolver domain)
+  interpret $ \case
+    LookupSRV domain -> embed (SRV.interpretResponse <$> DNS.lookupSRV resolver domain)
+    LookupA domain -> embed (A.interpretResponse <$> DNS.lookupA resolver domain)
diff --git a/libs/wire-api/src/Wire/API/Call/Config.hs b/libs/wire-api/src/Wire/API/Call/Config.hs
index c239de17344..85c315254be 100644
--- a/libs/wire-api/src/Wire/API/Call/Config.hs
+++ b/libs/wire-api/src/Wire/API/Call/Config.hs
@@ -25,6 +25,7 @@ module Wire.API.Call.Config
     rtcConfiguration,
     rtcConfIceServers,
     rtcConfSftServers,
+    rtcConfSftServersAll,
     rtcConfTTL,
 
     -- * RTCIceServer
@@ -104,12 +105,18 @@ import Wire.API.Arbitrary (Arbitrary (arbitrary), GenericUniform (..))
 data RTCConfiguration = RTCConfiguration
   { _rtcConfIceServers :: NonEmpty RTCIceServer,
     _rtcConfSftServers :: Maybe (NonEmpty SFTServer),
-    _rtcConfTTL :: Word32
+    _rtcConfTTL :: Word32,
+    _rtcConfSftServersAll :: Maybe [SFTServer]
   }
   deriving stock (Eq, Show, Generic)
   deriving (Arbitrary) via (GenericUniform RTCConfiguration)
 
-rtcConfiguration :: NonEmpty RTCIceServer -> Maybe (NonEmpty SFTServer) -> Word32 -> RTCConfiguration
+rtcConfiguration ::
+  NonEmpty RTCIceServer ->
+  Maybe (NonEmpty SFTServer) ->
+  Word32 ->
+  Maybe [SFTServer] ->
+  RTCConfiguration
 rtcConfiguration = RTCConfiguration
 
 modelRtcConfiguration :: Doc.Model
@@ -121,19 +128,26 @@ modelRtcConfiguration = Doc.defineModel "RTCConfiguration" $ do
     Doc.description "Array of 'SFTServer' objects (optional)"
   Doc.property "ttl" Doc.int32' $
     Doc.description "Number of seconds after which the configuration should be refreshed (advisory)"
+  Doc.property "sft_servers_all" (Doc.array (Doc.ref modelRtcSftServerUrl)) $
+    Doc.description "Array of 'SFTServer' URLs (optional)"
 
 instance ToJSON RTCConfiguration where
-  toJSON (RTCConfiguration srvs sfts ttl) =
+  toJSON (RTCConfiguration srvs sfts ttl all_servers) =
     object
       ( [ "ice_servers" .= srvs,
           "ttl" .= ttl
         ]
           <> ["sft_servers" .= sfts | isJust sfts]
+          <> ["sft_servers_all" .= all_servers | isJust all_servers]
       )
 
 instance FromJSON RTCConfiguration where
   parseJSON = withObject "RTCConfiguration" $ \o ->
-    RTCConfiguration <$> o .: "ice_servers" <*> o .:? "sft_servers" <*> o .: "ttl"
+    RTCConfiguration
+      <$> o .: "ice_servers"
+      <*> o .:? "sft_servers"
+      <*> o .: "ttl"
+      <*> o .:? "sft_servers_all"
 
 --------------------------------------------------------------------------------
 -- SFTServer
@@ -165,6 +179,12 @@ modelRtcSftServer = Doc.defineModel "RTC SFT Server" $ do
   Doc.property "urls" (Doc.array Doc.string') $
     Doc.description "Array containing exactly one SFT server address of the form 'https://<addr>:<port>'"
 
+modelRtcSftServerUrl :: Doc.Model
+modelRtcSftServerUrl = Doc.defineModel "RTC SFT Server URL" $ do
+  Doc.description "Inspired by WebRTC 'RTCIceServer' object, contains details of SFT servers"
+  Doc.property "urls" (Doc.array Doc.string') $
+    Doc.description "Array containing exactly one SFT server URL"
+
 --------------------------------------------------------------------------------
 -- RTCIceServer
 
diff --git a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/RTCConfiguration_user.hs b/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/RTCConfiguration_user.hs
index cb52eaec7a7..5ef3d79325d 100644
--- a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/RTCConfiguration_user.hs
+++ b/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/RTCConfiguration_user.hs
@@ -152,6 +152,7 @@ testObject_RTCConfiguration_user_1 =
       )
       (Nothing)
       (2)
+      Nothing
   )
 
 testObject_RTCConfiguration_user_2 :: RTCConfiguration
@@ -334,6 +335,7 @@ testObject_RTCConfiguration_user_2 =
           )
       )
       (4)
+      Nothing
   )
 
 testObject_RTCConfiguration_user_3 :: RTCConfiguration
@@ -480,6 +482,7 @@ testObject_RTCConfiguration_user_3 =
           )
       )
       (9)
+      Nothing
   )
 
 testObject_RTCConfiguration_user_4 :: RTCConfiguration
@@ -685,6 +688,7 @@ testObject_RTCConfiguration_user_4 =
           )
       )
       (2)
+      Nothing
   )
 
 testObject_RTCConfiguration_user_5 :: RTCConfiguration
@@ -728,6 +732,7 @@ testObject_RTCConfiguration_user_5 =
           )
       )
       (2)
+      Nothing
   )
 
 testObject_RTCConfiguration_user_6 :: RTCConfiguration
@@ -750,4 +755,5 @@ testObject_RTCConfiguration_user_6 =
       )
       Nothing
       (2)
+      Nothing
   )
diff --git a/services/brig/brig.cabal b/services/brig/brig.cabal
index 94a4b541681..17a6c70c7b8 100644
--- a/services/brig/brig.cabal
+++ b/services/brig/brig.cabal
@@ -4,7 +4,7 @@ cabal-version: 2.0
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 513c0f5104342fb14b0246f7c44733a84ec36fae97633fc55cb209e0e0bcd087
+-- hash: 244ca5e0c12867ef47ffcfbc056775381028fbc85e5c57eb280afe842e3499d9
 
 name:           brig
 version:        2.0
@@ -167,6 +167,7 @@ library
     , errors >=1.4
     , exceptions >=0.5
     , extended
+    , extra
     , filepath >=1.3
     , fsnotify >=0.2
     , galley-types >=0.75.3
@@ -496,6 +497,7 @@ test-suite brig-tests
     , dns-util
     , http-types
     , imports
+    , iproute
     , polysemy
     , polysemy-wire-zoo
     , retry
diff --git a/services/brig/package.yaml b/services/brig/package.yaml
index 05329979f73..02cd7dbf32b 100644
--- a/services/brig/package.yaml
+++ b/services/brig/package.yaml
@@ -57,6 +57,7 @@ library:
   - errors >=1.4
   - exceptions >=0.5
   - extended
+  - extra
   - filepath >=1.3
   - fsnotify >=0.2
   - galley-types >=0.75.3
@@ -160,6 +161,7 @@ tests:
     - dns-util
     - http-types
     - imports
+    - iproute
     - polysemy
     - polysemy-wire-zoo
     - retry
diff --git a/services/brig/src/Brig/Calling.hs b/services/brig/src/Brig/Calling.hs
index 73e981873a5..9c102058288 100644
--- a/services/brig/src/Brig/Calling.hs
+++ b/services/brig/src/Brig/Calling.hs
@@ -29,6 +29,7 @@ module Brig.Calling
     newEnv,
     sftDiscoveryLoop,
     discoverSFTServers,
+    discoverSFTServersAll,
     discoveryToMaybe,
     randomize,
     startSFTServiceDiscovery,
@@ -46,9 +47,11 @@ import qualified Brig.Options as Opts
 import Brig.Types (TurnURI)
 import Control.Lens
 import Control.Monad.Random.Class (MonadRandom)
+import Data.IP
 import Data.List.NonEmpty (NonEmpty (..))
 import qualified Data.List.NonEmpty as NonEmpty
 import Data.List1
+import Data.Misc (Port (..))
 import Data.Range
 import Data.Time.Clock (DiffTime, diffTimeToPicoseconds)
 import Imports
@@ -59,6 +62,7 @@ import Polysemy.TinyLog
 import qualified System.Logger as Log
 import System.Random.MWC (GenIO, createSystemRandom)
 import System.Random.Shuffle
+import Wire.Network.DNS.A
 import Wire.Network.DNS.Effect
 import Wire.Network.DNS.SRV
 
@@ -109,7 +113,9 @@ data SFTEnv = SFTEnv
     sftDiscoveryInterval :: Int,
     -- | maximum amount of servers to give out,
     -- even if more are in the SRV record
-    sftListLength :: Range 1 100 Int
+    sftListLength :: Range 1 100 Int,
+    sftLookupDomain :: DNS.Domain,
+    sftLookupPort :: Port
   }
 
 data Discovery a
@@ -133,6 +139,14 @@ discoverSFTServers domain =
       err (Log.msg ("DNS Lookup failed for SFT Discovery" :: ByteString) . Log.field "Error" (show e))
       pure Nothing
 
+discoverSFTServersAll :: Members [DNSLookup, TinyLog] r => DNS.Domain -> Sem r (Maybe [IPv4])
+discoverSFTServersAll domain =
+  lookupA domain >>= \case
+    AIPv4s ips -> pure . Just $ ips
+    AResponseError e -> do
+      err (Log.msg ("DNS Lookup failed for SFT Discovery" :: ByteString) . Log.field "Error" (show e))
+      pure Nothing
+
 mkSFTDomain :: SFTOptions -> DNS.Domain
 mkSFTDomain SFTOptions {..} = DNS.normalize $ maybe defSftServiceName ("_" <>) sftSRVServiceName <> "._tcp." <> sftBaseDomain
 
@@ -153,6 +167,8 @@ mkSFTEnv opts =
     <*> pure (mkSFTDomain opts)
     <*> pure (diffTimeToMicroseconds (fromMaybe defSftDiscoveryIntervalSeconds (Opts.sftDiscoveryIntervalSeconds opts)))
     <*> pure (fromMaybe defSftListLength (Opts.sftListLength opts))
+    <*> pure (Opts.sftLookupDomain opts)
+    <*> pure (Opts.sftLookupPort opts)
 
 startSFTServiceDiscovery :: Log.Logger -> SFTEnv -> IO ()
 startSFTServiceDiscovery logger =
diff --git a/services/brig/src/Brig/Calling/API.hs b/services/brig/src/Brig/Calling/API.hs
index e2654a488bc..4e500c9f417 100644
--- a/services/brig/src/Brig/Calling/API.hs
+++ b/services/brig/src/Brig/Calling/API.hs
@@ -29,8 +29,9 @@ import qualified Brig.Calling as Calling
 import Brig.Calling.Internal
 import qualified Brig.Options as Opt
 import Control.Lens
-import Data.ByteString.Conversion (toByteString')
+import Data.ByteString.Conversion
 import Data.ByteString.Lens
+import Data.Either.Extra (eitherToMaybe)
 import Data.Id
 import Data.List.NonEmpty (NonEmpty (..))
 import qualified Data.List.NonEmpty as NonEmpty
@@ -42,14 +43,20 @@ import Data.Text.Ascii (AsciiBase64, encodeBase64)
 import Data.Text.Strict.Lens
 import Data.Time.Clock.POSIX (getPOSIXTime)
 import Imports hiding (head)
+import Network.HTTP.Client hiding (Response)
 import Network.Wai (Response)
 import Network.Wai.Predicate hiding (and, result, setStatus, (#))
 import Network.Wai.Routing hiding (toList)
 import Network.Wai.Utilities hiding (code, message)
 import Network.Wai.Utilities.Swagger (document)
 import OpenSSL.EVP.Digest (Digest, hmacBS)
+import Polysemy (runM)
+import Polysemy.TinyLog
+import System.Logger (Logger)
 import qualified System.Random.MWC as MWC
+import Wire.API.Call.Config (SFTServer)
 import qualified Wire.API.Call.Config as Public
+import Wire.Network.DNS.Effect
 import Wire.Network.DNS.SRV (srvTarget)
 
 routesPublic :: Routes Doc.ApiBuilder Handler ()
@@ -91,10 +98,12 @@ getCallsConfigV2H (_ ::: uid ::: connid ::: limit) =
 -- | ('UserId', 'ConnId' are required as args here to make sure this is an authenticated end-point.)
 getCallsConfigV2 :: UserId -> ConnId -> Maybe (Range 1 10 Int) -> Handler Public.RTCConfiguration
 getCallsConfigV2 _ _ limit = do
-  env <- liftIO =<< readIORef <$> view turnEnvV2
+  env <- liftIO . readIORef =<< view turnEnvV2
   staticUrl <- view $ settings . Opt.sftStaticUrl
   sftEnv' <- view sftEnv
-  newConfig env staticUrl sftEnv' limit
+  httpMan <- view httpManager
+  logger <- view applog
+  newConfig env staticUrl sftEnv' limit httpMan logger
 
 getCallsConfigH :: JSON ::: UserId ::: ConnId -> Handler Response
 getCallsConfigH (_ ::: uid ::: connid) =
@@ -102,8 +111,10 @@ getCallsConfigH (_ ::: uid ::: connid) =
 
 getCallsConfig :: UserId -> ConnId -> Handler Public.RTCConfiguration
 getCallsConfig _ _ = do
-  env <- liftIO =<< readIORef <$> view turnEnv
-  dropTransport <$> newConfig env Nothing Nothing Nothing
+  env <- liftIO . readIORef =<< view turnEnv
+  httpMan <- view httpManager
+  logger <- view applog
+  dropTransport <$> newConfig env Nothing Nothing Nothing httpMan logger
   where
     -- In order to avoid being backwards incompatible, remove the `transport` query param from the URIs
     dropTransport :: Public.RTCConfiguration -> Public.RTCConfiguration
@@ -112,8 +123,16 @@ getCallsConfig _ _ = do
         (Public.rtcConfIceServers . traverse . Public.iceURLs . traverse . Public.turiTransport)
         Nothing
 
-newConfig :: MonadIO m => Calling.Env -> Maybe HttpsUrl -> Maybe SFTEnv -> Maybe (Range 1 10 Int) -> m Public.RTCConfiguration
-newConfig env sftStaticUrl mSftEnv limit = do
+newConfig ::
+  MonadIO m =>
+  Calling.Env ->
+  Maybe HttpsUrl ->
+  Maybe SFTEnv ->
+  Maybe (Range 1 10 Int) ->
+  Manager ->
+  Logger ->
+  m Public.RTCConfiguration
+newConfig env sftStaticUrl mSftEnv limit httpMan logger = do
   let (sha, secret, tTTL, cTTL, prng) = (env ^. turnSHA512, env ^. turnSecret, env ^. turnTokenTTL, env ^. turnConfigTTL, env ^. turnPrng)
   -- randomize list of servers (before limiting the list, to ensure not always the same servers are chosen if limit is set)
   randomizedUris <- liftIO $ randomize (List1.toNonEmpty $ env ^. turnServers)
@@ -134,7 +153,28 @@ newConfig env sftStaticUrl mSftEnv limit = do
       let subsetLength = Calling.sftListLength actualSftEnv
       liftIO $ mapM (getRandomSFTServers subsetLength) sftSrvEntries
 
-  pure $ Public.rtcConfiguration srvs (staticSft <|> sftServerFromSrvTarget . srvTarget <$$> sftEntries) cTTL
+  let mSftServers = staticSft <|> sftServerFromSrvTarget . srvTarget <$$> sftEntries
+  mSftServersAll :: Maybe (Maybe [SFTServer]) <- for mSftEnv $ \e -> liftIO $ do
+    response <- runM . runTinyLog logger . runDNSLookupDefault . discoverSFTServersAll . sftLookupDomain $ e
+    case response of
+      Nothing -> pure $ Nothing @[SFTServer]
+      Just ips -> fmap (eitherToMaybe @String @[SFTServer] . sequence) $
+        for ips $ \ip -> do
+          let req =
+                parseRequest_ $
+                  mconcat
+                    [ "GET ",
+                      show ip,
+                      ":",
+                      show . sftLookupPort $ e,
+                      "/sft/url"
+                    ]
+          -- TODO: introduce an effect for talking to SFT. Perhaps this could be a
+          -- part of an existing effect External.
+          sftUrlResponse <- liftIO (responseBody <$> httpLbs req httpMan)
+          pure @IO . fmap Public.sftServer . runParser' (parser @HttpsUrl) $ sftUrlResponse
+
+  pure $ Public.rtcConfiguration srvs mSftServers cTTL (join mSftServersAll)
   where
     limitedList :: NonEmpty Public.TurnURI -> Range 1 10 Int -> NonEmpty Public.TurnURI
     limitedList uris lim =
diff --git a/services/brig/src/Brig/Options.hs b/services/brig/src/Brig/Options.hs
index ad631e49325..5d73b27e89e 100644
--- a/services/brig/src/Brig/Options.hs
+++ b/services/brig/src/Brig/Options.hs
@@ -33,7 +33,7 @@ import Data.Aeson.Types (typeMismatch)
 import qualified Data.Char as Char
 import Data.Domain (Domain (..))
 import Data.Id
-import Data.Misc (HttpsUrl)
+import Data.Misc (HttpsUrl, Port (..))
 import Data.Range
 import Data.Scientific (toBoundedInteger)
 import qualified Data.Text as Text
@@ -612,7 +612,9 @@ data SFTOptions = SFTOptions
   { sftBaseDomain :: !DNS.Domain,
     sftSRVServiceName :: !(Maybe ByteString), -- defaults to defSftServiceName if unset
     sftDiscoveryIntervalSeconds :: !(Maybe DiffTime), -- defaults to defSftDiscoveryIntervalSeconds
-    sftListLength :: !(Maybe (Range 1 100 Int)) -- defaults to defSftListLength
+    sftListLength :: !(Maybe (Range 1 100 Int)), -- defaults to defSftListLength
+    sftLookupDomain :: !DNS.Domain,
+    sftLookupPort :: !Port
   }
   deriving (Show, Generic)
 
@@ -623,6 +625,8 @@ instance FromJSON SFTOptions where
       <*> (mapM asciiOnly =<< o .:? "sftSRVServiceName")
       <*> (secondsToDiffTime <$$> o .:? "sftDiscoveryIntervalSeconds")
       <*> (o .:? "sftListLength")
+      <*> (asciiOnly =<< o .: "sftLookupDomain")
+      <*> o .: "sftLookupPort"
     where
       asciiOnly :: Text -> Y.Parser ByteString
       asciiOnly t =
diff --git a/services/brig/test/integration/API/Calling.hs b/services/brig/test/integration/API/Calling.hs
index be0185af2d0..6515f2272ff 100644
--- a/services/brig/test/integration/API/Calling.hs
+++ b/services/brig/test/integration/API/Calling.hs
@@ -32,7 +32,7 @@ import Data.Id
 import qualified Data.List.NonEmpty as NonEmpty
 import Data.List1 (List1)
 import qualified Data.List1 as List1
-import Data.Misc (Port, mkHttpsUrl)
+import Data.Misc (Port (..), mkHttpsUrl)
 import qualified Data.Set as Set
 import Imports
 import System.FilePath ((</>))
@@ -103,12 +103,16 @@ testSFT :: Brig -> Opts.Opts -> Http ()
 testSFT b opts = do
   uid <- userId <$> randomUser b
   cfg <- getTurnConfigurationV2 uid b
-  liftIO $
+  liftIO $ do
     assertEqual
       "when SFT discovery is not enabled, sft_servers shouldn't be returned"
       Nothing
       (cfg ^. rtcConfSftServers)
-  withSettingsOverrides (opts & Opts.sftL ?~ Opts.SFTOptions "integration-tests.zinfra.io" Nothing (Just 0.001) Nothing) $ do
+    assertEqual
+      "when SFT discovery is not enabled, sft_servers_all shouldn't be returned"
+      Nothing
+      (cfg ^. rtcConfSftServersAll)
+  withSettingsOverrides (opts & Opts.sftL ?~ Opts.SFTOptions "integration-tests.zinfra.io" Nothing (Just 0.001) Nothing "integration-tests.zinfra.io" (Port 8585)) $ do
     cfg1 <- retryWhileN 10 (isNothing . view rtcConfSftServers) (getTurnConfigurationV2 uid b)
     -- These values are controlled by https://github.com/zinfra/cailleach/tree/77ca2d23cf2959aa183dd945d0a0b13537a8950d/environments/dns-integration-tests
     let Right server1 = mkHttpsUrl =<< first show (parseURI laxURIParserOptions "https://sft01.integration-tests.zinfra.io:443")
diff --git a/services/brig/test/unit/Test/Brig/Calling.hs b/services/brig/test/unit/Test/Brig/Calling.hs
index 8fab0a2731f..64af8c99b84 100644
--- a/services/brig/test/unit/Test/Brig/Calling.hs
+++ b/services/brig/test/unit/Test/Brig/Calling.hs
@@ -22,8 +22,10 @@ module Test.Brig.Calling where
 import Brig.Calling
 import Brig.Options
 import Control.Retry
+import Data.IP
 import Data.List.NonEmpty (NonEmpty (..))
 import qualified Data.List.NonEmpty as NonEmpty
+import Data.Misc (Port (..))
 import Data.Range
 import qualified Data.Set as Set
 import Imports
@@ -34,23 +36,28 @@ import qualified System.Logger as Log
 import Test.Tasty
 import Test.Tasty.HUnit
 import qualified UnliftIO.Async as Async
+import qualified Wire.Network.DNS.A as A
 import Wire.Network.DNS.Effect
 import Wire.Network.DNS.SRV
 
 data FakeDNSEnv = FakeDNSEnv
-  { fakeLookupFn :: Domain -> SrvResponse,
+  { fakeLookupSrv :: Domain -> SrvResponse,
+    fakeLookupA :: Domain -> A.AResponse,
     fakeLookupCalls :: IORef [Domain]
   }
 
-newFakeDNSEnv :: (Domain -> SrvResponse) -> IO FakeDNSEnv
-newFakeDNSEnv lookupFn =
-  FakeDNSEnv lookupFn <$> newIORef []
+newFakeDNSEnv :: (Domain -> SrvResponse) -> (Domain -> A.AResponse) -> IO FakeDNSEnv
+newFakeDNSEnv lookupSrvFn lookupAFn =
+  FakeDNSEnv lookupSrvFn lookupAFn <$> newIORef []
 
 runFakeDNSLookup :: Member (Embed IO) r => FakeDNSEnv -> Sem (DNSLookup ': r) a -> Sem r a
 runFakeDNSLookup FakeDNSEnv {..} = interpret $ \case
   LookupSRV domain -> do
     modifyIORef' fakeLookupCalls (++ [domain])
-    pure $ fakeLookupFn domain
+    pure $ fakeLookupSrv domain
+  LookupA domain -> do
+    modifyIORef' fakeLookupCalls (++ [domain])
+    pure $ fakeLookupA domain
 
 newtype LogRecorder = LogRecorder {recordedLogs :: IORef [(Log.Level, LByteString)]}
 
@@ -67,18 +74,19 @@ ignoreLogs = interpret $ \(Polylog _ _) -> pure ()
 {-# ANN tests ("HLint: ignore" :: String) #-}
 tests :: TestTree
 tests =
-  testGroup "Calling" $
+  testGroup
+    "Calling"
     [ testGroup "mkSFTDomain" $
         [ testCase "when service name is provided" $
             assertEqual
               "should use the service name to form domain"
               "_foo._tcp.example.com."
-              (mkSFTDomain (SFTOptions "example.com" (Just "foo") Nothing Nothing)),
+              (mkSFTDomain (SFTOptions "example.com" (Just "foo") Nothing Nothing "example.com" (Port 8585))),
           testCase "when service name is not provided" $
             assertEqual
               "should assume service name to be 'sft'"
               "_sft._tcp.example.com."
-              (mkSFTDomain (SFTOptions "example.com" Nothing Nothing Nothing))
+              (mkSFTDomain (SFTOptions "example.com" Nothing Nothing Nothing "example.com" (Port 8585)))
         ],
       testGroup "sftDiscoveryLoop" $
         [ testCase "when service can be discovered" $ void testDiscoveryLoopWhenSuccessful,
@@ -95,6 +103,10 @@ tests =
         [ testCase "more servers in SRV than limit" testSFTManyServers,
           testCase "fewer servers in SRV than limit" testSFTFewerServers
           -- the randomization part is not (yet?) tested here.
+        ],
+      testGroup "discoverSFTServersAll" $
+        [ testCase "when service is available" testSFTDiscoverAWhenAvailable,
+          testCase "when dns lookup fails" testSFTDiscoverAWhenDNSFails
         ]
     ]
 
@@ -104,8 +116,8 @@ testDiscoveryLoopWhenSuccessful = do
       entry2 = SrvEntry 0 0 (SrvTarget "sft2.foo.example.com." 443)
       entry3 = SrvEntry 0 0 (SrvTarget "sft3.foo.example.com." 443)
       returnedEntries = entry1 :| [entry2, entry3]
-  fakeDNSEnv <- newFakeDNSEnv (\_ -> SrvAvailable returnedEntries)
-  sftEnv <- mkSFTEnv (SFTOptions "foo.example.com" Nothing (Just 0.001) Nothing)
+  fakeDNSEnv <- newFakeDNSEnv (\_ -> SrvAvailable returnedEntries) undefined
+  sftEnv <- mkSFTEnv (SFTOptions "foo.example.com" Nothing (Just 0.001) Nothing "foo.example.com" (Port 8585))
 
   discoveryLoop <- Async.async $ runM . ignoreLogs . runFakeDNSLookup fakeDNSEnv $ sftDiscoveryLoop sftEnv
   void $ retryEvery10MicrosWhileN 2000 (== 0) (length <$> readIORef (fakeLookupCalls fakeDNSEnv))
@@ -119,8 +131,8 @@ testDiscoveryLoopWhenSuccessful = do
 
 testDiscoveryLoopWhenUnsuccessful :: IO ()
 testDiscoveryLoopWhenUnsuccessful = do
-  fakeDNSEnv <- newFakeDNSEnv (\_ -> SrvNotAvailable)
-  sftEnv <- mkSFTEnv (SFTOptions "foo.example.com" Nothing (Just 0.001) Nothing)
+  fakeDNSEnv <- newFakeDNSEnv (const SrvNotAvailable) undefined
+  sftEnv <- mkSFTEnv (SFTOptions "foo.example.com" Nothing (Just 0.001) Nothing "foo.example.com" (Port 8585))
 
   discoveryLoop <- Async.async $ runM . ignoreLogs . runFakeDNSLookup fakeDNSEnv $ sftDiscoveryLoop sftEnv
   -- We wait for at least two lookups to be sure that the lookup loop looped at
@@ -138,7 +150,7 @@ testDiscoveryLoopWhenUnsuccessfulAfterSuccess = do
 
   -- In the following lines we re-use the 'sftEnv' from a successful lookup to
   -- replicate what will happen when a dns lookup fails after success
-  failingFakeDNSEnv <- newFakeDNSEnv (\_ -> SrvNotAvailable)
+  failingFakeDNSEnv <- newFakeDNSEnv (const SrvNotAvailable) undefined
   discoveryLoop <- Async.async $ runM . ignoreLogs . runFakeDNSLookup failingFakeDNSEnv $ sftDiscoveryLoop sftEnv
   -- We wait for at least two lookups to be sure that the lookup loop looped at
   -- least once
@@ -156,9 +168,9 @@ testDiscoveryLoopWhenURLsChange = do
   -- replicate what will happen when a dns lookup returns new URLs
   let entry1 = SrvEntry 0 0 (SrvTarget "sft4.foo.example.com." 443)
       entry2 = SrvEntry 0 0 (SrvTarget "sft5.foo.example.com." 443)
-      newEntries = (entry1 :| [entry2])
+      newEntries = entry1 :| [entry2]
 
-  fakeDNSEnv <- newFakeDNSEnv (\_ -> SrvAvailable newEntries)
+  fakeDNSEnv <- newFakeDNSEnv (const $ SrvAvailable newEntries) undefined
   discoveryLoop <- Async.async $ runM . ignoreLogs . runFakeDNSLookup fakeDNSEnv $ sftDiscoveryLoop sftEnv
   void $ retryEvery10MicrosWhileN 2000 (== 0) (length <$> readIORef (fakeLookupCalls fakeDNSEnv))
   -- We don't want to stop the loop before it has written to the sftServers IORef
@@ -173,8 +185,8 @@ testSFTDiscoverWhenAvailable = do
   logRecorder <- newLogRecorder
   let entry1 = SrvEntry 0 0 (SrvTarget "sft7.foo.example.com." 443)
       entry2 = SrvEntry 0 0 (SrvTarget "sft8.foo.example.com." 8843)
-      returnedEntries = (entry1 :| [entry2])
-  fakeDNSEnv <- newFakeDNSEnv (\_ -> SrvAvailable returnedEntries)
+      returnedEntries = entry1 :| [entry2]
+  fakeDNSEnv <- newFakeDNSEnv (\_ -> SrvAvailable returnedEntries) undefined
 
   assertEqual "discovered servers should be returned" (Just returnedEntries)
     =<< ( runM . recordLogs logRecorder . runFakeDNSLookup fakeDNSEnv $
@@ -186,7 +198,7 @@ testSFTDiscoverWhenAvailable = do
 testSFTDiscoverWhenNotAvailable :: IO ()
 testSFTDiscoverWhenNotAvailable = do
   logRecorder <- newLogRecorder
-  fakeDNSEnv <- newFakeDNSEnv (\_ -> SrvNotAvailable)
+  fakeDNSEnv <- newFakeDNSEnv (const SrvNotAvailable) undefined
 
   assertEqual "discovered servers should be returned" Nothing
     =<< ( runM . recordLogs logRecorder . runFakeDNSLookup fakeDNSEnv $
@@ -198,9 +210,9 @@ testSFTDiscoverWhenNotAvailable = do
 testSFTDiscoverWhenDNSFails :: IO ()
 testSFTDiscoverWhenDNSFails = do
   logRecorder <- newLogRecorder
-  fakeDNSEnv <- newFakeDNSEnv (\_ -> SrvResponseError IllegalDomain)
+  fakeDNSEnv <- newFakeDNSEnv (const $ SrvResponseError IllegalDomain) undefined
 
-  assertEqual "discovered servers should be returned" Nothing
+  assertEqual "no servers should be returned" Nothing
     =<< ( runM . recordLogs logRecorder . runFakeDNSLookup fakeDNSEnv $
             discoverSFTServers "_sft._tcp.foo.example.com"
         )
@@ -239,3 +251,30 @@ retryEvery10MicrosWhileN n f m =
     (constantDelay 10 <> limitRetries n)
     (const (return . f))
     (const m)
+
+testSFTDiscoverAWhenAvailable :: IO ()
+testSFTDiscoverAWhenAvailable = do
+  logRecorder <- newLogRecorder
+  let entry1 = read "192.0.2.1" :: IPv4
+      entry2 = read "192.0.2.2" :: IPv4
+      returnedEntries = [entry1, entry2]
+  fakeDNSEnv <- newFakeDNSEnv undefined (const $ A.AIPv4s returnedEntries)
+
+  assertEqual "discovered servers should be returned" (Just returnedEntries)
+    =<< ( runM . recordLogs logRecorder . runFakeDNSLookup fakeDNSEnv $
+            discoverSFTServersAll "foo.example.com"
+        )
+  assertEqual "nothing should be logged" []
+    =<< readIORef (recordedLogs logRecorder)
+
+testSFTDiscoverAWhenDNSFails :: IO ()
+testSFTDiscoverAWhenDNSFails = do
+  logRecorder <- newLogRecorder
+  fakeDNSEnv <- newFakeDNSEnv undefined (const $ A.AResponseError IllegalDomain)
+
+  assertEqual "no servers should be returned" Nothing
+    =<< ( runM . recordLogs logRecorder . runFakeDNSLookup fakeDNSEnv $
+            discoverSFTServersAll "foo.example.com"
+        )
+  assertEqual "should warn about it in the logs" [(Log.Error, "DNS Lookup failed for SFT Discovery, Error=IllegalDomain\n")]
+    =<< readIORef (recordedLogs logRecorder)

From dd6bdcda76d3f81b3e3d4b17f7947a8ae48b655c Mon Sep 17 00:00:00 2001
From: Sven Tennie <sven.tennie@wire.com>
Date: Wed, 29 Dec 2021 11:27:12 +0100
Subject: [PATCH 39/74] Add documentation about linting

---
 .gitignore                |  5 +++-
 docs/developer/linting.md | 55 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 59 insertions(+), 1 deletion(-)
 create mode 100644 docs/developer/linting.md

diff --git a/.gitignore b/.gitignore
index d1c8a56e869..a906ed007c6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -85,6 +85,9 @@ hie.yaml
 hie.orig.yaml
 stack-dev.yaml
 
+# HIE db files (e.g. generated for stan)
+*.hie
+
 # generated files under .local
 .local
 
@@ -102,4 +105,4 @@ telepresence.log
 
 # local config
 .envrc.local
-cabal.project.local
\ No newline at end of file
+cabal.project.local
diff --git a/docs/developer/linting.md b/docs/developer/linting.md
new file mode 100644
index 00000000000..e0d787433ae
--- /dev/null
+++ b/docs/developer/linting.md
@@ -0,0 +1,55 @@
+# Linting
+
+# HLint
+
+To run [HLint](https://github.com/ndmitchell/hlint) you need it's binary, e.g.
+by executing:
+
+```sh
+nix-shell -p hlint
+```
+
+To run it on the whole project (Warning: This takes long!):
+
+```sh
+hlint .
+```
+
+To run it on a sub-project:
+
+```sh
+hlint services/federator
+```
+
+# Stan
+
+To run [Stan](https://github.com/kowainik/stan), you need it's binary compiled
+by the same GHC version as used in the project.
+
+```sh
+nix-shell -p haskell.packages.ghc884.stan
+```
+
+Stan depends on [*hie*](https://www.haskell.org/ghc/blog/20190626-HIEFiles.html)
+database files that are created during compilation. To generate them for all
+packages add this to your `cabal.project.local` file:
+
+```
+package *
+    ghc-options: -fwrite-ide-info -hiedir=.hie
+```
+
+Of course, you can append the `ghc-options` to the respective entry of a package or
+add a new one:
+
+```sh
+package cargohold
+    ghc-options: -fwrite-ide-info -hiedir=.hie
+```
+
+To analyze a sub-project with stan:
+
+```sh
+cd services/cargohold
+stan
+```

From 0ec9c66237d8403fe7239289e690e78cf5dd0b59 Mon Sep 17 00:00:00 2001
From: Sven Tennie <sven.tennie@wire.com>
Date: Wed, 29 Dec 2021 13:52:37 +0100
Subject: [PATCH 40/74] Update docs/developer/linting.md

Co-authored-by: Julia Longtin <julia.longtin@wire.com>
---
 docs/developer/linting.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/developer/linting.md b/docs/developer/linting.md
index e0d787433ae..5dcbf75ab0f 100644
--- a/docs/developer/linting.md
+++ b/docs/developer/linting.md
@@ -9,7 +9,7 @@ by executing:
 nix-shell -p hlint
 ```
 
-To run it on the whole project (Warning: This takes long!):
+To run it on the whole project (Warning: This takes a long time!):
 
 ```sh
 hlint .

From 8613748a62b138e331b7848b50811f09bda1f26c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marko=20Dimja=C5=A1evi=C4=87?= <marko.dimjasevic@wire.com>
Date: Thu, 30 Dec 2021 15:42:12 +0100
Subject: [PATCH 41/74] Enable Insecure Requests for SFT Lookups in a Test
 Environment (#2014)

* Move SFT lookup parameters to another configuration section
* Fix a request to an SFT's `GET /sft/url`
* Group the SFT lookup domain and port in Brig configuration
* Fix how the SFT environment is computed. Before, it would rely on
the SFT lookup parameters to be set to keep on working. This change makes SFT
lookup parameters truly optional.
* Add a Brig configuration flag for insecure connections in test environments
* Introduce an effect for SFT
---
 .../6-federation/sft-servers-all-fixup        |  1 +
 charts/brig/templates/configmap.yaml          | 10 ++-
 services/brig/brig.cabal                      |  5 +-
 services/brig/brig.integration.yaml           |  6 ++
 services/brig/package.yaml                    |  2 +
 services/brig/src/Brig/App.hs                 |  2 +-
 services/brig/src/Brig/Calling.hs             | 11 ++-
 services/brig/src/Brig/Calling/API.hs         | 49 +++++++------
 services/brig/src/Brig/Effects/SFT.hs         | 68 +++++++++++++++++++
 services/brig/src/Brig/Options.hs             | 47 +++++++++++--
 services/brig/test/integration/API/Calling.hs | 10 ++-
 services/brig/test/unit/Test/Brig/Calling.hs  | 26 +++----
 12 files changed, 179 insertions(+), 58 deletions(-)
 create mode 100644 changelog.d/6-federation/sft-servers-all-fixup
 create mode 100644 services/brig/src/Brig/Effects/SFT.hs

diff --git a/changelog.d/6-federation/sft-servers-all-fixup b/changelog.d/6-federation/sft-servers-all-fixup
new file mode 100644
index 00000000000..25c1a8fb06d
--- /dev/null
+++ b/changelog.d/6-federation/sft-servers-all-fixup
@@ -0,0 +1 @@
+Improve Brig's configuration for SFTs and fix a call to SFT servers
diff --git a/charts/brig/templates/configmap.yaml b/charts/brig/templates/configmap.yaml
index 967217453d1..88be747050b 100644
--- a/charts/brig/templates/configmap.yaml
+++ b/charts/brig/templates/configmap.yaml
@@ -175,8 +175,6 @@ data:
       {{- if .sftDiscoveryIntervalSeconds }}
       sftDiscoveryIntervalSeconds: {{ .sftDiscoveryIntervalSeconds }}
       {{- end }}
-      sftLookupDomain: {{ required "Missing value: .sft.sftLookupDomain" .sftLookupDomain }}
-      sftLookupPort: {{ required "Missing value: .sft.sftLookupPort" .sftLookupPort }}
     {{- end }}
     {{- end }}
 
@@ -230,5 +228,13 @@ data:
       {{- if .setSftStaticUrl }}
       setSftStaticUrl: {{ .setSftStaticUrl }}
       {{- end }}
+      {{- if .setSftLookup }}
+      {{- with .setSftLookup }}
+      setSftLookup:
+        domain: {{ required "Missing value: .setSftLookup.domain" .setSftLookup.domain }}
+        port: {{ required "Missing value: .setSftLookup.port" .setSftLookup.port }}
+        isTestingEnvironment: {{ .setSftLookup.isTestingEnvironment }}
+      {{- end }}
+      {{- end }}
     {{- end }}
   {{- end }}
diff --git a/services/brig/brig.cabal b/services/brig/brig.cabal
index 17a6c70c7b8..fe097e533ae 100644
--- a/services/brig/brig.cabal
+++ b/services/brig/brig.cabal
@@ -4,7 +4,7 @@ cabal-version: 2.0
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 244ca5e0c12867ef47ffcfbc056775381028fbc85e5c57eb280afe842e3499d9
+-- hash: addf4b080e564149f44c6cdb33c824734aa68cc9ff021f41268938902e2958b0
 
 name:           brig
 version:        2.0
@@ -64,6 +64,7 @@ library
       Brig.Data.User
       Brig.Data.UserKey
       Brig.Data.UserPendingActivation
+      Brig.Effects.SFT
       Brig.Email
       Brig.Federation.Client
       Brig.Index.Eval
@@ -154,6 +155,7 @@ library
     , cassandra-util >=0.16.2
     , comonad
     , conduit >=1.2.8
+    , connection
     , containers >=0.5
     , cookie >=0.4
     , cryptobox-haskell >=0.1.1
@@ -177,6 +179,7 @@ library
     , html-entities >=1.1
     , http-client >=0.5
     , http-client-openssl >=0.2
+    , http-client-tls
     , http-media
     , http-types >=0.8
     , imports
diff --git a/services/brig/brig.integration.yaml b/services/brig/brig.integration.yaml
index b5ca314dfb9..07175fdd7be 100644
--- a/services/brig/brig.integration.yaml
+++ b/services/brig/brig.integration.yaml
@@ -178,6 +178,12 @@ optSettings:
   #   Remember to keep it the same in Galley.
   setFederationDomain: example.com
   setFeatureFlags:  # see #RefConfigOptions in `/docs/reference`
+  # FUTUREWORK: Replace the following SFT DNS lookup parameters with something
+  # to be added to the CI environment
+  setSftLookup:
+    domain: sftd.integration-tests.zinfra.io
+    port: 443
+    isTestingEnvironment: true
 
 logLevel: Warn
 # ^ NOTE: We log too much in brig, if we set this to Info like other services, running tests
diff --git a/services/brig/package.yaml b/services/brig/package.yaml
index 02cd7dbf32b..0f10e5f4b24 100644
--- a/services/brig/package.yaml
+++ b/services/brig/package.yaml
@@ -44,6 +44,7 @@ library:
   - cassandra-util >=0.16.2
   - comonad
   - conduit >=1.2.8
+  - connection
   - containers >=0.5
   - cookie >=0.4
   - cryptobox-haskell >=0.1.1
@@ -71,6 +72,7 @@ library:
   - html-entities >=1.1
   - http-client >=0.5
   - http-client-openssl >=0.2
+  - http-client-tls
   - http-media
   - http-types >=0.8
   - imports
diff --git a/services/brig/src/Brig/App.hs b/services/brig/src/Brig/App.hs
index 326ca0b0a24..6f68e03adf2 100644
--- a/services/brig/src/Brig/App.hs
+++ b/services/brig/src/Brig/App.hs
@@ -214,7 +214,7 @@ newEnv o = do
   eventsQueue <- case Opt.internalEventsQueue (Opt.internalEvents o) of
     StompQueue q -> pure (StompQueue q)
     SqsQueue q -> SqsQueue <$> AWS.getQueueUrl (aws ^. AWS.amazonkaEnv) q
-  mSFTEnv <- mapM Calling.mkSFTEnv $ Opt.sft o
+  mSFTEnv <- mapM Calling.mkSFTEnv $ (,Opt.setSftLookup . Opt.optSettings $ o) <$> Opt.sft o
   prekeyLocalLock <- case Opt.randomPrekeys o of
     Just True -> Just <$> newMVar ()
     _ -> pure Nothing
diff --git a/services/brig/src/Brig/Calling.hs b/services/brig/src/Brig/Calling.hs
index 9c102058288..97537d82cbe 100644
--- a/services/brig/src/Brig/Calling.hs
+++ b/services/brig/src/Brig/Calling.hs
@@ -51,7 +51,6 @@ import Data.IP
 import Data.List.NonEmpty (NonEmpty (..))
 import qualified Data.List.NonEmpty as NonEmpty
 import Data.List1
-import Data.Misc (Port (..))
 import Data.Range
 import Data.Time.Clock (DiffTime, diffTimeToPicoseconds)
 import Imports
@@ -114,8 +113,7 @@ data SFTEnv = SFTEnv
     -- | maximum amount of servers to give out,
     -- even if more are in the SRV record
     sftListLength :: Range 1 100 Int,
-    sftLookupDomain :: DNS.Domain,
-    sftLookupPort :: Port
+    sftLookup :: Maybe Opts.SFTLookup
   }
 
 data Discovery a
@@ -160,15 +158,14 @@ sftDiscoveryLoop SFTEnv {..} = forever $ do
     Just es -> atomicWriteIORef sftServers (Discovered (SFTServers es))
   threadDelay sftDiscoveryInterval
 
-mkSFTEnv :: SFTOptions -> IO SFTEnv
-mkSFTEnv opts =
+mkSFTEnv :: (SFTOptions, Maybe Opts.SFTLookup) -> IO SFTEnv
+mkSFTEnv (opts, msftLookup) =
   SFTEnv
     <$> newIORef NotDiscoveredYet
     <*> pure (mkSFTDomain opts)
     <*> pure (diffTimeToMicroseconds (fromMaybe defSftDiscoveryIntervalSeconds (Opts.sftDiscoveryIntervalSeconds opts)))
     <*> pure (fromMaybe defSftListLength (Opts.sftListLength opts))
-    <*> pure (Opts.sftLookupDomain opts)
-    <*> pure (Opts.sftLookupPort opts)
+    <*> pure msftLookup
 
 startSFTServiceDiscovery :: Log.Logger -> SFTEnv -> IO ()
 startSFTServiceDiscovery logger =
diff --git a/services/brig/src/Brig/Calling/API.hs b/services/brig/src/Brig/Calling/API.hs
index 4e500c9f417..44c1d2b7d2a 100644
--- a/services/brig/src/Brig/Calling/API.hs
+++ b/services/brig/src/Brig/Calling/API.hs
@@ -27,6 +27,7 @@ import Brig.App
 import Brig.Calling
 import qualified Brig.Calling as Calling
 import Brig.Calling.Internal
+import Brig.Effects.SFT
 import qualified Brig.Options as Opt
 import Control.Lens
 import Data.ByteString.Conversion
@@ -43,7 +44,8 @@ import Data.Text.Ascii (AsciiBase64, encodeBase64)
 import Data.Text.Strict.Lens
 import Data.Time.Clock.POSIX (getPOSIXTime)
 import Imports hiding (head)
-import Network.HTTP.Client hiding (Response)
+import Network.Connection
+import Network.HTTP.Client.TLS (mkManagerSettings, newTlsManager, newTlsManagerWith)
 import Network.Wai (Response)
 import Network.Wai.Predicate hiding (and, result, setStatus, (#))
 import Network.Wai.Routing hiding (toList)
@@ -101,9 +103,8 @@ getCallsConfigV2 _ _ limit = do
   env <- liftIO . readIORef =<< view turnEnvV2
   staticUrl <- view $ settings . Opt.sftStaticUrl
   sftEnv' <- view sftEnv
-  httpMan <- view httpManager
   logger <- view applog
-  newConfig env staticUrl sftEnv' limit httpMan logger
+  newConfig env staticUrl sftEnv' limit logger
 
 getCallsConfigH :: JSON ::: UserId ::: ConnId -> Handler Response
 getCallsConfigH (_ ::: uid ::: connid) =
@@ -112,9 +113,8 @@ getCallsConfigH (_ ::: uid ::: connid) =
 getCallsConfig :: UserId -> ConnId -> Handler Public.RTCConfiguration
 getCallsConfig _ _ = do
   env <- liftIO . readIORef =<< view turnEnv
-  httpMan <- view httpManager
   logger <- view applog
-  dropTransport <$> newConfig env Nothing Nothing Nothing httpMan logger
+  dropTransport <$> newConfig env Nothing Nothing Nothing logger
   where
     -- In order to avoid being backwards incompatible, remove the `transport` query param from the URIs
     dropTransport :: Public.RTCConfiguration -> Public.RTCConfiguration
@@ -129,10 +129,9 @@ newConfig ::
   Maybe HttpsUrl ->
   Maybe SFTEnv ->
   Maybe (Range 1 10 Int) ->
-  Manager ->
   Logger ->
   m Public.RTCConfiguration
-newConfig env sftStaticUrl mSftEnv limit httpMan logger = do
+newConfig env sftStaticUrl mSftEnv limit logger = do
   let (sha, secret, tTTL, cTTL, prng) = (env ^. turnSHA512, env ^. turnSecret, env ^. turnTokenTTL, env ^. turnConfigTTL, env ^. turnPrng)
   -- randomize list of servers (before limiting the list, to ensure not always the same servers are chosen if limit is set)
   randomizedUris <- liftIO $ randomize (List1.toNonEmpty $ env ^. turnServers)
@@ -153,27 +152,27 @@ newConfig env sftStaticUrl mSftEnv limit httpMan logger = do
       let subsetLength = Calling.sftListLength actualSftEnv
       liftIO $ mapM (getRandomSFTServers subsetLength) sftSrvEntries
 
-  let mSftServers = staticSft <|> sftServerFromSrvTarget . srvTarget <$$> sftEntries
-  mSftServersAll :: Maybe (Maybe [SFTServer]) <- for mSftEnv $ \e -> liftIO $ do
-    response <- runM . runTinyLog logger . runDNSLookupDefault . discoverSFTServersAll . sftLookupDomain $ e
+  mSftServersAll :: Maybe (Maybe [SFTServer]) <- for (mSftEnv >>= sftLookup) $ \sftl -> liftIO $ do
+    httpMan <-
+      if Opt.sftlIsTestEnv sftl
+        then
+          let s = TLSSettingsSimple True False True
+           in newTlsManagerWith $ mkManagerSettings s Nothing
+        else newTlsManager
+    response <-
+      runM
+        . runTinyLog logger
+        . runDNSLookupDefault
+        . discoverSFTServersAll
+        . Opt.unLookupDomain
+        . Opt.sftlDomain
+        $ sftl
     case response of
       Nothing -> pure $ Nothing @[SFTServer]
-      Just ips -> fmap (eitherToMaybe @String @[SFTServer] . sequence) $
-        for ips $ \ip -> do
-          let req =
-                parseRequest_ $
-                  mconcat
-                    [ "GET ",
-                      show ip,
-                      ":",
-                      show . sftLookupPort $ e,
-                      "/sft/url"
-                    ]
-          -- TODO: introduce an effect for talking to SFT. Perhaps this could be a
-          -- part of an existing effect External.
-          sftUrlResponse <- liftIO (responseBody <$> httpLbs req httpMan)
-          pure @IO . fmap Public.sftServer . runParser' (parser @HttpsUrl) $ sftUrlResponse
+      Just ips -> fmap (eitherToMaybe @SFTError @[SFTServer] . sequence) $
+        for ips $ \ip -> runM . interpretSFT httpMan $ sftGetClientUrl ip (Opt.sftlPort sftl)
 
+  let mSftServers = staticSft <|> sftServerFromSrvTarget . srvTarget <$$> sftEntries
   pure $ Public.rtcConfiguration srvs mSftServers cTTL (join mSftServersAll)
   where
     limitedList :: NonEmpty Public.TurnURI -> Range 1 10 Int -> NonEmpty Public.TurnURI
diff --git a/services/brig/src/Brig/Effects/SFT.hs b/services/brig/src/Brig/Effects/SFT.hs
new file mode 100644
index 00000000000..2297a7a1df1
--- /dev/null
+++ b/services/brig/src/Brig/Effects/SFT.hs
@@ -0,0 +1,68 @@
+-- This file is part of the Wire Server implementation.
+--
+-- Copyright (C) 2021 Wire Swiss GmbH <opensource@wire.com>
+--
+-- This program is free software: you can redistribute it and/or modify it under
+-- the terms of the GNU Affero General Public License as published by the Free
+-- Software Foundation, either version 3 of the License, or (at your option) any
+-- later version.
+--
+-- This program is distributed in the hope that it will be useful, but WITHOUT
+-- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+-- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+-- details.
+--
+-- You should have received a copy of the GNU Affero General Public License along
+-- with this program. If not, see <https://www.gnu.org/licenses/>.
+
+module Brig.Effects.SFT where
+
+import Data.ByteString (unsnoc)
+import qualified Data.ByteString.Char8 as BS8
+import Data.ByteString.Conversion.From
+import Data.ByteString.Internal (ByteString (PS), w2c)
+import Data.ByteString.Unsafe (unsafeTake)
+import Data.IP
+import Data.Misc
+import Data.String.Conversions (cs)
+import Imports
+import Network.HTTP.Client
+import Polysemy
+import Polysemy.Internal
+import Wire.API.Call.Config
+
+newtype SFTError = SFTError {unSFTError :: String}
+
+data SFT m a where
+  SFTGetClientUrl :: IPv4 -> Port -> SFT m (Either SFTError SFTServer)
+
+sftGetClientUrl :: Member SFT r => IPv4 -> Port -> Sem r (Either SFTError SFTServer)
+sftGetClientUrl ipAddr port = send $ SFTGetClientUrl ipAddr port
+
+interpretSFT :: Member (Embed IO) r => Manager -> Sem (SFT ': r) a -> Sem r a
+interpretSFT httpManager = interpret $ \(SFTGetClientUrl ipAddr port) -> do
+  let req =
+        parseRequest_ $
+          mconcat
+            [ "GET https://",
+              show ipAddr,
+              ":",
+              show . portNumber $ port,
+              "/sft/url"
+            ]
+  sftUrlResponse <- liftIO (responseBody <$> httpLbs req httpManager)
+  pure . bimap SFTError sftServer . runParser' (parser @HttpsUrl) . cs . strip . cs $ sftUrlResponse
+  where
+    -- FUTUREWORK: remove this adopted code once upgraded to bytestring >= 0.10.12.0
+    strip :: BS8.ByteString -> BS8.ByteString
+    strip = BS8.dropWhile isSpace . dropWhileEnd' isSpace
+      where
+        dropWhileEnd' :: (Char -> Bool) -> BS8.ByteString -> BS8.ByteString
+        dropWhileEnd' f ps = unsafeTake (findFromEndUntil (not . f . w2c) ps) ps
+        findFromEndUntil :: (Word8 -> Bool) -> BS8.ByteString -> Int
+        findFromEndUntil f ps@(PS _ _ l) = case unsnoc ps of
+          Nothing -> 0
+          Just (b, c) ->
+            if f c
+              then l
+              else findFromEndUntil f b
diff --git a/services/brig/src/Brig/Options.hs b/services/brig/src/Brig/Options.hs
index 5d73b27e89e..ce19a26eded 100644
--- a/services/brig/src/Brig/Options.hs
+++ b/services/brig/src/Brig/Options.hs
@@ -495,10 +495,46 @@ data Settings = Settings
     -- config will always return this entry. This is useful in Kubernetes
     -- where SFTs are deployed behind a load-balancer.  In the long-run the SRV
     -- fetching logic can go away completely
-    setSftStaticUrl :: !(Maybe HttpsUrl)
+    setSftStaticUrl :: !(Maybe HttpsUrl),
+    setSftLookup :: !(Maybe SFTLookup)
   }
   deriving (Show, Generic)
 
+data SFTLookup = SFTLookup
+  { sftlDomain :: !LookupDomain,
+    sftlPort :: !Port,
+    -- FUTUREWORK: Get rid of the test environment flag below. This is to be
+    -- done by not looking up A records and consequently making GET requests via
+    -- HTTPS based on IP addresses, instead of domain names.
+
+    -- | Set to True if running in a test environment. This will avoid
+    -- performing SSL checks in a request to an SFT server. The default value is
+    -- False.
+    sftlIsTestEnv :: Bool
+  }
+  deriving (Show, Generic)
+
+instance FromJSON SFTLookup where
+  parseJSON = Aeson.withObject "SFTLookup" $ \o -> do
+    d <- o Aeson..: "domain"
+    p <- o Aeson..: "port"
+    t <- o Aeson..:? "isTestingEnvironment" Aeson..!= False
+    pure $ SFTLookup d p t
+
+newtype LookupDomain = LookupDomain {unLookupDomain :: DNS.Domain}
+  deriving stock (Show, Generic)
+
+instance FromJSON LookupDomain where
+  parseJSON (Y.String s) =
+    LookupDomain <$> Y.withText "LookupDomain" asciiOnly (Y.String s)
+    where
+      asciiOnly :: Text -> Y.Parser ByteString
+      asciiOnly t =
+        if Text.all Char.isAscii t
+          then pure $ Text.encodeUtf8 t
+          else fail $ "Expected ascii string only, found: " <> Text.unpack t
+  parseJSON _ = fail "Expected a String"
+
 -- | The analog to `GT.FeatureFlags`.  This type tracks only the things that we need to
 -- express our current cloud business logic.
 --
@@ -612,9 +648,7 @@ data SFTOptions = SFTOptions
   { sftBaseDomain :: !DNS.Domain,
     sftSRVServiceName :: !(Maybe ByteString), -- defaults to defSftServiceName if unset
     sftDiscoveryIntervalSeconds :: !(Maybe DiffTime), -- defaults to defSftDiscoveryIntervalSeconds
-    sftListLength :: !(Maybe (Range 1 100 Int)), -- defaults to defSftListLength
-    sftLookupDomain :: !DNS.Domain,
-    sftLookupPort :: !Port
+    sftListLength :: !(Maybe (Range 1 100 Int)) -- defaults to defSftListLength
   }
   deriving (Show, Generic)
 
@@ -625,8 +659,6 @@ instance FromJSON SFTOptions where
       <*> (mapM asciiOnly =<< o .:? "sftSRVServiceName")
       <*> (secondsToDiffTime <$$> o .:? "sftDiscoveryIntervalSeconds")
       <*> (o .:? "sftListLength")
-      <*> (asciiOnly =<< o .: "sftLookupDomain")
-      <*> o .: "sftLookupPort"
     where
       asciiOnly :: Text -> Y.Parser ByteString
       asciiOnly t =
@@ -688,7 +720,8 @@ Lens.makeLensesFor
     ("setUserMaxPermClients", "userMaxPermClients"),
     ("setFederationDomain", "federationDomain"),
     ("setSqsThrottleMillis", "sqsThrottleMillis"),
-    ("setSftStaticUrl", "sftStaticUrl")
+    ("setSftStaticUrl", "sftStaticUrl"),
+    ("setSftLookup", "sftLookup")
   ]
   ''Settings
 
diff --git a/services/brig/test/integration/API/Calling.hs b/services/brig/test/integration/API/Calling.hs
index 6515f2272ff..7b06963fdab 100644
--- a/services/brig/test/integration/API/Calling.hs
+++ b/services/brig/test/integration/API/Calling.hs
@@ -112,16 +112,22 @@ testSFT b opts = do
       "when SFT discovery is not enabled, sft_servers_all shouldn't be returned"
       Nothing
       (cfg ^. rtcConfSftServersAll)
-  withSettingsOverrides (opts & Opts.sftL ?~ Opts.SFTOptions "integration-tests.zinfra.io" Nothing (Just 0.001) Nothing "integration-tests.zinfra.io" (Port 8585)) $ do
+  withSettingsOverrides (opts & Opts.sftL ?~ Opts.SFTOptions "integration-tests.zinfra.io" Nothing (Just 0.001) Nothing) $ do
     cfg1 <- retryWhileN 10 (isNothing . view rtcConfSftServers) (getTurnConfigurationV2 uid b)
     -- These values are controlled by https://github.com/zinfra/cailleach/tree/77ca2d23cf2959aa183dd945d0a0b13537a8950d/environments/dns-integration-tests
     let Right server1 = mkHttpsUrl =<< first show (parseURI laxURIParserOptions "https://sft01.integration-tests.zinfra.io:443")
     let Right server2 = mkHttpsUrl =<< first show (parseURI laxURIParserOptions "https://sft02.integration-tests.zinfra.io:8443")
-    liftIO $
+    liftIO $ do
       assertEqual
         "when SFT discovery is enabled, sft_servers should be returned"
         (Set.fromList [sftServer server1, sftServer server2])
         (Set.fromList $ maybe [] NonEmpty.toList $ cfg1 ^. rtcConfSftServers)
+      void . for (cfg1 ^. rtcConfSftServersAll) $ \allServers -> do
+        let Right clientUrl = mkHttpsUrl =<< first show (parseURI laxURIParserOptions "https://sft01.avs.zinfra.io")
+        assertEqual
+          "when SFT discovery is enabled and SFT lookup configured, sft_servers_all should be returned"
+          (Set.singleton . sftServer $ clientUrl)
+          (Set.fromList allServers)
 
 modifyAndAssert ::
   Brig ->
diff --git a/services/brig/test/unit/Test/Brig/Calling.hs b/services/brig/test/unit/Test/Brig/Calling.hs
index 64af8c99b84..192262f7cd4 100644
--- a/services/brig/test/unit/Test/Brig/Calling.hs
+++ b/services/brig/test/unit/Test/Brig/Calling.hs
@@ -25,7 +25,6 @@ import Control.Retry
 import Data.IP
 import Data.List.NonEmpty (NonEmpty (..))
 import qualified Data.List.NonEmpty as NonEmpty
-import Data.Misc (Port (..))
 import Data.Range
 import qualified Data.Set as Set
 import Imports
@@ -43,20 +42,21 @@ import Wire.Network.DNS.SRV
 data FakeDNSEnv = FakeDNSEnv
   { fakeLookupSrv :: Domain -> SrvResponse,
     fakeLookupA :: Domain -> A.AResponse,
-    fakeLookupCalls :: IORef [Domain]
+    fakeLookupSrvCalls :: IORef [Domain],
+    fakeLookupACalls :: IORef [Domain]
   }
 
 newFakeDNSEnv :: (Domain -> SrvResponse) -> (Domain -> A.AResponse) -> IO FakeDNSEnv
 newFakeDNSEnv lookupSrvFn lookupAFn =
-  FakeDNSEnv lookupSrvFn lookupAFn <$> newIORef []
+  FakeDNSEnv lookupSrvFn lookupAFn <$> newIORef [] <*> newIORef []
 
 runFakeDNSLookup :: Member (Embed IO) r => FakeDNSEnv -> Sem (DNSLookup ': r) a -> Sem r a
 runFakeDNSLookup FakeDNSEnv {..} = interpret $ \case
   LookupSRV domain -> do
-    modifyIORef' fakeLookupCalls (++ [domain])
+    modifyIORef' fakeLookupSrvCalls (++ [domain])
     pure $ fakeLookupSrv domain
   LookupA domain -> do
-    modifyIORef' fakeLookupCalls (++ [domain])
+    modifyIORef' fakeLookupACalls (++ [domain])
     pure $ fakeLookupA domain
 
 newtype LogRecorder = LogRecorder {recordedLogs :: IORef [(Log.Level, LByteString)]}
@@ -81,12 +81,12 @@ tests =
             assertEqual
               "should use the service name to form domain"
               "_foo._tcp.example.com."
-              (mkSFTDomain (SFTOptions "example.com" (Just "foo") Nothing Nothing "example.com" (Port 8585))),
+              (mkSFTDomain (SFTOptions "example.com" (Just "foo") Nothing Nothing)),
           testCase "when service name is not provided" $
             assertEqual
               "should assume service name to be 'sft'"
               "_sft._tcp.example.com."
-              (mkSFTDomain (SFTOptions "example.com" Nothing Nothing Nothing "example.com" (Port 8585)))
+              (mkSFTDomain (SFTOptions "example.com" Nothing Nothing Nothing))
         ],
       testGroup "sftDiscoveryLoop" $
         [ testCase "when service can be discovered" $ void testDiscoveryLoopWhenSuccessful,
@@ -117,10 +117,10 @@ testDiscoveryLoopWhenSuccessful = do
       entry3 = SrvEntry 0 0 (SrvTarget "sft3.foo.example.com." 443)
       returnedEntries = entry1 :| [entry2, entry3]
   fakeDNSEnv <- newFakeDNSEnv (\_ -> SrvAvailable returnedEntries) undefined
-  sftEnv <- mkSFTEnv (SFTOptions "foo.example.com" Nothing (Just 0.001) Nothing "foo.example.com" (Port 8585))
+  sftEnv <- mkSFTEnv (SFTOptions "foo.example.com" Nothing (Just 0.001) Nothing, Nothing)
 
   discoveryLoop <- Async.async $ runM . ignoreLogs . runFakeDNSLookup fakeDNSEnv $ sftDiscoveryLoop sftEnv
-  void $ retryEvery10MicrosWhileN 2000 (== 0) (length <$> readIORef (fakeLookupCalls fakeDNSEnv))
+  void $ retryEvery10MicrosWhileN 2000 (== 0) (length <$> readIORef (fakeLookupSrvCalls fakeDNSEnv))
   -- We don't want to stop the loop before it has written to the sftServers IORef
   void $ retryEvery10MicrosWhileN 2000 (== NotDiscoveredYet) (readIORef (sftServers sftEnv))
   Async.cancel discoveryLoop
@@ -132,12 +132,12 @@ testDiscoveryLoopWhenSuccessful = do
 testDiscoveryLoopWhenUnsuccessful :: IO ()
 testDiscoveryLoopWhenUnsuccessful = do
   fakeDNSEnv <- newFakeDNSEnv (const SrvNotAvailable) undefined
-  sftEnv <- mkSFTEnv (SFTOptions "foo.example.com" Nothing (Just 0.001) Nothing "foo.example.com" (Port 8585))
+  sftEnv <- mkSFTEnv (SFTOptions "foo.example.com" Nothing (Just 0.001) Nothing, Nothing)
 
   discoveryLoop <- Async.async $ runM . ignoreLogs . runFakeDNSLookup fakeDNSEnv $ sftDiscoveryLoop sftEnv
   -- We wait for at least two lookups to be sure that the lookup loop looped at
   -- least once
-  void $ retryEvery10MicrosWhileN 2000 (<= 1) (length <$> readIORef (fakeLookupCalls fakeDNSEnv))
+  void $ retryEvery10MicrosWhileN 2000 (<= 1) (length <$> readIORef (fakeLookupSrvCalls fakeDNSEnv))
   Async.cancel discoveryLoop
 
   actualServers <- readIORef (sftServers sftEnv)
@@ -154,7 +154,7 @@ testDiscoveryLoopWhenUnsuccessfulAfterSuccess = do
   discoveryLoop <- Async.async $ runM . ignoreLogs . runFakeDNSLookup failingFakeDNSEnv $ sftDiscoveryLoop sftEnv
   -- We wait for at least two lookups to be sure that the lookup loop looped at
   -- least once
-  void $ retryEvery10MicrosWhileN 2000 (<= 1) (length <$> readIORef (fakeLookupCalls failingFakeDNSEnv))
+  void $ retryEvery10MicrosWhileN 2000 (<= 1) (length <$> readIORef (fakeLookupSrvCalls failingFakeDNSEnv))
   Async.cancel discoveryLoop
 
   actualServers <- readIORef (sftServers sftEnv)
@@ -172,7 +172,7 @@ testDiscoveryLoopWhenURLsChange = do
 
   fakeDNSEnv <- newFakeDNSEnv (const $ SrvAvailable newEntries) undefined
   discoveryLoop <- Async.async $ runM . ignoreLogs . runFakeDNSLookup fakeDNSEnv $ sftDiscoveryLoop sftEnv
-  void $ retryEvery10MicrosWhileN 2000 (== 0) (length <$> readIORef (fakeLookupCalls fakeDNSEnv))
+  void $ retryEvery10MicrosWhileN 2000 (== 0) (length <$> readIORef (fakeLookupSrvCalls fakeDNSEnv))
   -- We don't want to stop the loop before it has written to the sftServers IORef
   void $ retryEvery10MicrosWhileN 2000 (== Discovered (mkSFTServers newEntries)) (readIORef (sftServers sftEnv))
   Async.cancel discoveryLoop

From d540f9bcb154f880219dfc0635b991140a5ab525 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marko=20Dimja=C5=A1evi=C4=87?= <marko.dimjasevic@wire.com>
Date: Fri, 31 Dec 2021 15:26:16 +0100
Subject: [PATCH 42/74] Fix Brig's configmap for SFT Lookup Templating (#2015)

---
 changelog.d/6-federation/sft-brig-configmap-fix | 1 +
 charts/brig/templates/configmap.yaml            | 8 +++++---
 services/brig/src/Brig/Options.hs               | 3 +--
 3 files changed, 7 insertions(+), 5 deletions(-)
 create mode 100644 changelog.d/6-federation/sft-brig-configmap-fix

diff --git a/changelog.d/6-federation/sft-brig-configmap-fix b/changelog.d/6-federation/sft-brig-configmap-fix
new file mode 100644
index 00000000000..d271b241cf3
--- /dev/null
+++ b/changelog.d/6-federation/sft-brig-configmap-fix
@@ -0,0 +1 @@
+Fix Brig's configmap for SFT lookups
diff --git a/charts/brig/templates/configmap.yaml b/charts/brig/templates/configmap.yaml
index 88be747050b..2f7a0be6735 100644
--- a/charts/brig/templates/configmap.yaml
+++ b/charts/brig/templates/configmap.yaml
@@ -231,9 +231,11 @@ data:
       {{- if .setSftLookup }}
       {{- with .setSftLookup }}
       setSftLookup:
-        domain: {{ required "Missing value: .setSftLookup.domain" .setSftLookup.domain }}
-        port: {{ required "Missing value: .setSftLookup.port" .setSftLookup.port }}
-        isTestingEnvironment: {{ .setSftLookup.isTestingEnvironment }}
+        domain: {{ required "Missing value: .setSftLookup.domain" .domain }}
+        port: {{ required "Missing value: .setSftLookup.port" .port }}
+        {{- if .isTestingEnvironment }}
+        isTestingEnvironment: {{ .isTestingEnvironment }}
+        {{- end }}
       {{- end }}
       {{- end }}
     {{- end }}
diff --git a/services/brig/src/Brig/Options.hs b/services/brig/src/Brig/Options.hs
index ce19a26eded..798b5c1f988 100644
--- a/services/brig/src/Brig/Options.hs
+++ b/services/brig/src/Brig/Options.hs
@@ -720,8 +720,7 @@ Lens.makeLensesFor
     ("setUserMaxPermClients", "userMaxPermClients"),
     ("setFederationDomain", "federationDomain"),
     ("setSqsThrottleMillis", "sqsThrottleMillis"),
-    ("setSftStaticUrl", "sftStaticUrl"),
-    ("setSftLookup", "sftLookup")
+    ("setSftStaticUrl", "sftStaticUrl")
   ]
   ''Settings
 

From f6fd70d6d378f6db8b5c57fe9bc4d842f6e8d949 Mon Sep 17 00:00:00 2001
From: Leif Battermann <leif.battermann@gmail.com>
Date: Mon, 3 Jan 2022 09:28:24 +0100
Subject: [PATCH 43/74] SQSERVICES 1011 Servantify Galley/Team API (#2008)

* ToSchema instances for types in Team.Member

* Servantify `PUT /teams/:tid` endpoint

Co-authored-by: Paolo Capriotti <paolo@capriotti.io>
---
 changelog.d/5-internal/pr-2008                |    1 +
 libs/galley-types/src/Galley/Types/Teams.hs   |    7 +-
 libs/schema-profunctor/src/Data/Schema.hs     |    6 +
 .../src/Wire/API/Routes/Public/Galley.hs      |   22 +-
 libs/wire-api/src/Wire/API/Team.hs            |  175 +-
 libs/wire-api/src/Wire/API/Team/Member.hs     |  362 +--
 libs/wire-api/src/Wire/API/Team/Permission.hs |   33 +-
 libs/wire-api/src/Wire/API/User.hs            |   11 +-
 .../Golden/Generated/NewTeamMember_team.hs    |   42 +-
 .../Golden/Generated/TeamMemberList_team.hs   | 2011 ++++++++---------
 .../API/Golden/Generated/TeamMember_team.hs   |  538 +++--
 services/brig/src/Brig/IO/Intra.hs            |    3 +-
 .../brig/test/integration/API/Team/Util.hs    |    3 +-
 services/galley/src/Galley/API/Public.hs      |   15 +-
 services/galley/src/Galley/API/Teams.hs       |   56 +-
 services/galley/src/Galley/Cassandra/Team.hs  |    4 +-
 .../test/integration/API/MessageTimer.hs      |    2 +-
 services/galley/test/integration/API/Teams.hs |   30 +-
 services/galley/test/integration/API/Util.hs  |    7 +-
 services/spar/test-integration/Util/Core.hs   |    7 +-
 tools/stern/src/Stern/Types.hs                |    1 +
 21 files changed, 1633 insertions(+), 1703 deletions(-)
 create mode 100644 changelog.d/5-internal/pr-2008

diff --git a/changelog.d/5-internal/pr-2008 b/changelog.d/5-internal/pr-2008
new file mode 100644
index 00000000000..a5c36a513b0
--- /dev/null
+++ b/changelog.d/5-internal/pr-2008
@@ -0,0 +1 @@
+Servantify Galley Teams API. (#2008)
diff --git a/libs/galley-types/src/Galley/Types/Teams.hs b/libs/galley-types/src/Galley/Types/Teams.hs
index f1251eff0a5..a37bbdc466d 100644
--- a/libs/galley-types/src/Galley/Types/Teams.hs
+++ b/libs/galley-types/src/Galley/Types/Teams.hs
@@ -65,16 +65,17 @@ module Galley.Types.Teams
     teamListHasMore,
     TeamMember,
     userId,
+    nUserId,
     permissions,
+    nPermissions,
     invitation,
+    nInvitation,
     legalHoldStatus,
-    teamMemberJson,
     TeamMemberList,
     ListType (..),
     newTeamMemberList,
     teamMembers,
     teamMemberListType,
-    teamMemberListJson,
     TeamConversation,
     newTeamConversation,
     conversationId,
@@ -105,8 +106,6 @@ module Galley.Types.Teams
     newTeamIconKey,
     newTeamMembers,
     NewTeamMember,
-    newNewTeamMember,
-    ntmNewTeamMember,
     Event,
     newEvent,
     eventType,
diff --git a/libs/schema-profunctor/src/Data/Schema.hs b/libs/schema-profunctor/src/Data/Schema.hs
index 398d4caaabd..0e8c5e8cacb 100644
--- a/libs/schema-profunctor/src/Data/Schema.hs
+++ b/libs/schema-profunctor/src/Data/Schema.hs
@@ -500,6 +500,9 @@ instance With Text where
 instance With Integer where
   with _ = (A.parseJSON >=>)
 
+instance With Bool where
+  with = A.withBool
+
 -- | A schema for a single value of an enumeration.
 element ::
   forall a b.
@@ -766,6 +769,9 @@ instance HasEnum Text NamedSwaggerDoc where
 instance HasEnum Integer NamedSwaggerDoc where
   mkEnum = mkSwaggerEnum S.SwaggerInteger
 
+instance HasEnum Bool NamedSwaggerDoc where
+  mkEnum = mkSwaggerEnum S.SwaggerBoolean
+
 mkSwaggerEnum ::
   S.SwaggerType 'S.SwaggerKindSchema ->
   Text ->
diff --git a/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs b/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs
index 63949b1d841..fe3ec2ec6e3 100644
--- a/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs
+++ b/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs
@@ -1,4 +1,5 @@
 {-# LANGUAGE DerivingVia #-}
+{-# LANGUAGE GeneralizedNewtypeDeriving #-}
 {-# OPTIONS_GHC -Wno-orphans #-}
 
 -- This file is part of the Wire Server implementation.
@@ -43,6 +44,7 @@ import Wire.API.Routes.Public
 import Wire.API.Routes.Public.Util
 import Wire.API.Routes.QualifiedCapture
 import Wire.API.ServantProto (Proto, RawProto)
+import Wire.API.Team
 import Wire.API.Team.Conversation
 import Wire.API.Team.Feature
 
@@ -705,7 +707,25 @@ data Api routes = Api
         :- FeatureConfigGet 'WithLockStatus 'TeamFeatureSelfDeletingMessages,
     featureConfigGuestLinksGet ::
       routes
-        :- FeatureConfigGet 'WithLockStatus 'TeamFeatureGuestLinks
+        :- FeatureConfigGet 'WithLockStatus 'TeamFeatureGuestLinks,
+    -- teams
+    createNonBindingTeam ::
+      routes
+        :- Summary "Create a new non binding team"
+        :> ZUser
+        :> ZConn
+        :> CanThrow NotConnected
+        :> "teams"
+        :> ReqBody '[Servant.JSON] NonBindingNewTeam
+        :> MultiVerb
+             'POST
+             '[JSON]
+             '[ WithHeaders
+                  '[DescHeader "Location" "Team ID" TeamId]
+                  TeamId
+                  (RespondEmpty 201 "Team ID as `Location` header value")
+              ]
+             TeamId
   }
   deriving (Generic)
 
diff --git a/libs/wire-api/src/Wire/API/Team.hs b/libs/wire-api/src/Wire/API/Team.hs
index b1307bea120..d639b314d06 100644
--- a/libs/wire-api/src/Wire/API/Team.hs
+++ b/libs/wire-api/src/Wire/API/Team.hs
@@ -46,7 +46,6 @@ module Wire.API.Team
     newTeamIcon,
     newTeamIconKey,
     newTeamMembers,
-    newTeamJson,
 
     -- * TeamUpdateData
     TeamUpdateData (..),
@@ -71,12 +70,14 @@ module Wire.API.Team
 where
 
 import Control.Lens (makeLenses)
-import Data.Aeson
-import Data.Aeson.Types (Pair)
+import Data.Aeson (FromJSON, ToJSON, Value (..))
+import Data.Aeson.Types (Parser)
 import Data.Id (TeamId, UserId)
-import Data.Json.Util
 import Data.Misc (PlainTextPassword (..))
 import Data.Range
+import Data.Schema
+import Data.Singletons (sing)
+import qualified Data.Swagger as S
 import qualified Data.Swagger.Build.Api as Doc
 import Imports
 import Test.QuickCheck.Gen (suchThat)
@@ -96,9 +97,10 @@ data Team = Team
   }
   deriving stock (Eq, Show, Generic)
   deriving (Arbitrary) via (GenericUniform Team)
+  deriving (ToJSON, FromJSON, S.ToSchema) via (Schema Team)
 
 newTeam :: TeamId -> UserId -> Text -> Text -> TeamBinding -> Team
-newTeam tid uid nme ico bnd = Team tid uid nme ico Nothing bnd
+newTeam tid uid nme ico = Team tid uid nme ico Nothing
 
 modelTeam :: Doc.Model
 modelTeam = Doc.defineModel "Team" $ do
@@ -117,41 +119,28 @@ modelTeam = Doc.defineModel "Team" $ do
   Doc.property "binding" Doc.bool' $
     Doc.description "user binding team"
 
-instance ToJSON Team where
-  toJSON t =
-    object $
-      "id" .= _teamId t
-        # "creator" .= _teamCreator t
-        # "name" .= _teamName t
-        # "icon" .= _teamIcon t
-        # "icon_key" .= _teamIconKey t
-        # "binding" .= _teamBinding t
-        # []
-
-instance FromJSON Team where
-  parseJSON = withObject "team" $ \o -> do
-    Team
-      <$> o .: "id"
-      <*> o .: "creator"
-      <*> o .: "name"
-      <*> o .: "icon"
-      <*> o .:? "icon_key"
-      <*> o .:? "binding" .!= NonBinding
+instance ToSchema Team where
+  schema =
+    object "Team" $
+      Team
+        <$> _teamId .= field "id" schema
+        <*> _teamCreator .= field "creator" schema
+        <*> _teamName .= field "name" schema
+        <*> _teamIcon .= field "icon" schema
+        <*> _teamIconKey .= maybe_ (optField "icon_key" schema)
+        <*> _teamBinding .= (fromMaybe Binding <$> optField "binding" schema)
 
 data TeamBinding
   = Binding
   | NonBinding
   deriving stock (Eq, Show, Generic)
   deriving (Arbitrary) via (GenericUniform TeamBinding)
+  deriving (ToJSON, FromJSON, S.ToSchema) via (Schema TeamBinding)
 
-instance ToJSON TeamBinding where
-  toJSON Binding = Bool True
-  toJSON NonBinding = Bool False
-
-instance FromJSON TeamBinding where
-  parseJSON (Bool True) = pure Binding
-  parseJSON (Bool False) = pure NonBinding
-  parseJSON other = fail $ "Unknown binding type: " <> show other
+instance ToSchema TeamBinding where
+  schema =
+    enum @Bool "TeamBinding" $
+      mconcat [element True Binding, element False NonBinding]
 
 --------------------------------------------------------------------------------
 -- TeamList
@@ -162,6 +151,7 @@ data TeamList = TeamList
   }
   deriving stock (Eq, Show, Generic)
   deriving (Arbitrary) via (GenericUniform TeamList)
+  deriving (ToJSON, FromJSON, S.ToSchema) via (Schema TeamList)
 
 newTeamList :: [Team] -> Bool -> TeamList
 newTeamList = TeamList
@@ -174,24 +164,18 @@ modelTeamList = Doc.defineModel "TeamList" $ do
   Doc.property "has_more" Doc.bool' $
     Doc.description "if more teams are available"
 
-instance ToJSON TeamList where
-  toJSON t =
-    object $
-      "teams" .= _teamListTeams t
-        # "has_more" .= _teamListHasMore t
-        # []
-
-instance FromJSON TeamList where
-  parseJSON = withObject "teamlist" $ \o -> do
-    TeamList
-      <$> o .: "teams"
-      <*> o .: "has_more"
+instance ToSchema TeamList where
+  schema =
+    object "TeamList" $
+      TeamList <$> _teamListTeams .= field "teams" (array schema)
+        <*> _teamListHasMore .= field "has_more" schema
 
 --------------------------------------------------------------------------------
 -- NewTeam
 
 newtype BindingNewTeam = BindingNewTeam (NewTeam ())
   deriving stock (Eq, Show, Generic)
+  deriving (ToJSON, FromJSON, S.ToSchema) via (Schema BindingNewTeam)
 
 modelNewBindingTeam :: Doc.Model
 modelNewBindingTeam = Doc.defineModel "NewBindingTeam" $ do
@@ -204,17 +188,13 @@ modelNewBindingTeam = Doc.defineModel "NewBindingTeam" $ do
     Doc.description "team icon asset key"
     Doc.optional
 
-instance ToJSON BindingNewTeam where
-  toJSON (BindingNewTeam t) = object $ newTeamJson t
-
-newTeamJson :: NewTeam a -> [Pair]
-newTeamJson (NewTeam n i ik _) =
-  "name" .= fromRange n
-    # "icon" .= fromRange i
-    # "icon_key" .= (fromRange <$> ik)
-    # []
+instance ToSchema BindingNewTeam where
+  schema = BindingNewTeam <$> unwrap .= newTeamSchema "BindingNewTeam" sch
+    where
+      unwrap (BindingNewTeam nt) = nt
 
-deriving newtype instance FromJSON BindingNewTeam
+      sch :: ValueSchema SwaggerDoc ()
+      sch = null_
 
 -- FUTUREWORK: since new team members do not get serialized, we zero them here.
 -- it may be worth looking into how this can be solved in the types.
@@ -227,6 +207,15 @@ instance Arbitrary BindingNewTeam where
 -- | FUTUREWORK: this is dead code!  remove!
 newtype NonBindingNewTeam = NonBindingNewTeam (NewTeam (Range 1 127 [TeamMember]))
   deriving stock (Eq, Show, Generic)
+  deriving (FromJSON, ToJSON, S.ToSchema) via (Schema NonBindingNewTeam)
+
+instance ToSchema NonBindingNewTeam where
+  schema = NonBindingNewTeam <$> unwrap .= newTeamSchema "NonBindingNewTeam" sch
+    where
+      unwrap (NonBindingNewTeam nt) = nt
+
+      sch :: ValueSchema SwaggerDoc (Range 1 127 [TeamMember])
+      sch = fromRange .= rangedSchema sing sing (array schema)
 
 modelNewNonBindingTeam :: Doc.Model
 modelNewNonBindingTeam = Doc.defineModel "newNonBindingTeam" $ do
@@ -242,14 +231,6 @@ modelNewNonBindingTeam = Doc.defineModel "newNonBindingTeam" $ do
     Doc.description "initial team member ids (between 1 and 127)"
     Doc.optional
 
-instance ToJSON NonBindingNewTeam where
-  toJSON (NonBindingNewTeam t) =
-    object $
-      "members" .= (fromRange <$> _newTeamMembers t)
-        # newTeamJson t
-
-deriving newtype instance FromJSON NonBindingNewTeam
-
 data NewTeam a = NewTeam
   { _newTeamName :: Range 1 256 Text,
     _newTeamIcon :: Range 1 256 Text,
@@ -262,17 +243,14 @@ data NewTeam a = NewTeam
 newNewTeam :: Range 1 256 Text -> Range 1 256 Text -> NewTeam a
 newNewTeam nme ico = NewTeam nme ico Nothing Nothing
 
-instance (FromJSON a) => FromJSON (NewTeam a) where
-  parseJSON = withObject "new-team" $ \o -> do
-    name <- o .: "name"
-    icon <- o .: "icon"
-    key <- o .:? "icon_key"
-    mems <- o .:? "members"
-    either fail pure $
-      NewTeam <$> checkedEitherMsg "name" name
-        <*> checkedEitherMsg "icon" icon
-        <*> maybe (pure Nothing) (fmap Just . checkedEitherMsg "icon_key") key
-        <*> pure mems
+newTeamSchema :: HasSchemaRef d => Text -> ValueSchema d a -> ValueSchema NamedSwaggerDoc (NewTeam a)
+newTeamSchema name sch =
+  object name $
+    NewTeam
+      <$> _newTeamName .= field "name" schema
+      <*> _newTeamIcon .= field "icon" schema
+      <*> _newTeamIconKey .= maybe_ (optField "icon_key" schema)
+      <*> _newTeamMembers .= maybe_ (optField "members" sch)
 
 --------------------------------------------------------------------------------
 -- TeamUpdateData
@@ -283,6 +261,7 @@ data TeamUpdateData = TeamUpdateData
     _iconKeyUpdate :: Maybe (Range 1 256 Text)
   }
   deriving stock (Eq, Show, Generic)
+  deriving (ToJSON, FromJSON, S.ToSchema) via (Schema TeamUpdateData)
 
 instance Arbitrary TeamUpdateData where
   arbitrary = arb `suchThat` valid
@@ -307,25 +286,21 @@ modelUpdateData = Doc.defineModel "TeamUpdateData" $ do
 newTeamUpdateData :: TeamUpdateData
 newTeamUpdateData = TeamUpdateData Nothing Nothing Nothing
 
-instance ToJSON TeamUpdateData where
-  toJSON u =
-    object $
-      "name" .= _nameUpdate u
-        # "icon" .= _iconUpdate u
-        # "icon_key" .= _iconKeyUpdate u
-        # []
-
-instance FromJSON TeamUpdateData where
-  parseJSON = withObject "team update data" $ \o -> do
-    name <- o .:? "name"
-    icon <- o .:? "icon"
-    icon_key <- o .:? "icon_key"
-    when (isNothing name && isNothing icon && isNothing icon_key) $
-      fail "TeamUpdateData: no update data specified"
-    either fail pure $
-      TeamUpdateData <$> maybe (pure Nothing) (fmap Just . checkedEitherMsg "name") name
-        <*> maybe (pure Nothing) (fmap Just . checkedEitherMsg "icon") icon
-        <*> maybe (pure Nothing) (fmap Just . checkedEitherMsg "icon_key") icon_key
+validateTeamUpdateData :: TeamUpdateData -> Parser TeamUpdateData
+validateTeamUpdateData u =
+  when
+    (isNothing (_nameUpdate u) && isNothing (_iconUpdate u) && isNothing (_iconKeyUpdate u))
+    (fail "TeamUpdateData: no update data specified")
+    $> u
+
+instance ToSchema TeamUpdateData where
+  schema =
+    (`withParser` validateTeamUpdateData)
+      . object "TeamUpdateData"
+      $ TeamUpdateData
+        <$> _nameUpdate .= maybe_ (optField "name" schema)
+        <*> _iconUpdate .= maybe_ (optField "icon" schema)
+        <*> _iconKeyUpdate .= maybe_ (optField "icon_key" schema)
 
 --------------------------------------------------------------------------------
 -- TeamDeleteData
@@ -335,6 +310,7 @@ newtype TeamDeleteData = TeamDeleteData
   }
   deriving stock (Eq, Show)
   deriving newtype (Arbitrary)
+  deriving (ToJSON, FromJSON, S.ToSchema) via (Schema TeamDeleteData)
 
 newTeamDeleteData :: Maybe PlainTextPassword -> TeamDeleteData
 newTeamDeleteData = TeamDeleteData
@@ -346,15 +322,10 @@ modelTeamDelete = Doc.defineModel "teamDeleteData" $ do
   Doc.property "password" Doc.string' $
     Doc.description "The account password to authorise the deletion."
 
-instance FromJSON TeamDeleteData where
-  parseJSON = withObject "team-delete-data" $ \o ->
-    TeamDeleteData <$> o .: "password"
-
-instance ToJSON TeamDeleteData where
-  toJSON tdd =
-    object
-      [ "password" .= _tdAuthPassword tdd
-      ]
+instance ToSchema TeamDeleteData where
+  schema =
+    object "TeamDeleteData" $
+      TeamDeleteData <$> _tdAuthPassword .= optField "password" (maybeWithDefault Null schema)
 
 makeLenses ''Team
 makeLenses ''TeamList
diff --git a/libs/wire-api/src/Wire/API/Team/Member.hs b/libs/wire-api/src/Wire/API/Team/Member.hs
index 905bd2f9718..9a7cfda570e 100644
--- a/libs/wire-api/src/Wire/API/Team/Member.hs
+++ b/libs/wire-api/src/Wire/API/Team/Member.hs
@@ -21,12 +21,17 @@
 
 module Wire.API.Team.Member
   ( -- * TeamMember
-    TeamMember (..),
+    TeamMember,
+    mkTeamMember,
     userId,
     permissions,
     invitation,
     legalHoldStatus,
+    ntmNewTeamMember,
+
+    -- * TODO: remove after servantification
     teamMemberJson,
+    teamMemberListJson,
 
     -- * TeamMemberList
     TeamMemberList,
@@ -38,12 +43,13 @@ module Wire.API.Team.Member
     NewListType (..),
     toNewListType,
     ListType (..),
-    teamMemberListJson,
 
     -- * NewTeamMember
     NewTeamMember,
-    newNewTeamMember,
-    ntmNewTeamMember,
+    mkNewTeamMember,
+    nUserId,
+    nPermissions,
+    nInvitation,
 
     -- * TeamMemberDeleteData
     TeamMemberDeleteData,
@@ -58,35 +64,95 @@ module Wire.API.Team.Member
   )
 where
 
-import Control.Lens (makeLenses)
-import Data.Aeson
-import Data.Aeson.Types (Parser)
-import qualified Data.HashMap.Strict as HM
+import Control.Lens (Lens, Lens', makeLenses, (%~))
+import Data.Aeson (FromJSON (..), ToJSON (..), Value (..))
 import Data.Id (UserId)
 import Data.Json.Util
 import Data.LegalHold (UserLegalHoldStatus (..), defUserLegalHoldStatus, typeUserLegalHoldStatus)
 import Data.Misc (PlainTextPassword (..))
 import Data.Proxy
-import Data.String.Conversions (cs)
+import Data.Schema
 import qualified Data.Swagger.Build.Api as Doc
-import Data.Swagger.Schema (ToSchema)
-import Deriving.Swagger (CamelToSnake, ConstructorTagModifier, CustomSwagger, StripPrefix)
+import qualified Data.Swagger.Schema as S
 import GHC.TypeLits
 import Imports
-import Wire.API.Arbitrary (Arbitrary, GenericUniform (..), arbitrary, shrink)
+import Wire.API.Arbitrary (Arbitrary, GenericUniform (..))
 import Wire.API.Team.Permission (Permissions, modelPermissions)
 
+data PermissionTag = Required | Optional
+
+type family PermissionType (tag :: PermissionTag) = (t :: *) | t -> tag where
+  PermissionType 'Required = Permissions
+  PermissionType 'Optional = Maybe Permissions
+
 --------------------------------------------------------------------------------
 -- TeamMember
 
-data TeamMember = TeamMember
-  { _userId :: UserId,
-    _permissions :: Permissions,
-    _invitation :: Maybe (UserId, UTCTimeMillis),
+type TeamMember = TeamMember' 'Required
+
+data TeamMember' (tag :: PermissionTag) = TeamMember
+  { _newTeamMember :: NewTeamMember' tag,
     _legalHoldStatus :: UserLegalHoldStatus
   }
-  deriving stock (Eq, Ord, Show, Generic)
-  deriving (Arbitrary) via (GenericUniform TeamMember)
+  deriving stock (Generic)
+
+ntmNewTeamMember :: NewTeamMember' tag -> TeamMember' tag
+ntmNewTeamMember ntm = TeamMember ntm defUserLegalHoldStatus
+
+deriving instance Eq (PermissionType tag) => Eq (TeamMember' tag)
+
+deriving instance Ord (PermissionType tag) => Ord (TeamMember' tag)
+
+deriving instance Show (PermissionType tag) => Show (TeamMember' tag)
+
+deriving via (GenericUniform TeamMember) instance Arbitrary TeamMember
+
+deriving via (GenericUniform (TeamMember' 'Optional)) instance Arbitrary (TeamMember' 'Optional)
+
+deriving via
+  (Schema (TeamMember' tag))
+  instance
+    (ToSchema (TeamMember' tag)) =>
+    ToJSON (TeamMember' tag)
+
+deriving via
+  (Schema (TeamMember' tag))
+  instance
+    (ToSchema (TeamMember' tag)) =>
+    FromJSON (TeamMember' tag)
+
+deriving via
+  (Schema (TeamMember' tag))
+  instance
+    (ToSchema (TeamMember' tag)) =>
+    S.ToSchema (TeamMember' tag)
+
+mkTeamMember ::
+  UserId ->
+  PermissionType tag ->
+  Maybe (UserId, UTCTimeMillis) ->
+  UserLegalHoldStatus ->
+  TeamMember' tag
+mkTeamMember uid perms inv = TeamMember (NewTeamMember uid perms inv)
+
+instance ToSchema TeamMember where
+  schema =
+    object "TeamMember" $
+      TeamMember
+        <$> _newTeamMember .= newTeamMemberSchema
+        <*> _legalHoldStatus .= (fromMaybe defUserLegalHoldStatus <$> optField "legalhold_status" schema)
+
+instance ToSchema (TeamMember' 'Optional) where
+  schema =
+    object "TeamMember" $
+      TeamMember
+        <$> _newTeamMember
+          .= ( NewTeamMember
+                 <$> _nUserId .= field "user" schema
+                 <*> _nPermissions .= maybe_ (optField "permissions" schema)
+                 <*> _nInvitation .= invitedSchema'
+             )
+        <*> _legalHoldStatus .= (fromMaybe defUserLegalHoldStatus <$> optField "legalhold_status" schema)
 
 modelTeamMember :: Doc.Model
 modelTeamMember = Doc.defineModel "TeamMember" $ do
@@ -111,54 +177,46 @@ modelTeamMember = Doc.defineModel "TeamMember" $ do
     Doc.description "The state of Legal Hold compliance for the member"
     Doc.optional
 
-instance ToJSON TeamMember where
-  toJSON = teamMemberJson (const True)
-
-instance FromJSON TeamMember where
-  parseJSON = parseTeamMember
-
--- | Show 'Permissions' conditionally.  The condition takes the member that will receive the result
--- into account.  See 'canSeePermsOf'.
---
--- FUTUREWORK:
--- There must be a cleaner way to do this, with a separate type
--- instead of logic in the JSON instance.
-teamMemberJson :: (TeamMember -> Bool) -> TeamMember -> Value
-teamMemberJson withPerms m =
-  object $
-    ["user" .= _userId m]
-      <> ["permissions" .= _permissions m | withPerms m]
-      <> ["created_by" .= (fst <$> _invitation m)]
-      <> ["created_at" .= (snd <$> _invitation m)]
-      <> ["legalhold_status" .= _legalHoldStatus m]
-
-parseTeamMember :: Value -> Parser TeamMember
-parseTeamMember = withObject "team-member" $ \o ->
-  TeamMember
-    <$> o .: "user"
-    <*> o .: "permissions"
-    <*> parseInvited o
-    -- Default to disabled if missing
-    <*> o .:? "legalhold_status" .!= defUserLegalHoldStatus
-  where
-    parseInvited :: Object -> Parser (Maybe (UserId, UTCTimeMillis))
-    parseInvited o = do
-      invby <- o .:? "created_by"
-      invat <- o .:? "created_at"
-      case (invby, invat) of
-        (Just b, Just a) -> pure $ Just (b, a)
-        (Nothing, Nothing) -> pure $ Nothing
-        _ -> fail "created_by, created_at"
+setPerm :: Bool -> Permissions -> Maybe Permissions
+setPerm True = Just
+setPerm False = const Nothing
 
 --------------------------------------------------------------------------------
 -- TeamMemberList
 
-data TeamMemberList = TeamMemberList
-  { _teamMembers :: [TeamMember],
+type TeamMemberList = TeamMemberList' 'Required
+
+data TeamMemberList' (tag :: PermissionTag) = TeamMemberList
+  { _teamMembers :: [TeamMember' tag],
     _teamMemberListType :: ListType
   }
-  deriving stock (Eq, Show, Generic)
-  deriving (Arbitrary) via (GenericUniform TeamMemberList)
+  deriving stock (Generic)
+
+deriving instance Eq (PermissionType tag) => Eq (TeamMemberList' tag)
+
+deriving instance Show (PermissionType tag) => Show (TeamMemberList' tag)
+
+deriving via (GenericUniform (TeamMemberList' 'Optional)) instance Arbitrary (TeamMemberList' 'Optional)
+
+deriving via (GenericUniform TeamMemberList) instance Arbitrary TeamMemberList
+
+deriving via
+  (Schema (TeamMemberList' tag))
+  instance
+    ToSchema (TeamMemberList' tag) =>
+    FromJSON (TeamMemberList' tag)
+
+deriving via
+  (Schema (TeamMemberList' tag))
+  instance
+    ToSchema (TeamMemberList' tag) =>
+    ToJSON (TeamMemberList' tag)
+
+deriving via
+  (Schema (TeamMemberList' tag))
+  instance
+    ToSchema (TeamMemberList' tag) =>
+    S.ToSchema (TeamMemberList' tag)
 
 newTeamMemberList :: [TeamMember] -> ListType -> TeamMemberList
 newTeamMemberList = TeamMemberList
@@ -171,20 +229,12 @@ modelTeamMemberList = Doc.defineModel "TeamMemberList" $ do
   Doc.property "hasMore" Doc.bool' $
     Doc.description "true if 'members' doesn't contain all team members"
 
-instance ToJSON TeamMemberList where
-  toJSON = teamMemberListJson (const True)
-
--- | Show a list of team members using 'teamMemberJson'.
-teamMemberListJson :: (TeamMember -> Bool) -> TeamMemberList -> Value
-teamMemberListJson withPerms l =
-  object
-    [ "members" .= map (teamMemberJson withPerms) (_teamMembers l),
-      "hasMore" .= _teamMemberListType l
-    ]
-
-instance FromJSON TeamMemberList where
-  parseJSON = withObject "team member list" $ \o ->
-    TeamMemberList <$> o .: "members" <*> o .: "hasMore"
+instance ToSchema (TeamMember' tag) => ToSchema (TeamMemberList' tag) where
+  schema =
+    object "TeamMemberList" $
+      TeamMemberList
+        <$> _teamMembers .= field "members" (array schema)
+        <*> _teamMemberListType .= field "hasMore" schema
 
 type HardTruncationLimit = (2000 :: Nat)
 
@@ -197,18 +247,15 @@ data NewListType
   | NewListTruncated
   deriving stock (Eq, Ord, Show, Generic)
   deriving (Arbitrary) via (GenericUniform NewListType)
-  deriving (ToSchema) via (CustomSwagger '[ConstructorTagModifier (StripPrefix "New", CamelToSnake)] NewListType)
-
--- This replaces the previous `hasMore` but has no boolean blindness. At the API level
--- though we do want this to remain true/false
-instance ToJSON NewListType where
-  toJSON NewListComplete = String "list_complete"
-  toJSON NewListTruncated = String "list_truncated"
+  deriving (FromJSON, ToJSON, S.ToSchema) via (Schema NewListType)
 
-instance FromJSON NewListType where
-  parseJSON (String "list_complete") = pure NewListComplete
-  parseJSON (String "list_truncated") = pure NewListTruncated
-  parseJSON bad = fail $ "NewListType: " <> cs (encode bad)
+instance ToSchema NewListType where
+  schema =
+    enum @Text "NewListType" $
+      mconcat
+        [ element "list_complete" NewListComplete,
+          element "list_truncated" NewListTruncated
+        ]
 
 toNewListType :: ListType -> NewListType
 toNewListType ListComplete = NewListComplete
@@ -219,37 +266,83 @@ data ListType
   | ListTruncated
   deriving stock (Eq, Ord, Show, Generic)
   deriving (Arbitrary) via (GenericUniform ListType)
+  deriving (FromJSON, ToJSON, S.ToSchema) via (Schema ListType)
 
 -- This replaces the previous `hasMore` but has no boolean blindness. At the API level
 -- though we do want this to remain true/false
-instance ToJSON ListType where
-  toJSON ListComplete = Bool False
-  toJSON ListTruncated = Bool True
-
-instance FromJSON ListType where
-  parseJSON (Bool False) = pure ListComplete
-  parseJSON (Bool True) = pure ListTruncated
-  parseJSON bad = fail $ "ListType: " <> cs (encode bad)
+instance ToSchema ListType where
+  schema =
+    enum @Bool "ListType" $
+      mconcat [element True ListTruncated, element False ListComplete]
 
 --------------------------------------------------------------------------------
 -- NewTeamMember
 
+type NewTeamMember = NewTeamMember' 'Required
+
+mkNewTeamMember :: UserId -> PermissionType 'Required -> Maybe (UserId, UTCTimeMillis) -> NewTeamMember
+mkNewTeamMember = NewTeamMember
+
 -- | Like 'TeamMember', but we can receive this from the clients.  Clients are not allowed to
--- set 'UserLegalHoldStatus', so both 'newNewTeamMember and {To,From}JSON make sure that is
--- always the default.  I decided to keep the 'TeamMember' inside (rather than making an
--- entirely new type because (1) it's a smaller change and I'm in a hurry; (2) it encodes the
--- identity relationship between the fields that *do* occur in both more explicit.
-newtype NewTeamMember = NewTeamMember
-  { _ntmNewTeamMember :: TeamMember
+-- set 'UserLegalHoldStatus'.
+data NewTeamMember' (tag :: PermissionTag) = NewTeamMember
+  { _nUserId :: UserId,
+    _nPermissions :: PermissionType tag,
+    _nInvitation :: Maybe (UserId, UTCTimeMillis)
   }
-  deriving stock (Eq, Show)
+  deriving stock (Generic)
+
+deriving instance (Eq (PermissionType tag)) => Eq (NewTeamMember' tag)
+
+deriving instance (Ord (PermissionType tag)) => Ord (NewTeamMember' tag)
+
+deriving instance (Show (PermissionType tag)) => Show (NewTeamMember' tag)
+
+deriving via
+  (Schema (NewTeamMember' tag))
+  instance
+    (ToSchema (NewTeamMember' tag)) =>
+    ToJSON (NewTeamMember' tag)
+
+deriving via
+  (Schema (NewTeamMember' tag))
+  instance
+    (ToSchema (NewTeamMember' tag)) =>
+    FromJSON (NewTeamMember' tag)
+
+deriving via
+  (Schema (NewTeamMember' tag))
+  instance
+    (ToSchema (NewTeamMember' tag)) =>
+    S.ToSchema (NewTeamMember' tag)
+
+deriving via (GenericUniform NewTeamMember) instance Arbitrary NewTeamMember
+
+deriving via (GenericUniform (NewTeamMember' 'Optional)) instance Arbitrary (NewTeamMember' 'Optional)
+
+newTeamMemberSchema :: ObjectSchema SwaggerDoc NewTeamMember
+newTeamMemberSchema =
+  NewTeamMember
+    <$> _nUserId .= field "user" schema
+    <*> _nPermissions .= field "permissions" schema
+    <*> _nInvitation .= invitedSchema'
 
-instance Arbitrary NewTeamMember where
-  arbitrary = newNewTeamMember <$> arbitrary <*> arbitrary <*> arbitrary
-  shrink (NewTeamMember (TeamMember uid perms _mbinv _)) = [newNewTeamMember uid perms Nothing]
+invitedSchema :: ObjectSchemaP SwaggerDoc (Maybe (UserId, UTCTimeMillis)) (Maybe UserId, Maybe UTCTimeMillis)
+invitedSchema =
+  (,) <$> fmap fst .= optField "created_by" (maybeWithDefault Null schema)
+    <*> fmap snd .= optField "created_at" (maybeWithDefault Null schema)
 
-newNewTeamMember :: UserId -> Permissions -> Maybe (UserId, UTCTimeMillis) -> NewTeamMember
-newNewTeamMember uid perms mbinv = NewTeamMember $ TeamMember uid perms mbinv defUserLegalHoldStatus
+invitedSchema' :: ObjectSchema SwaggerDoc (Maybe (UserId, UTCTimeMillis))
+invitedSchema' = withParser invitedSchema $ \(invby, invat) ->
+  case (invby, invat) of
+    (Just b, Just a) -> pure $ Just (b, a)
+    (Nothing, Nothing) -> pure $ Nothing
+    _ -> fail "created_by, created_at"
+
+instance ToSchema NewTeamMember where
+  schema =
+    object "NewTeamMember" $
+      field "member" $ unnamed (object "Unnamed" newTeamMemberSchema)
 
 modelNewTeamMember :: Doc.Model
 modelNewTeamMember = Doc.defineModel "NewTeamMember" $ do
@@ -257,22 +350,6 @@ modelNewTeamMember = Doc.defineModel "NewTeamMember" $ do
   Doc.property "member" (Doc.ref modelTeamMember) $
     Doc.description "the team member to add (the legalhold_status field must be null or missing!)"
 
-instance ToJSON NewTeamMember where
-  toJSON t = object ["member" .= mem]
-    where
-      mem = Object . HM.fromList . fltr . HM.toList $ o
-      o = case toJSON (_ntmNewTeamMember t) of
-        Object o_ -> o_
-        _ -> error "impossible"
-      fltr = filter ((`elem` ["user", "permissions", "created_by", "created_at"]) . fst)
-
-instance FromJSON NewTeamMember where
-  parseJSON = withObject "add team member" $ \o -> do
-    mem <- o .: "member"
-    if (_legalHoldStatus mem == defUserLegalHoldStatus)
-      then pure $ NewTeamMember mem
-      else fail "legalhold_status field cannot be set in NewTeamMember"
-
 --------------------------------------------------------------------------------
 -- TeamMemberDeleteData
 
@@ -281,6 +358,12 @@ newtype TeamMemberDeleteData = TeamMemberDeleteData
   }
   deriving stock (Eq, Show)
   deriving newtype (Arbitrary)
+  deriving (ToJSON, FromJSON, S.ToSchema) via (Schema TeamMemberDeleteData)
+
+instance ToSchema TeamMemberDeleteData where
+  schema =
+    object "TeamMemberDeleteData" $
+      TeamMemberDeleteData <$> _tmdAuthPassword .= optField "password" (maybeWithDefault Null schema)
 
 newTeamMemberDeleteData :: Maybe PlainTextPassword -> TeamMemberDeleteData
 newTeamMemberDeleteData = TeamMemberDeleteData
@@ -292,17 +375,30 @@ modelTeamMemberDelete = Doc.defineModel "teamDeleteData" $ do
   Doc.property "password" Doc.string' $
     Doc.description "The account password to authorise the deletion."
 
-instance FromJSON TeamMemberDeleteData where
-  parseJSON = withObject "team-member-delete-data" $ \o ->
-    TeamMemberDeleteData <$> (o .:? "password")
+makeLenses ''TeamMember'
+makeLenses ''TeamMemberList'
+makeLenses ''NewTeamMember'
+makeLenses ''TeamMemberDeleteData
 
-instance ToJSON TeamMemberDeleteData where
-  toJSON tmd =
-    object
-      [ "password" .= _tmdAuthPassword tmd
-      ]
+userId :: Lens' TeamMember UserId
+userId = newTeamMember . nUserId
 
-makeLenses ''TeamMember
-makeLenses ''TeamMemberList
-makeLenses ''NewTeamMember
-makeLenses ''TeamMemberDeleteData
+permissions :: Lens (TeamMember' tag1) (TeamMember' tag2) (PermissionType tag1) (PermissionType tag2)
+permissions = newTeamMember . nPermissions
+
+invitation :: Lens' TeamMember (Maybe (UserId, UTCTimeMillis))
+invitation = newTeamMember . nInvitation
+
+-- JSON serialisation utilities (FUTUREWORK(leif): remove after servantification)
+
+teamMemberJson :: (TeamMember -> Bool) -> TeamMember -> Value
+teamMemberJson withPerms = toJSON . setOptionalPerms withPerms
+
+setOptionalPerms :: (TeamMember -> Bool) -> TeamMember -> TeamMember' 'Optional
+setOptionalPerms withPerms m = m & permissions %~ setPerm (withPerms m)
+
+-- | Show a list of team members using 'teamMemberJson'.
+teamMemberListJson :: (TeamMember -> Bool) -> TeamMemberList -> Value
+teamMemberListJson withPerms l =
+  toJSON $
+    l {_teamMembers = map (setOptionalPerms withPerms) (_teamMembers l)}
diff --git a/libs/wire-api/src/Wire/API/Team/Permission.hs b/libs/wire-api/src/Wire/API/Team/Permission.hs
index 00ef0ed71c0..272d7281b26 100644
--- a/libs/wire-api/src/Wire/API/Team/Permission.hs
+++ b/libs/wire-api/src/Wire/API/Team/Permission.hs
@@ -44,10 +44,11 @@ where
 import qualified Cassandra as Cql
 import qualified Control.Error.Util as Err
 import Control.Lens (makeLenses, (^.))
-import Data.Aeson
+import Data.Aeson (FromJSON (..), ToJSON (..))
 import Data.Bits (testBit, (.|.))
-import Data.Json.Util
+import Data.Schema
 import qualified Data.Set as Set
+import qualified Data.Swagger as S
 import qualified Data.Swagger.Build.Api as Doc
 import Imports
 import Wire.API.Arbitrary (Arbitrary (arbitrary), GenericUniform (..))
@@ -60,6 +61,19 @@ data Permissions = Permissions
     _copy :: Set Perm
   }
   deriving stock (Eq, Ord, Show, Generic)
+  deriving (FromJSON, ToJSON, S.ToSchema) via (Schema Permissions)
+
+permissionsSchema :: ValueSchemaP NamedSwaggerDoc Permissions (Set Perm, Set Perm)
+permissionsSchema =
+  object "Permissions" $
+    (,) <$> (permsToInt . _self) .= field "self" (intToPerms <$> schema)
+      <*> (permsToInt . _copy) .= field "copy" (intToPerms <$> schema)
+
+instance ToSchema Permissions where
+  schema = withParser permissionsSchema $ \(s, d) ->
+    case newPermissions s d of
+      Nothing -> fail "invalid permissions"
+      Just ps -> pure ps
 
 modelPermissions :: Doc.Model
 modelPermissions = Doc.defineModel "Permissions" $ do
@@ -72,21 +86,6 @@ modelPermissions = Doc.defineModel "Permissions" $ do
   Doc.property "copy" (Doc.int64 $ Doc.min 0 . Doc.max 0x7FFFFFFFFFFFFFFF) $
     Doc.description "The permissions bitmask which this user can assign to others"
 
-instance ToJSON Permissions where
-  toJSON p =
-    object $
-      "self" .= permsToInt (_self p)
-        # "copy" .= permsToInt (_copy p)
-        # []
-
-instance FromJSON Permissions where
-  parseJSON = withObject "permissions" $ \o -> do
-    s <- intToPerms <$> o .: "self"
-    d <- intToPerms <$> o .: "copy"
-    case newPermissions s d of
-      Nothing -> fail "invalid permissions"
-      Just ps -> pure ps
-
 instance Arbitrary Permissions where
   arbitrary =
     maybe (error "instance Arbitrary Permissions") pure =<< do
diff --git a/libs/wire-api/src/Wire/API/User.hs b/libs/wire-api/src/Wire/API/User.hs
index 18464c0b185..40780bd55fe 100644
--- a/libs/wire-api/src/Wire/API/User.hs
+++ b/libs/wire-api/src/Wire/API/User.hs
@@ -129,7 +129,7 @@ import qualified SAML2.WebSSO as SAML
 import qualified Test.QuickCheck as QC
 import Wire.API.Arbitrary (Arbitrary (arbitrary), GenericUniform (..))
 import Wire.API.Provider.Service (ServiceRef, modelServiceRef)
-import Wire.API.Team (BindingNewTeam (BindingNewTeam), modelNewBindingTeam, newTeamJson)
+import Wire.API.Team (BindingNewTeam (BindingNewTeam), NewTeam (..), modelNewBindingTeam)
 import Wire.API.User.Activation (ActivationCode)
 import Wire.API.User.Auth (CookieLabel)
 import Wire.API.User.Identity
@@ -802,6 +802,15 @@ instance ToJSON BindingNewTeamUser where
     A.object $
       "currency" A..= c
         # newTeamJson t
+    where
+      -- FUTUREWORK(leif): this was originally defined in libs/wire-api/src/Wire/API/Team.hs and I moved it here
+      -- during the process of servantifying, it should go away when servantification is complete
+      newTeamJson :: NewTeam a -> [A.Pair]
+      newTeamJson (NewTeam n i ik _) =
+        "name" A..= fromRange n
+          # "icon" A..= fromRange i
+          # "icon_key" A..= (fromRange <$> ik)
+          # []
 
 instance FromJSON BindingNewTeamUser where
   parseJSON j@(A.Object o) = do
diff --git a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/NewTeamMember_team.hs b/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/NewTeamMember_team.hs
index ebbffc91d2f..4092949a185 100644
--- a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/NewTeamMember_team.hs
+++ b/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/NewTeamMember_team.hs
@@ -23,7 +23,7 @@ import Data.Json.Util (readUTCTimeMillis)
 import qualified Data.UUID as UUID (fromString)
 import GHC.Exts (IsList (fromList))
 import Imports (Maybe (Just, Nothing), fromJust)
-import Wire.API.Team.Member (NewTeamMember, newNewTeamMember)
+import Wire.API.Team.Member (NewTeamMember, mkNewTeamMember)
 import Wire.API.Team.Permission
   ( Perm
       ( AddTeamMember,
@@ -45,7 +45,7 @@ import Wire.API.Team.Permission
 
 testObject_NewTeamMember_team_1 :: NewTeamMember
 testObject_NewTeamMember_team_1 =
-  ( newNewTeamMember
+  ( mkNewTeamMember
       (Id (fromJust (UUID.fromString "00000002-0000-0007-0000-000200000002")))
       (Permissions {_self = fromList [], _copy = fromList []})
       ( Just
@@ -57,7 +57,7 @@ testObject_NewTeamMember_team_1 =
 
 testObject_NewTeamMember_team_2 :: NewTeamMember
 testObject_NewTeamMember_team_2 =
-  ( newNewTeamMember
+  ( mkNewTeamMember
       (Id (fromJust (UUID.fromString "00000004-0000-0000-0000-000200000003")))
       ( Permissions
           { _self =
@@ -81,7 +81,7 @@ testObject_NewTeamMember_team_2 =
 
 testObject_NewTeamMember_team_3 :: NewTeamMember
 testObject_NewTeamMember_team_3 =
-  ( newNewTeamMember
+  ( mkNewTeamMember
       (Id (fromJust (UUID.fromString "00000008-0000-0008-0000-000700000005")))
       ( Permissions
           { _self =
@@ -99,7 +99,7 @@ testObject_NewTeamMember_team_3 =
 
 testObject_NewTeamMember_team_4 :: NewTeamMember
 testObject_NewTeamMember_team_4 =
-  ( newNewTeamMember
+  ( mkNewTeamMember
       (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000700000005")))
       ( Permissions
           { _self = fromList [CreateConversation, AddTeamMember, SetTeamData],
@@ -111,7 +111,7 @@ testObject_NewTeamMember_team_4 =
 
 testObject_NewTeamMember_team_5 :: NewTeamMember
 testObject_NewTeamMember_team_5 =
-  ( newNewTeamMember
+  ( mkNewTeamMember
       (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000002")))
       (Permissions {_self = fromList [AddTeamMember, SetBilling, GetTeamConversations], _copy = fromList [AddTeamMember]})
       ( Just
@@ -123,7 +123,7 @@ testObject_NewTeamMember_team_5 =
 
 testObject_NewTeamMember_team_6 :: NewTeamMember
 testObject_NewTeamMember_team_6 =
-  ( newNewTeamMember
+  ( mkNewTeamMember
       (Id (fromJust (UUID.fromString "00000002-0000-0006-0000-000400000003")))
       ( Permissions
           { _self =
@@ -141,7 +141,7 @@ testObject_NewTeamMember_team_6 =
 
 testObject_NewTeamMember_team_7 :: NewTeamMember
 testObject_NewTeamMember_team_7 =
-  ( newNewTeamMember
+  ( mkNewTeamMember
       (Id (fromJust (UUID.fromString "00000007-0000-0004-0000-000500000005")))
       ( Permissions
           { _self =
@@ -159,7 +159,7 @@ testObject_NewTeamMember_team_7 =
 
 testObject_NewTeamMember_team_8 :: NewTeamMember
 testObject_NewTeamMember_team_8 =
-  ( newNewTeamMember
+  ( mkNewTeamMember
       (Id (fromJust (UUID.fromString "00000008-0000-0003-0000-000200000003")))
       ( Permissions
           { _self = fromList [DoNotUseDeprecatedModifyConvName],
@@ -175,7 +175,7 @@ testObject_NewTeamMember_team_8 =
 
 testObject_NewTeamMember_team_9 :: NewTeamMember
 testObject_NewTeamMember_team_9 =
-  ( newNewTeamMember
+  ( mkNewTeamMember
       (Id (fromJust (UUID.fromString "00000001-0000-0008-0000-000300000004")))
       (Permissions {_self = fromList [SetBilling], _copy = fromList []})
       ( Just
@@ -187,7 +187,7 @@ testObject_NewTeamMember_team_9 =
 
 testObject_NewTeamMember_team_10 :: NewTeamMember
 testObject_NewTeamMember_team_10 =
-  ( newNewTeamMember
+  ( mkNewTeamMember
       (Id (fromJust (UUID.fromString "00000008-0000-0003-0000-000600000003")))
       (Permissions {_self = fromList [GetBilling], _copy = fromList []})
       ( Just
@@ -199,7 +199,7 @@ testObject_NewTeamMember_team_10 =
 
 testObject_NewTeamMember_team_11 :: NewTeamMember
 testObject_NewTeamMember_team_11 =
-  ( newNewTeamMember
+  ( mkNewTeamMember
       (Id (fromJust (UUID.fromString "00000006-0000-0005-0000-000000000002")))
       ( Permissions
           { _self = fromList [CreateConversation, DoNotUseDeprecatedModifyConvName, SetTeamData],
@@ -215,7 +215,7 @@ testObject_NewTeamMember_team_11 =
 
 testObject_NewTeamMember_team_12 :: NewTeamMember
 testObject_NewTeamMember_team_12 =
-  ( newNewTeamMember
+  ( mkNewTeamMember
       (Id (fromJust (UUID.fromString "00000001-0000-0004-0000-000000000007")))
       (Permissions {_self = fromList [SetBilling, SetTeamData, GetTeamConversations], _copy = fromList []})
       (Nothing)
@@ -223,7 +223,7 @@ testObject_NewTeamMember_team_12 =
 
 testObject_NewTeamMember_team_13 :: NewTeamMember
 testObject_NewTeamMember_team_13 =
-  ( newNewTeamMember
+  ( mkNewTeamMember
       (Id (fromJust (UUID.fromString "00000002-0000-0004-0000-000600000001")))
       ( Permissions
           { _self = fromList [AddTeamMember, DoNotUseDeprecatedAddRemoveConvMember, SetTeamData, GetTeamConversations],
@@ -235,7 +235,7 @@ testObject_NewTeamMember_team_13 =
 
 testObject_NewTeamMember_team_14 :: NewTeamMember
 testObject_NewTeamMember_team_14 =
-  ( newNewTeamMember
+  ( mkNewTeamMember
       (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000500000004")))
       ( Permissions
           { _self =
@@ -253,7 +253,7 @@ testObject_NewTeamMember_team_14 =
 
 testObject_NewTeamMember_team_15 :: NewTeamMember
 testObject_NewTeamMember_team_15 =
-  ( newNewTeamMember
+  ( mkNewTeamMember
       (Id (fromJust (UUID.fromString "00000000-0000-0008-0000-000800000007")))
       ( Permissions
           { _self = fromList [RemoveTeamMember, GetMemberPermissions, DeleteTeam],
@@ -269,7 +269,7 @@ testObject_NewTeamMember_team_15 =
 
 testObject_NewTeamMember_team_16 :: NewTeamMember
 testObject_NewTeamMember_team_16 =
-  ( newNewTeamMember
+  ( mkNewTeamMember
       (Id (fromJust (UUID.fromString "00000000-0000-0006-0000-000300000005")))
       ( Permissions
           { _self = fromList [CreateConversation, RemoveTeamMember, GetBilling, GetTeamConversations, DeleteTeam],
@@ -281,7 +281,7 @@ testObject_NewTeamMember_team_16 =
 
 testObject_NewTeamMember_team_17 :: NewTeamMember
 testObject_NewTeamMember_team_17 =
-  ( newNewTeamMember
+  ( mkNewTeamMember
       (Id (fromJust (UUID.fromString "00000000-0000-0008-0000-000400000005")))
       (Permissions {_self = fromList [], _copy = fromList []})
       ( Just
@@ -293,7 +293,7 @@ testObject_NewTeamMember_team_17 =
 
 testObject_NewTeamMember_team_18 :: NewTeamMember
 testObject_NewTeamMember_team_18 =
-  ( newNewTeamMember
+  ( mkNewTeamMember
       (Id (fromJust (UUID.fromString "00000006-0000-0003-0000-000000000001")))
       (Permissions {_self = fromList [], _copy = fromList []})
       ( Just
@@ -305,7 +305,7 @@ testObject_NewTeamMember_team_18 =
 
 testObject_NewTeamMember_team_19 :: NewTeamMember
 testObject_NewTeamMember_team_19 =
-  ( newNewTeamMember
+  ( mkNewTeamMember
       (Id (fromJust (UUID.fromString "00000004-0000-0005-0000-000100000008")))
       ( Permissions
           { _self = fromList [DoNotUseDeprecatedDeleteConversation, RemoveTeamMember, SetBilling, SetMemberPermissions],
@@ -317,7 +317,7 @@ testObject_NewTeamMember_team_19 =
 
 testObject_NewTeamMember_team_20 :: NewTeamMember
 testObject_NewTeamMember_team_20 =
-  ( newNewTeamMember
+  ( mkNewTeamMember
       (Id (fromJust (UUID.fromString "00000008-0000-0000-0000-000000000004")))
       ( Permissions
           { _self =
diff --git a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/TeamMemberList_team.hs b/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/TeamMemberList_team.hs
index 9cb5bc130eb..5b6a14c481b 100644
--- a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/TeamMemberList_team.hs
+++ b/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/TeamMemberList_team.hs
@@ -32,14 +32,8 @@ import GHC.Exts (IsList (fromList))
 import Imports (Maybe (Just, Nothing), fromJust)
 import Wire.API.Team.Member
   ( ListType (ListComplete, ListTruncated),
-    TeamMember
-      ( TeamMember,
-        _invitation,
-        _legalHoldStatus,
-        _permissions,
-        _userId
-      ),
     TeamMemberList,
+    mkTeamMember,
     newTeamMemberList,
   )
 import Wire.API.Team.Permission
@@ -56,95 +50,85 @@ import Wire.API.Team.Permission
   )
 
 testObject_TeamMemberList_team_1 :: TeamMemberList
-testObject_TeamMemberList_team_1 = (newTeamMemberList ([]) (ListComplete))
+testObject_TeamMemberList_team_1 = newTeamMemberList ([]) (ListComplete)
 
 testObject_TeamMemberList_team_2 :: TeamMemberList
 testObject_TeamMemberList_team_2 =
-  ( newTeamMemberList
-      ( [ TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000002-0000-0000-0000-000000000002"))),
-              _permissions = Permissions {_self = fromList [GetBilling, SetMemberPermissions], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000002"))),
-                    (fromJust (readUTCTimeMillis "1864-05-10T10:05:44.332Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            }
-        ]
-      )
-      (ListComplete)
-  )
+  newTeamMemberList
+    [ mkTeamMember
+        (Id (fromJust (UUID.fromString "00000002-0000-0000-0000-000000000002")))
+        (Permissions {_self = fromList [GetBilling, SetMemberPermissions], _copy = fromList []})
+        ( Just
+            ( Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000002")),
+              fromJust (readUTCTimeMillis "1864-05-10T10:05:44.332Z")
+            )
+        )
+        UserLegalHoldPending
+    ]
+    ListComplete
 
 testObject_TeamMemberList_team_3 :: TeamMemberList
 testObject_TeamMemberList_team_3 =
   ( newTeamMemberList
-      ( [ TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T06:07:36.175Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T14:28:10.448Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T16:05:37.642Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldDisabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation = Nothing,
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T13:06:20.504Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T16:37:10.774Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldDisabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T04:36:55.388Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            }
+      ( [ mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T06:07:36.175Z"))
+                )
+            )
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T14:28:10.448Z"))
+                )
+            )
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T16:05:37.642Z"))
+                )
+            )
+            UserLegalHoldDisabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            (Nothing)
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T13:06:20.504Z"))
+                )
+            )
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T16:37:10.774Z"))
+                )
+            )
+            UserLegalHoldDisabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T04:36:55.388Z"))
+                )
+            )
+            UserLegalHoldPending
         ]
       )
       (ListComplete)
@@ -153,26 +137,24 @@ testObject_TeamMemberList_team_3 =
 testObject_TeamMemberList_team_4 :: TeamMemberList
 testObject_TeamMemberList_team_4 =
   ( newTeamMemberList
-      ( [ TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000"))),
-              _permissions = Permissions {_self = fromList [GetTeamConversations], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-08T16:05:11.696Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-08T07:09:26.753Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldDisabled
-            }
+      ( [ mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000")))
+            (Permissions {_self = fromList [GetTeamConversations], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-08T16:05:11.696Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-08T07:09:26.753Z"))
+                )
+            )
+            UserLegalHoldDisabled
         ]
       )
       (ListTruncated)
@@ -181,46 +163,42 @@ testObject_TeamMemberList_team_4 =
 testObject_TeamMemberList_team_5 :: TeamMemberList
 testObject_TeamMemberList_team_5 =
   ( newTeamMemberList
-      ( [ TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T23:10:04.963Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T15:40:17.119Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T00:40:38.004Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T07:30:49.028Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            }
+      ( [ mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T23:10:04.963Z"))
+                )
+            )
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T15:40:17.119Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T00:40:38.004Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T07:30:49.028Z"))
+                )
+            )
+            UserLegalHoldEnabled
         ]
       )
       (ListComplete)
@@ -229,106 +207,96 @@ testObject_TeamMemberList_team_5 =
 testObject_TeamMemberList_team_6 :: TeamMemberList
 testObject_TeamMemberList_team_6 =
   ( newTeamMemberList
-      ( [ TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T17:07:48.156Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldDisabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T00:04:10.559Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T10:39:19.860Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldDisabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T13:40:56.648Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldDisabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T12:13:40.273Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T13:28:04.561Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldDisabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T02:59:55.584Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T22:57:33.947Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T01:02:39.691Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T13:39:38.488Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            }
+      ( [ mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T17:07:48.156Z"))
+                )
+            )
+            UserLegalHoldDisabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T00:04:10.559Z"))
+                )
+            )
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T10:39:19.860Z"))
+                )
+            )
+            UserLegalHoldDisabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T13:40:56.648Z"))
+                )
+            )
+            UserLegalHoldDisabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T12:13:40.273Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T13:28:04.561Z"))
+                )
+            )
+            UserLegalHoldDisabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T02:59:55.584Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T22:57:33.947Z"))
+                )
+            )
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T01:02:39.691Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T13:39:38.488Z"))
+                )
+            )
+            UserLegalHoldEnabled
         ]
       )
       (ListComplete)
@@ -337,28 +305,25 @@ testObject_TeamMemberList_team_6 =
 testObject_TeamMemberList_team_7 :: TeamMemberList
 testObject_TeamMemberList_team_7 =
   ( newTeamMemberList
-      ( [ TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation = Nothing,
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [SetTeamData], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-10T03:11:36.961Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation = Nothing,
-              _legalHoldStatus = UserLegalHoldEnabled
-            }
+      ( [ mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            (Nothing)
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001")))
+            (Permissions {_self = fromList [SetTeamData], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-10T03:11:36.961Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            (Nothing)
+            UserLegalHoldEnabled
         ]
       )
       (ListTruncated)
@@ -367,108 +332,97 @@ testObject_TeamMemberList_team_7 =
 testObject_TeamMemberList_team_8 :: TeamMemberList
 testObject_TeamMemberList_team_8 =
   ( newTeamMemberList
-      ( [ TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T07:35:03.629Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T00:48:38.818Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldDisabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T06:12:10.151Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T03:45:53.520Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T17:14:59.798Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldDisabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T17:51:55.340Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T01:38:35.880Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldDisabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T18:06:10.660Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T07:30:46.880Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation = Nothing,
-              _legalHoldStatus = UserLegalHoldDisabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation = Nothing,
-              _legalHoldStatus = UserLegalHoldPending
-            }
+      ( [ mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T07:35:03.629Z"))
+                )
+            )
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T00:48:38.818Z"))
+                )
+            )
+            UserLegalHoldDisabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T06:12:10.151Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T03:45:53.520Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T17:14:59.798Z"))
+                )
+            )
+            UserLegalHoldDisabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T17:51:55.340Z"))
+                )
+            )
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T01:38:35.880Z"))
+                )
+            )
+            UserLegalHoldDisabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T18:06:10.660Z"))
+                )
+            )
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T07:30:46.880Z"))
+                )
+            )
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            (Nothing)
+            UserLegalHoldDisabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            (Nothing)
+            UserLegalHoldPending
         ]
       )
       (ListTruncated)
@@ -477,26 +431,24 @@ testObject_TeamMemberList_team_8 =
 testObject_TeamMemberList_team_9 :: TeamMemberList
 testObject_TeamMemberList_team_9 =
   ( newTeamMemberList
-      ( [ TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [AddTeamMember], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-08T22:16:59.050Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [CreateConversation], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-08T21:43:37.550Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            }
+      ( [ mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000001")))
+            (Permissions {_self = fromList [AddTeamMember], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-08T22:16:59.050Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001")))
+            (Permissions {_self = fromList [CreateConversation], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-08T21:43:37.550Z"))
+                )
+            )
+            UserLegalHoldEnabled
         ]
       )
       (ListTruncated)
@@ -505,214 +457,192 @@ testObject_TeamMemberList_team_9 =
 testObject_TeamMemberList_team_10 :: TeamMemberList
 testObject_TeamMemberList_team_10 =
   ( newTeamMemberList
-      ( [ TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T04:44:28.366Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T06:22:04.036Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T12:10:11.701Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T21:54:05.305Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T00:26:06.221Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation = Nothing,
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T20:12:04.856Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldDisabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T23:35:44.986Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldDisabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T07:36:17.730Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T19:36:57.529Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation = Nothing,
-              _legalHoldStatus = UserLegalHoldDisabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T19:45:56.914Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T13:42:17.107Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T03:42:46.106Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T09:41:44.679Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T09:26:44.717Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T00:40:00.056Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldDisabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation = Nothing,
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T07:47:20.635Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T15:58:21.895Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T19:25:51.873Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T03:19:55.569Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            }
+      ( [ mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T04:44:28.366Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T06:22:04.036Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T12:10:11.701Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T21:54:05.305Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T00:26:06.221Z"))
+                )
+            )
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            (Nothing)
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T20:12:04.856Z"))
+                )
+            )
+            UserLegalHoldDisabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T23:35:44.986Z"))
+                )
+            )
+            UserLegalHoldDisabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T07:36:17.730Z"))
+                )
+            )
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T19:36:57.529Z"))
+                )
+            )
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            (Nothing)
+            UserLegalHoldDisabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T19:45:56.914Z"))
+                )
+            )
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T13:42:17.107Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T03:42:46.106Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T09:41:44.679Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T09:26:44.717Z"))
+                )
+            )
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T00:40:00.056Z"))
+                )
+            )
+            UserLegalHoldDisabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            (Nothing)
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T07:47:20.635Z"))
+                )
+            )
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T15:58:21.895Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T19:25:51.873Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T03:19:55.569Z"))
+                )
+            )
+            UserLegalHoldPending
         ]
       )
       (ListComplete)
@@ -721,120 +651,107 @@ testObject_TeamMemberList_team_10 =
 testObject_TeamMemberList_team_11 :: TeamMemberList
 testObject_TeamMemberList_team_11 =
   ( newTeamMemberList
-      ( [ TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T06:08:50.626Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation = Nothing,
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T08:23:53.653Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation = Nothing,
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T16:28:42.815Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation = Nothing,
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation = Nothing,
-              _legalHoldStatus = UserLegalHoldDisabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T11:47:57.498Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T17:22:07.538Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T19:14:48.836Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T14:53:49.059Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T10:44:04.209Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldDisabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T23:34:24.831Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            }
+      ( [ mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T06:08:50.626Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            (Nothing)
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T08:23:53.653Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            (Nothing)
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T16:28:42.815Z"))
+                )
+            )
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            (Nothing)
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            (Nothing)
+            UserLegalHoldDisabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T11:47:57.498Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T17:22:07.538Z"))
+                )
+            )
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T19:14:48.836Z"))
+                )
+            )
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T14:53:49.059Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T10:44:04.209Z"))
+                )
+            )
+            UserLegalHoldDisabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T23:34:24.831Z"))
+                )
+            )
+            UserLegalHoldPending
         ]
       )
       (ListTruncated)
@@ -843,38 +760,34 @@ testObject_TeamMemberList_team_11 =
 testObject_TeamMemberList_team_12 :: TeamMemberList
 testObject_TeamMemberList_team_12 =
   ( newTeamMemberList
-      ( [ TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation = Nothing,
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T15:59:09.462Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation = Nothing,
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T00:27:17.631Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            }
+      ( [ mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            (Nothing)
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T15:59:09.462Z"))
+                )
+            )
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            (Nothing)
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T00:27:17.631Z"))
+                )
+            )
+            UserLegalHoldEnabled
         ]
       )
       (ListTruncated)
@@ -883,32 +796,29 @@ testObject_TeamMemberList_team_12 =
 testObject_TeamMemberList_team_13 :: TeamMemberList
 testObject_TeamMemberList_team_13 =
   ( newTeamMemberList
-      ( [ TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation = Nothing,
-              _legalHoldStatus = UserLegalHoldDisabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [GetMemberPermissions], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-10T04:37:19.686Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T13:22:20.368Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            }
+      ( [ mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            (Nothing)
+            UserLegalHoldDisabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000000")))
+            (Permissions {_self = fromList [GetMemberPermissions], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-10T04:37:19.686Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T13:22:20.368Z"))
+                )
+            )
+            UserLegalHoldEnabled
         ]
       )
       (ListTruncated)
@@ -917,136 +827,121 @@ testObject_TeamMemberList_team_13 =
 testObject_TeamMemberList_team_14 :: TeamMemberList
 testObject_TeamMemberList_team_14 =
   ( newTeamMemberList
-      ( [ TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation = Nothing,
-              _legalHoldStatus = UserLegalHoldDisabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T07:01:56.077Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T09:34:46.900Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T10:40:24.034Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T10:17:53.056Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T18:37:38.894Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldDisabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation = Nothing,
-              _legalHoldStatus = UserLegalHoldDisabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T06:25:10.534Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T02:42:16.433Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldDisabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T07:25:18.248Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation = Nothing,
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T15:31:36.237Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T15:23:38.616Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldDisabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation = Nothing,
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation = Nothing,
-              _legalHoldStatus = UserLegalHoldEnabled
-            }
+      ( [ mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            (Nothing)
+            UserLegalHoldDisabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T07:01:56.077Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T09:34:46.900Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T10:40:24.034Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T10:17:53.056Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T18:37:38.894Z"))
+                )
+            )
+            UserLegalHoldDisabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            (Nothing)
+            UserLegalHoldDisabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T06:25:10.534Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T02:42:16.433Z"))
+                )
+            )
+            UserLegalHoldDisabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T07:25:18.248Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            (Nothing)
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T15:31:36.237Z"))
+                )
+            )
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T15:23:38.616Z"))
+                )
+            )
+            UserLegalHoldDisabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            (Nothing)
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            (Nothing)
+            UserLegalHoldEnabled
         ]
       )
       (ListTruncated)
@@ -1055,44 +950,39 @@ testObject_TeamMemberList_team_14 =
 testObject_TeamMemberList_team_15 :: TeamMemberList
 testObject_TeamMemberList_team_15 =
   ( newTeamMemberList
-      ( [ TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T20:33:17.912Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldDisabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T09:03:59.579Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation = Nothing,
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation = Nothing,
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation = Nothing,
-              _legalHoldStatus = UserLegalHoldDisabled
-            }
+      ( [ mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T20:33:17.912Z"))
+                )
+            )
+            UserLegalHoldDisabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T09:03:59.579Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            (Nothing)
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            (Nothing)
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            (Nothing)
+            UserLegalHoldDisabled
         ]
       )
       (ListTruncated)
@@ -1104,52 +994,47 @@ testObject_TeamMemberList_team_16 = (newTeamMemberList ([]) (ListComplete))
 testObject_TeamMemberList_team_17 :: TeamMemberList
 testObject_TeamMemberList_team_17 =
   ( newTeamMemberList
-      ( [ TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T10:04:36.715Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldDisabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation = Nothing,
-              _legalHoldStatus = UserLegalHoldDisabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T03:02:37.641Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T23:21:44.944Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldDisabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T08:47:48.774Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldDisabled
-            }
+      ( [ mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T10:04:36.715Z"))
+                )
+            )
+            UserLegalHoldDisabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            (Nothing)
+            UserLegalHoldDisabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000000000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T03:02:37.641Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0000-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T23:21:44.944Z"))
+                )
+            )
+            UserLegalHoldDisabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T08:47:48.774Z"))
+                )
+            )
+            UserLegalHoldDisabled
         ]
       )
       (ListTruncated)
@@ -1158,56 +1043,51 @@ testObject_TeamMemberList_team_17 =
 testObject_TeamMemberList_team_18 :: TeamMemberList
 testObject_TeamMemberList_team_18 =
   ( newTeamMemberList
-      ( [ TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T17:44:12.611Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T05:14:06.040Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000001"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T05:24:40.864Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T20:09:48.156Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T20:09:31.059Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            }
+      ( [ mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000000000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T17:44:12.611Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T05:14:06.040Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000001"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T05:24:40.864Z"))
+                )
+            )
+            UserLegalHoldPending,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0001-0000-000000000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T20:09:48.156Z"))
+                )
+            )
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T20:09:31.059Z"))
+                )
+            )
+            UserLegalHoldPending
         ]
       )
       (ListTruncated)
@@ -1216,20 +1096,19 @@ testObject_TeamMemberList_team_18 =
 testObject_TeamMemberList_team_19 :: TeamMemberList
 testObject_TeamMemberList_team_19 =
   ( newTeamMemberList
-      ( [ TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0002-0000-000200000000"))),
-              _permissions =
-                Permissions
-                  { _self = fromList [CreateConversation, SetTeamData, SetMemberPermissions],
-                    _copy = fromList []
-                  },
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0002-0000-000200000002"))),
-                    (fromJust (readUTCTimeMillis "1864-05-09T19:12:15.962Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldDisabled
-            }
+      ( [ mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0002-0000-000200000000")))
+            ( Permissions
+                { _self = fromList [CreateConversation, SetTeamData, SetMemberPermissions],
+                  _copy = fromList []
+                }
+            )
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0002-0000-000200000002"))),
+                  (fromJust (readUTCTimeMillis "1864-05-09T19:12:15.962Z"))
+                )
+            )
+            UserLegalHoldDisabled
         ]
       )
       (ListTruncated)
@@ -1238,22 +1117,20 @@ testObject_TeamMemberList_team_19 =
 testObject_TeamMemberList_team_20 :: TeamMemberList
 testObject_TeamMemberList_team_20 =
   ( newTeamMemberList
-      ( [ TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000001"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation = Nothing,
-              _legalHoldStatus = UserLegalHoldEnabled
-            },
-          TeamMember
-            { _userId = (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000000"))),
-              _permissions = Permissions {_self = fromList [], _copy = fromList []},
-              _invitation =
-                Just
-                  ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
-                    (fromJust (readUTCTimeMillis "1864-05-08T15:41:51.601Z"))
-                  ),
-              _legalHoldStatus = UserLegalHoldPending
-            }
+      ( [ mkTeamMember
+            (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000100000001")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            (Nothing)
+            UserLegalHoldEnabled,
+          mkTeamMember
+            (Id (fromJust (UUID.fromString "00000001-0000-0001-0000-000100000000")))
+            (Permissions {_self = fromList [], _copy = fromList []})
+            ( Just
+                ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000000"))),
+                  (fromJust (readUTCTimeMillis "1864-05-08T15:41:51.601Z"))
+                )
+            )
+            UserLegalHoldPending
         ]
       )
       (ListComplete)
diff --git a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/TeamMember_team.hs b/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/TeamMember_team.hs
index 432dba47f5a..395af66b78f 100644
--- a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/TeamMember_team.hs
+++ b/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/TeamMember_team.hs
@@ -30,7 +30,7 @@ import Data.LegalHold
 import qualified Data.UUID as UUID (fromString)
 import GHC.Exts (IsList (fromList))
 import Imports (Maybe (Just, Nothing), fromJust)
-import Wire.API.Team.Member (TeamMember (..))
+import Wire.API.Team.Member (TeamMember, mkTeamMember)
 import Wire.API.Team.Permission
   ( Perm
       ( AddTeamMember,
@@ -52,340 +52,316 @@ import Wire.API.Team.Permission
 
 testObject_TeamMember_team_1 :: TeamMember
 testObject_TeamMember_team_1 =
-  TeamMember
-    { _userId = (Id (fromJust (UUID.fromString "00000007-0000-0005-0000-000500000002"))),
-      _permissions =
-        Permissions
-          { _self = fromList [GetBilling, GetMemberPermissions, SetMemberPermissions, DeleteTeam],
-            _copy = fromList [GetBilling]
-          },
-      _invitation =
-        Just
-          ( (Id (fromJust (UUID.fromString "00000001-0000-0003-0000-000300000004"))),
-            (fromJust (readUTCTimeMillis "1864-05-12T22:05:34.634Z"))
-          ),
-      _legalHoldStatus = UserLegalHoldPending
-    }
+  mkTeamMember
+    (Id (fromJust (UUID.fromString "00000007-0000-0005-0000-000500000002")))
+    ( Permissions
+        { _self = fromList [GetBilling, GetMemberPermissions, SetMemberPermissions, DeleteTeam],
+          _copy = fromList [GetBilling]
+        }
+    )
+    ( Just
+        ( (Id (fromJust (UUID.fromString "00000001-0000-0003-0000-000300000004"))),
+          (fromJust (readUTCTimeMillis "1864-05-12T22:05:34.634Z"))
+        )
+    )
+    UserLegalHoldPending
 
 testObject_TeamMember_team_2 :: TeamMember
 testObject_TeamMember_team_2 =
-  TeamMember
-    { _userId = (Id (fromJust (UUID.fromString "00000003-0000-0000-0000-000500000005"))),
-      _permissions =
-        Permissions {_self = fromList [DoNotUseDeprecatedModifyConvName, SetMemberPermissions], _copy = fromList []},
-      _invitation =
-        Just
-          ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000004"))),
-            (fromJust (readUTCTimeMillis "1864-05-03T14:56:52.508Z"))
-          ),
-      _legalHoldStatus = UserLegalHoldDisabled
-    }
+  mkTeamMember
+    (Id (fromJust (UUID.fromString "00000003-0000-0000-0000-000500000005")))
+    (Permissions {_self = fromList [DoNotUseDeprecatedModifyConvName, SetMemberPermissions], _copy = fromList []})
+    ( Just
+        ( (Id (fromJust (UUID.fromString "00000000-0000-0000-0000-000000000004"))),
+          (fromJust (readUTCTimeMillis "1864-05-03T14:56:52.508Z"))
+        )
+    )
+    (UserLegalHoldDisabled)
 
 testObject_TeamMember_team_3 :: TeamMember
 testObject_TeamMember_team_3 =
-  TeamMember
-    { _userId = (Id (fromJust (UUID.fromString "00000005-0000-0003-0000-000400000003"))),
-      _permissions =
-        Permissions
-          { _self =
-              fromList
-                [DoNotUseDeprecatedDeleteConversation, AddTeamMember, DoNotUseDeprecatedAddRemoveConvMember, GetBilling],
-            _copy = fromList [GetBilling]
-          },
-      _invitation =
-        Just
-          ( (Id (fromJust (UUID.fromString "00000000-0000-0005-0000-000200000007"))),
-            (fromJust (readUTCTimeMillis "1864-05-06T14:02:04.371Z"))
-          ),
-      _legalHoldStatus = UserLegalHoldPending
-    }
+  mkTeamMember
+    (Id (fromJust (UUID.fromString "00000005-0000-0003-0000-000400000003")))
+    ( Permissions
+        { _self =
+            fromList
+              [DoNotUseDeprecatedDeleteConversation, AddTeamMember, DoNotUseDeprecatedAddRemoveConvMember, GetBilling],
+          _copy = fromList [GetBilling]
+        }
+    )
+    ( Just
+        ( (Id (fromJust (UUID.fromString "00000000-0000-0005-0000-000200000007"))),
+          (fromJust (readUTCTimeMillis "1864-05-06T14:02:04.371Z"))
+        )
+    )
+    (UserLegalHoldPending)
 
 testObject_TeamMember_team_4 :: TeamMember
 testObject_TeamMember_team_4 =
-  TeamMember
-    { _userId = (Id (fromJust (UUID.fromString "00000008-0000-0005-0000-000100000006"))),
-      _permissions =
-        Permissions
-          { _self = fromList [DoNotUseDeprecatedModifyConvName, SetMemberPermissions],
-            _copy = fromList [SetMemberPermissions]
-          },
-      _invitation =
-        Just
-          ( (Id (fromJust (UUID.fromString "00000006-0000-0002-0000-000500000001"))),
-            (fromJust (readUTCTimeMillis "1864-05-12T15:36:56.285Z"))
-          ),
-      _legalHoldStatus = UserLegalHoldEnabled
-    }
+  mkTeamMember
+    (Id (fromJust (UUID.fromString "00000008-0000-0005-0000-000100000006")))
+    ( Permissions
+        { _self = fromList [DoNotUseDeprecatedModifyConvName, SetMemberPermissions],
+          _copy = fromList [SetMemberPermissions]
+        }
+    )
+    ( Just
+        ( (Id (fromJust (UUID.fromString "00000006-0000-0002-0000-000500000001"))),
+          (fromJust (readUTCTimeMillis "1864-05-12T15:36:56.285Z"))
+        )
+    )
+    (UserLegalHoldEnabled)
 
 testObject_TeamMember_team_5 :: TeamMember
 testObject_TeamMember_team_5 =
-  TeamMember
-    { _userId = (Id (fromJust (UUID.fromString "00000007-0000-0000-0000-000200000001"))),
-      _permissions =
-        Permissions
-          { _self = fromList [DoNotUseDeprecatedDeleteConversation, GetBilling, SetBilling, GetMemberPermissions],
-            _copy = fromList [DoNotUseDeprecatedDeleteConversation, GetMemberPermissions]
-          },
-      _invitation =
-        Just
-          ( (Id (fromJust (UUID.fromString "00000004-0000-0002-0000-000300000007"))),
-            (fromJust (readUTCTimeMillis "1864-05-07T21:02:57.104Z"))
-          ),
-      _legalHoldStatus = UserLegalHoldPending
-    }
+  mkTeamMember
+    (Id (fromJust (UUID.fromString "00000007-0000-0000-0000-000200000001")))
+    ( Permissions
+        { _self = fromList [DoNotUseDeprecatedDeleteConversation, GetBilling, SetBilling, GetMemberPermissions],
+          _copy = fromList [DoNotUseDeprecatedDeleteConversation, GetMemberPermissions]
+        }
+    )
+    ( Just
+        ( (Id (fromJust (UUID.fromString "00000004-0000-0002-0000-000300000007"))),
+          (fromJust (readUTCTimeMillis "1864-05-07T21:02:57.104Z"))
+        )
+    )
+    (UserLegalHoldPending)
 
 testObject_TeamMember_team_6 :: TeamMember
 testObject_TeamMember_team_6 =
-  TeamMember
-    { _userId = (Id (fromJust (UUID.fromString "00000006-0000-0007-0000-000800000005"))),
-      _permissions =
-        Permissions
-          { _self =
-              fromList
-                [CreateConversation, AddTeamMember, DoNotUseDeprecatedAddRemoveConvMember, SetBilling, SetTeamData],
-            _copy = fromList []
-          },
-      _invitation =
-        Just
-          ( (Id (fromJust (UUID.fromString "00000005-0000-0007-0000-000800000000"))),
-            (fromJust (readUTCTimeMillis "1864-05-09T03:11:26.909Z"))
-          ),
-      _legalHoldStatus = UserLegalHoldEnabled
-    }
+  mkTeamMember
+    (Id (fromJust (UUID.fromString "00000006-0000-0007-0000-000800000005")))
+    ( Permissions
+        { _self =
+            fromList
+              [CreateConversation, AddTeamMember, DoNotUseDeprecatedAddRemoveConvMember, SetBilling, SetTeamData],
+          _copy = fromList []
+        }
+    )
+    ( Just
+        ( (Id (fromJust (UUID.fromString "00000005-0000-0007-0000-000800000000"))),
+          (fromJust (readUTCTimeMillis "1864-05-09T03:11:26.909Z"))
+        )
+    )
+    (UserLegalHoldEnabled)
 
 testObject_TeamMember_team_7 :: TeamMember
 testObject_TeamMember_team_7 =
-  TeamMember
-    { _userId = (Id (fromJust (UUID.fromString "00000007-0000-0000-0000-000200000001"))),
-      _permissions =
-        Permissions
-          { _self =
-              fromList
-                [ DoNotUseDeprecatedDeleteConversation,
-                  DoNotUseDeprecatedAddRemoveConvMember,
-                  SetBilling,
-                  SetMemberPermissions,
-                  GetTeamConversations
-                ],
-            _copy = fromList []
-          },
-      _invitation = Nothing,
-      _legalHoldStatus = UserLegalHoldPending
-    }
+  mkTeamMember
+    (Id (fromJust (UUID.fromString "00000007-0000-0000-0000-000200000001")))
+    ( Permissions
+        { _self =
+            fromList
+              [ DoNotUseDeprecatedDeleteConversation,
+                DoNotUseDeprecatedAddRemoveConvMember,
+                SetBilling,
+                SetMemberPermissions,
+                GetTeamConversations
+              ],
+          _copy = fromList []
+        }
+    )
+    (Nothing)
+    (UserLegalHoldPending)
 
 testObject_TeamMember_team_8 :: TeamMember
 testObject_TeamMember_team_8 =
-  TeamMember
-    { _userId = (Id (fromJust (UUID.fromString "00000005-0000-0007-0000-000300000000"))),
-      _permissions =
-        Permissions
-          { _self =
-              fromList
-                [ DoNotUseDeprecatedAddRemoveConvMember,
-                  DoNotUseDeprecatedModifyConvName,
-                  SetTeamData,
-                  SetMemberPermissions,
-                  DeleteTeam
-                ],
-            _copy = fromList []
-          },
-      _invitation =
-        Just
-          ( (Id (fromJust (UUID.fromString "00000007-0000-0003-0000-000400000003"))),
-            (fromJust (readUTCTimeMillis "1864-05-05T18:40:11.956Z"))
-          ),
-      _legalHoldStatus = UserLegalHoldDisabled
-    }
+  mkTeamMember
+    (Id (fromJust (UUID.fromString "00000005-0000-0007-0000-000300000000")))
+    ( Permissions
+        { _self =
+            fromList
+              [ DoNotUseDeprecatedAddRemoveConvMember,
+                DoNotUseDeprecatedModifyConvName,
+                SetTeamData,
+                SetMemberPermissions,
+                DeleteTeam
+              ],
+          _copy = fromList []
+        }
+    )
+    ( Just
+        ( (Id (fromJust (UUID.fromString "00000007-0000-0003-0000-000400000003"))),
+          (fromJust (readUTCTimeMillis "1864-05-05T18:40:11.956Z"))
+        )
+    )
+    (UserLegalHoldDisabled)
 
 testObject_TeamMember_team_9 :: TeamMember
 testObject_TeamMember_team_9 =
-  TeamMember
-    { _userId = (Id (fromJust (UUID.fromString "00000008-0000-0006-0000-000300000003"))),
-      _permissions =
-        Permissions
-          { _self = fromList [AddTeamMember, DoNotUseDeprecatedModifyConvName],
-            _copy = fromList [DoNotUseDeprecatedModifyConvName]
-          },
-      _invitation = Nothing,
-      _legalHoldStatus = UserLegalHoldPending
-    }
+  mkTeamMember
+    (Id (fromJust (UUID.fromString "00000008-0000-0006-0000-000300000003")))
+    ( Permissions
+        { _self = fromList [AddTeamMember, DoNotUseDeprecatedModifyConvName],
+          _copy = fromList [DoNotUseDeprecatedModifyConvName]
+        }
+    )
+    (Nothing)
+    (UserLegalHoldPending)
 
 testObject_TeamMember_team_10 :: TeamMember
 testObject_TeamMember_team_10 =
-  TeamMember
-    { _userId = (Id (fromJust (UUID.fromString "00000002-0000-0000-0000-000100000006"))),
-      _permissions =
-        Permissions {_self = fromList [DoNotUseDeprecatedDeleteConversation, AddTeamMember], _copy = fromList []},
-      _invitation =
-        Just
-          ( (Id (fromJust (UUID.fromString "00000008-0000-0005-0000-000000000002"))),
-            (fromJust (readUTCTimeMillis "1864-05-03T19:02:13.669Z"))
-          ),
-      _legalHoldStatus = UserLegalHoldDisabled
-    }
+  mkTeamMember
+    (Id (fromJust (UUID.fromString "00000002-0000-0000-0000-000100000006")))
+    (Permissions {_self = fromList [DoNotUseDeprecatedDeleteConversation, AddTeamMember], _copy = fromList []})
+    ( Just
+        ( (Id (fromJust (UUID.fromString "00000008-0000-0005-0000-000000000002"))),
+          (fromJust (readUTCTimeMillis "1864-05-03T19:02:13.669Z"))
+        )
+    )
+    (UserLegalHoldDisabled)
 
 testObject_TeamMember_team_11 :: TeamMember
 testObject_TeamMember_team_11 =
-  TeamMember
-    { _userId = (Id (fromJust (UUID.fromString "00000004-0000-0001-0000-000400000007"))),
-      _permissions =
-        Permissions
-          { _self =
-              fromList [CreateConversation, DoNotUseDeprecatedDeleteConversation, SetTeamData, SetMemberPermissions],
-            _copy = fromList []
-          },
-      _invitation =
-        Just
-          ( (Id (fromJust (UUID.fromString "00000003-0000-0001-0000-000100000005"))),
-            (fromJust (readUTCTimeMillis "1864-05-04T18:20:29.420Z"))
-          ),
-      _legalHoldStatus = UserLegalHoldEnabled
-    }
+  mkTeamMember
+    (Id (fromJust (UUID.fromString "00000004-0000-0001-0000-000400000007")))
+    ( Permissions
+        { _self =
+            fromList [CreateConversation, DoNotUseDeprecatedDeleteConversation, SetTeamData, SetMemberPermissions],
+          _copy = fromList []
+        }
+    )
+    ( Just
+        ( (Id (fromJust (UUID.fromString "00000003-0000-0001-0000-000100000005"))),
+          (fromJust (readUTCTimeMillis "1864-05-04T18:20:29.420Z"))
+        )
+    )
+    (UserLegalHoldEnabled)
 
 testObject_TeamMember_team_12 :: TeamMember
 testObject_TeamMember_team_12 =
-  TeamMember
-    { _userId = (Id (fromJust (UUID.fromString "00000002-0000-0006-0000-000200000005"))),
-      _permissions = Permissions {_self = fromList [GetTeamConversations], _copy = fromList []},
-      _invitation =
-        Just
-          ( (Id (fromJust (UUID.fromString "00000005-0000-0001-0000-000300000003"))),
-            (fromJust (readUTCTimeMillis "1864-05-10T22:34:18.259Z"))
-          ),
-      _legalHoldStatus = UserLegalHoldPending
-    }
+  mkTeamMember
+    (Id (fromJust (UUID.fromString "00000002-0000-0006-0000-000200000005")))
+    (Permissions {_self = fromList [GetTeamConversations], _copy = fromList []})
+    ( Just
+        ( (Id (fromJust (UUID.fromString "00000005-0000-0001-0000-000300000003"))),
+          (fromJust (readUTCTimeMillis "1864-05-10T22:34:18.259Z"))
+        )
+    )
+    (UserLegalHoldPending)
 
 testObject_TeamMember_team_13 :: TeamMember
 testObject_TeamMember_team_13 =
-  TeamMember
-    { _userId = (Id (fromJust (UUID.fromString "00000006-0000-0001-0000-000800000006"))),
-      _permissions =
-        Permissions {_self = fromList [CreateConversation, GetMemberPermissions], _copy = fromList [CreateConversation]},
-      _invitation =
-        Just
-          ( (Id (fromJust (UUID.fromString "00000000-0000-0003-0000-000400000007"))),
-            (fromJust (readUTCTimeMillis "1864-05-06T08:18:27.514Z"))
-          ),
-      _legalHoldStatus = UserLegalHoldDisabled
-    }
+  mkTeamMember
+    (Id (fromJust (UUID.fromString "00000006-0000-0001-0000-000800000006")))
+    (Permissions {_self = fromList [CreateConversation, GetMemberPermissions], _copy = fromList [CreateConversation]})
+    ( Just
+        ( (Id (fromJust (UUID.fromString "00000000-0000-0003-0000-000400000007"))),
+          (fromJust (readUTCTimeMillis "1864-05-06T08:18:27.514Z"))
+        )
+    )
+    (UserLegalHoldDisabled)
 
 testObject_TeamMember_team_14 :: TeamMember
 testObject_TeamMember_team_14 =
-  TeamMember
-    { _userId = (Id (fromJust (UUID.fromString "00000004-0000-0000-0000-000300000007"))),
-      _permissions =
-        Permissions
-          { _self = fromList [DoNotUseDeprecatedDeleteConversation, AddTeamMember, GetBilling, GetMemberPermissions],
-            _copy = fromList [GetBilling, GetMemberPermissions]
-          },
-      _invitation =
-        Just
-          ( (Id (fromJust (UUID.fromString "00000008-0000-0000-0000-000200000002"))),
-            (fromJust (readUTCTimeMillis "1864-05-12T15:53:41.144Z"))
-          ),
-      _legalHoldStatus = UserLegalHoldDisabled
-    }
+  mkTeamMember
+    (Id (fromJust (UUID.fromString "00000004-0000-0000-0000-000300000007")))
+    ( Permissions
+        { _self = fromList [DoNotUseDeprecatedDeleteConversation, AddTeamMember, GetBilling, GetMemberPermissions],
+          _copy = fromList [GetBilling, GetMemberPermissions]
+        }
+    )
+    ( Just
+        ( (Id (fromJust (UUID.fromString "00000008-0000-0000-0000-000200000002"))),
+          (fromJust (readUTCTimeMillis "1864-05-12T15:53:41.144Z"))
+        )
+    )
+    (UserLegalHoldDisabled)
 
 testObject_TeamMember_team_15 :: TeamMember
 testObject_TeamMember_team_15 =
-  TeamMember
-    { _userId = (Id (fromJust (UUID.fromString "00000005-0000-0006-0000-000800000006"))),
-      _permissions = Permissions {_self = fromList [DeleteTeam], _copy = fromList [DeleteTeam]},
-      _invitation =
-        Just
-          ( (Id (fromJust (UUID.fromString "00000008-0000-0000-0000-000500000003"))),
-            (fromJust (readUTCTimeMillis "1864-05-04T06:15:13.870Z"))
-          ),
-      _legalHoldStatus = UserLegalHoldEnabled
-    }
+  mkTeamMember
+    (Id (fromJust (UUID.fromString "00000005-0000-0006-0000-000800000006")))
+    (Permissions {_self = fromList [DeleteTeam], _copy = fromList [DeleteTeam]})
+    ( Just
+        ( (Id (fromJust (UUID.fromString "00000008-0000-0000-0000-000500000003"))),
+          (fromJust (readUTCTimeMillis "1864-05-04T06:15:13.870Z"))
+        )
+    )
+    (UserLegalHoldEnabled)
 
 testObject_TeamMember_team_16 :: TeamMember
 testObject_TeamMember_team_16 =
-  TeamMember
-    { _userId = (Id (fromJust (UUID.fromString "00000000-0000-0008-0000-000200000008"))),
-      _permissions =
-        Permissions {_self = fromList [DoNotUseDeprecatedDeleteConversation, GetTeamConversations], _copy = fromList []},
-      _invitation =
-        Just
-          ( (Id (fromJust (UUID.fromString "00000006-0000-0000-0000-000400000002"))),
-            (fromJust (readUTCTimeMillis "1864-05-10T04:27:37.101Z"))
-          ),
-      _legalHoldStatus = UserLegalHoldPending
-    }
+  mkTeamMember
+    (Id (fromJust (UUID.fromString "00000000-0000-0008-0000-000200000008")))
+    (Permissions {_self = fromList [DoNotUseDeprecatedDeleteConversation, GetTeamConversations], _copy = fromList []})
+    ( Just
+        ( (Id (fromJust (UUID.fromString "00000006-0000-0000-0000-000400000002"))),
+          (fromJust (readUTCTimeMillis "1864-05-10T04:27:37.101Z"))
+        )
+    )
+    (UserLegalHoldPending)
 
 testObject_TeamMember_team_17 :: TeamMember
 testObject_TeamMember_team_17 =
-  TeamMember
-    { _userId = (Id (fromJust (UUID.fromString "00000006-0000-0006-0000-000500000007"))),
-      _permissions =
-        Permissions
-          { _self =
-              fromList
-                [ DoNotUseDeprecatedAddRemoveConvMember,
-                  DoNotUseDeprecatedModifyConvName,
-                  GetBilling,
-                  SetTeamData,
-                  GetTeamConversations
-                ],
-            _copy = fromList [DoNotUseDeprecatedAddRemoveConvMember]
-          },
-      _invitation =
-        Just
-          ( (Id (fromJust (UUID.fromString "00000006-0000-0003-0000-000700000004"))),
-            (fromJust (readUTCTimeMillis "1864-05-07T23:22:37.991Z"))
-          ),
-      _legalHoldStatus = UserLegalHoldDisabled
-    }
+  mkTeamMember
+    (Id (fromJust (UUID.fromString "00000006-0000-0006-0000-000500000007")))
+    ( Permissions
+        { _self =
+            fromList
+              [ DoNotUseDeprecatedAddRemoveConvMember,
+                DoNotUseDeprecatedModifyConvName,
+                GetBilling,
+                SetTeamData,
+                GetTeamConversations
+              ],
+          _copy = fromList [DoNotUseDeprecatedAddRemoveConvMember]
+        }
+    )
+    ( Just
+        ( (Id (fromJust (UUID.fromString "00000006-0000-0003-0000-000700000004"))),
+          (fromJust (readUTCTimeMillis "1864-05-07T23:22:37.991Z"))
+        )
+    )
+    (UserLegalHoldDisabled)
 
 testObject_TeamMember_team_18 :: TeamMember
 testObject_TeamMember_team_18 =
-  TeamMember
-    { _userId = (Id (fromJust (UUID.fromString "00000005-0000-0005-0000-000200000008"))),
-      _permissions =
-        Permissions
-          { _self =
-              fromList [RemoveTeamMember, DoNotUseDeprecatedModifyConvName, GetMemberPermissions, SetMemberPermissions],
-            _copy = fromList [SetMemberPermissions]
-          },
-      _invitation =
-        Just
-          ( (Id (fromJust (UUID.fromString "00000007-0000-0008-0000-000500000006"))),
-            (fromJust (readUTCTimeMillis "1864-05-15T14:48:55.847Z"))
-          ),
-      _legalHoldStatus = UserLegalHoldPending
-    }
+  mkTeamMember
+    (Id (fromJust (UUID.fromString "00000005-0000-0005-0000-000200000008")))
+    ( Permissions
+        { _self =
+            fromList [RemoveTeamMember, DoNotUseDeprecatedModifyConvName, GetMemberPermissions, SetMemberPermissions],
+          _copy = fromList [SetMemberPermissions]
+        }
+    )
+    ( Just
+        ( (Id (fromJust (UUID.fromString "00000007-0000-0008-0000-000500000006"))),
+          (fromJust (readUTCTimeMillis "1864-05-15T14:48:55.847Z"))
+        )
+    )
+    (UserLegalHoldPending)
 
 testObject_TeamMember_team_19 :: TeamMember
 testObject_TeamMember_team_19 =
-  TeamMember
-    { _userId = (Id (fromJust (UUID.fromString "00000003-0000-0002-0000-000200000008"))),
-      _permissions =
-        Permissions
-          { _self =
-              fromList [AddTeamMember, DoNotUseDeprecatedModifyConvName, GetBilling, SetBilling, SetMemberPermissions],
-            _copy = fromList [SetMemberPermissions]
-          },
-      _invitation =
-        Just
-          ( (Id (fromJust (UUID.fromString "00000006-0000-0001-0000-000200000008"))),
-            (fromJust (readUTCTimeMillis "1864-05-12T01:37:35.003Z"))
-          ),
-      _legalHoldStatus = UserLegalHoldPending
-    }
+  mkTeamMember
+    (Id (fromJust (UUID.fromString "00000003-0000-0002-0000-000200000008")))
+    ( Permissions
+        { _self =
+            fromList [AddTeamMember, DoNotUseDeprecatedModifyConvName, GetBilling, SetBilling, SetMemberPermissions],
+          _copy = fromList [SetMemberPermissions]
+        }
+    )
+    ( Just
+        ( (Id (fromJust (UUID.fromString "00000006-0000-0001-0000-000200000008"))),
+          (fromJust (readUTCTimeMillis "1864-05-12T01:37:35.003Z"))
+        )
+    )
+    (UserLegalHoldPending)
 
 testObject_TeamMember_team_20 :: TeamMember
 testObject_TeamMember_team_20 =
-  TeamMember
-    { _userId = (Id (fromJust (UUID.fromString "00000005-0000-0007-0000-000100000005"))),
-      _permissions =
-        Permissions
-          { _self = fromList [CreateConversation, AddTeamMember, DoNotUseDeprecatedModifyConvName, GetBilling],
-            _copy = fromList []
-          },
-      _invitation =
-        Just
-          ( (Id (fromJust (UUID.fromString "00000005-0000-0001-0000-000800000007"))),
-            (fromJust (readUTCTimeMillis "1864-05-04T22:12:50.096Z"))
-          ),
-      _legalHoldStatus = UserLegalHoldEnabled
-    }
+  mkTeamMember
+    (Id (fromJust (UUID.fromString "00000005-0000-0007-0000-000100000005")))
+    ( Permissions
+        { _self = fromList [CreateConversation, AddTeamMember, DoNotUseDeprecatedModifyConvName, GetBilling],
+          _copy = fromList []
+        }
+    )
+    ( Just
+        ( (Id (fromJust (UUID.fromString "00000005-0000-0001-0000-000800000007"))),
+          (fromJust (readUTCTimeMillis "1864-05-04T22:12:50.096Z"))
+        )
+    )
+    (UserLegalHoldEnabled)
diff --git a/services/brig/src/Brig/IO/Intra.hs b/services/brig/src/Brig/IO/Intra.hs
index 55fbb8f54bd..a7ed7bc5068 100644
--- a/services/brig/src/Brig/IO/Intra.hs
+++ b/services/brig/src/Brig/IO/Intra.hs
@@ -122,6 +122,7 @@ import Wire.API.Federation.Error
 import Wire.API.Message (UserClients)
 import Wire.API.Team.Feature (IncludeLockStatus (..), TeamFeatureName (..), TeamFeatureStatus)
 import Wire.API.Team.LegalHold (LegalholdProtectee)
+import qualified Wire.API.Team.Member as Member
 
 -----------------------------------------------------------------------------
 -- Event Handlers
@@ -853,7 +854,7 @@ addTeamMember u tid (minvmeta, role) = do
     _ -> False
   where
     prm = Team.rolePermissions role
-    bdy = Team.newNewTeamMember u prm minvmeta
+    bdy = Member.mkNewTeamMember u prm minvmeta
     req =
       paths ["i", "teams", toByteString' tid, "members"]
         . header "Content-Type" "application/json"
diff --git a/services/brig/test/integration/API/Team/Util.hs b/services/brig/test/integration/API/Team/Util.hs
index aa44fc75895..36811ec25d3 100644
--- a/services/brig/test/integration/API/Team/Util.hs
+++ b/services/brig/test/integration/API/Team/Util.hs
@@ -48,6 +48,7 @@ import Util
 import Web.Cookie (parseSetCookie, setCookieName)
 import Wire.API.Team.Feature (TeamFeatureStatusValue (..))
 import qualified Wire.API.Team.Feature as Public
+import qualified Wire.API.Team.Member as Member
 import qualified Wire.API.User as Public
 
 -- | FUTUREWORK: Remove 'createPopulatedBindingTeam', 'createPopulatedBindingTeamWithNames',
@@ -204,7 +205,7 @@ updatePermissions from tid (to, perm) galley =
     !!! const 200
     === statusCode
   where
-    changeMember = Team.newNewTeamMember to perm Nothing
+    changeMember = Member.mkNewTeamMember to perm Nothing
 
 createTeamConv :: HasCallStack => Galley -> TeamId -> UserId -> [UserId] -> Maybe Milliseconds -> Http ConvId
 createTeamConv g tid u us mtimer = do
diff --git a/services/galley/src/Galley/API/Public.hs b/services/galley/src/Galley/API/Public.hs
index 31d41ae0531..42db3104f91 100644
--- a/services/galley/src/Galley/API/Public.hs
+++ b/services/galley/src/Galley/API/Public.hs
@@ -187,25 +187,14 @@ servantSitemap =
         GalleyAPI.featureConfigClassifiedDomainsGet = Features.getFeatureConfig @'Public.WithoutLockStatus @'Public.TeamFeatureClassifiedDomains Features.getClassifiedDomainsInternal,
         GalleyAPI.featureConfigConferenceCallingGet = Features.getFeatureConfig @'Public.WithoutLockStatus @'Public.TeamFeatureConferenceCalling Features.getConferenceCallingInternal,
         GalleyAPI.featureConfigSelfDeletingMessagesGet = Features.getFeatureConfig @'Public.WithLockStatus @'Public.TeamFeatureSelfDeletingMessages Features.getSelfDeletingMessagesInternal,
-        GalleyAPI.featureConfigGuestLinksGet = Features.getFeatureConfig @'Public.WithLockStatus @'Public.TeamFeatureGuestLinks Features.getGuestLinkInternal
+        GalleyAPI.featureConfigGuestLinksGet = Features.getFeatureConfig @'Public.WithLockStatus @'Public.TeamFeatureGuestLinks Features.getGuestLinkInternal,
+        GalleyAPI.createNonBindingTeam = Teams.createNonBindingTeamH
       }
 
 sitemap :: Routes ApiBuilder (Sem GalleyEffects) ()
 sitemap = do
   -- Team API -----------------------------------------------------------
 
-  post "/teams" (continue Teams.createNonBindingTeamH) $
-    zauthUserId
-      .&. zauthConnId
-      .&. jsonRequest @Public.NonBindingNewTeam
-      .&. accept "application" "json"
-  document "POST" "createNonBindingTeam" $ do
-    summary "Create a new non binding team"
-    body (ref Public.modelNewNonBindingTeam) $
-      description "JSON body"
-    response 201 "Team ID as `Location` header value" end
-    errorResponse (Error.errorDescriptionTypeToWai @Error.NotConnected)
-
   put "/teams/:tid" (continue Teams.updateTeamH) $
     zauthUserId
       .&. zauthConnId
diff --git a/services/galley/src/Galley/API/Teams.hs b/services/galley/src/Galley/API/Teams.hs
index 9d46c2fcd7a..34e27ae7fc1 100644
--- a/services/galley/src/Galley/API/Teams.hs
+++ b/services/galley/src/Galley/API/Teams.hs
@@ -135,6 +135,7 @@ import qualified Wire.API.Team as Public
 import qualified Wire.API.Team.Conversation as Public
 import Wire.API.Team.Export (TeamExportUser (..))
 import qualified Wire.API.Team.Feature as Public
+import Wire.API.Team.Member (ntmNewTeamMember, teamMemberJson, teamMemberListJson)
 import qualified Wire.API.Team.Member as Public
 import qualified Wire.API.Team.SearchVisibility as Public
 import Wire.API.User (User, UserSSOId (UserScimExternalId), userSCIMExternalId, userSSOId)
@@ -203,41 +204,22 @@ lookupTeam zusr tid = do
     else pure Nothing
 
 createNonBindingTeamH ::
-  Members
-    '[ BrigAccess,
-       Error ActionError,
-       Error TeamError,
-       GundeckAccess,
-       Input UTCTime,
-       P.TinyLog,
-       TeamStore,
-       WaiRoutes
-     ]
-    r =>
-  UserId ::: ConnId ::: JsonRequest Public.NonBindingNewTeam ::: JSON ->
-  Sem r Response
-createNonBindingTeamH (zusr ::: zcon ::: req ::: _) = do
-  newTeam <- fromJsonBody req
-  newTeamId <- createNonBindingTeam zusr zcon newTeam
-  pure (empty & setStatus status201 . location newTeamId)
-
-createNonBindingTeam ::
-  Members
-    '[ BrigAccess,
-       Error ActionError,
-       Error TeamError,
-       GundeckAccess,
-       Input UTCTime,
-       TeamStore,
-       P.TinyLog
-     ]
-    r =>
+  forall r.
+  ( Member BrigAccess r,
+    Member (Error ActionError) r,
+    Member (Error TeamError) r,
+    Member GundeckAccess r,
+    Member (Input UTCTime) r,
+    Member P.TinyLog r,
+    Member TeamStore r,
+    Member WaiRoutes r
+  ) =>
   UserId ->
   ConnId ->
   Public.NonBindingNewTeam ->
   Sem r TeamId
-createNonBindingTeam zusr zcon (Public.NonBindingNewTeam body) = do
-  let owner = Public.TeamMember zusr fullPermissions Nothing LH.defUserLegalHoldStatus
+createNonBindingTeamH zusr zcon (Public.NonBindingNewTeam body) = do
+  let owner = Public.mkTeamMember zusr fullPermissions Nothing LH.defUserLegalHoldStatus
   let others =
         filter ((zusr /=) . view userId)
           . maybe [] fromRange
@@ -275,7 +257,7 @@ createBindingTeam ::
   BindingNewTeam ->
   Sem r TeamId
 createBindingTeam zusr tid (BindingNewTeam body) = do
-  let owner = Public.TeamMember zusr fullPermissions Nothing LH.defUserLegalHoldStatus
+  let owner = Public.mkTeamMember zusr fullPermissions Nothing LH.defUserLegalHoldStatus
   team <-
     E.createTeam (Just tid) zusr (body ^. newTeamName) (body ^. newTeamIcon) (body ^. newTeamIconKey) Binding
   finishCreateTeam team owner [] Nothing
@@ -835,7 +817,7 @@ addTeamMember ::
   Public.NewTeamMember ->
   Sem r ()
 addTeamMember zusr zcon tid nmem = do
-  let uid = nmem ^. ntmNewTeamMember . userId
+  let uid = nmem ^. nUserId
   P.debug $
     Log.field "targets" (toByteString uid)
       . Log.field "action" (Log.val "Teams.addTeamMember")
@@ -843,7 +825,7 @@ addTeamMember zusr zcon tid nmem = do
   zusrMembership <-
     E.getTeamMember tid zusr
       >>= permissionCheck AddTeamMember
-  let targetPermissions = nmem ^. ntmNewTeamMember . permissions
+  let targetPermissions = nmem ^. nPermissions
   targetPermissions `ensureNotElevated` zusrMembership
   ensureNonBindingTeam tid
   ensureUnboundUsers [uid]
@@ -904,7 +886,7 @@ uncheckedAddTeamMember tid nmem = do
   (TeamSize sizeBeforeJoin) <- E.getSize tid
   ensureNotTooLargeForLegalHold tid (fromIntegral sizeBeforeJoin + 1)
   (TeamSize sizeBeforeAdd) <- addTeamMemberInternal tid Nothing Nothing nmem mems
-  billingUserIds <- Journal.getBillingUserIds tid $ Just $ newTeamMemberList ((nmem ^. ntmNewTeamMember) : mems ^. teamMembers) (mems ^. teamMemberListType)
+  billingUserIds <- Journal.getBillingUserIds tid $ Just $ newTeamMemberList (ntmNewTeamMember nmem : mems ^. teamMembers) (mems ^. teamMemberListType)
   Journal.teamUpdate tid (sizeBeforeAdd + 1) billingUserIds
 
 updateTeamMemberH ::
@@ -925,7 +907,7 @@ updateTeamMemberH ::
   Sem r Response
 updateTeamMemberH (zusr ::: zcon ::: tid ::: req ::: _) = do
   -- the team member to be updated
-  targetMember <- view ntmNewTeamMember <$> (fromJsonBody req)
+  targetMember <- ntmNewTeamMember <$> fromJsonBody req
   updateTeamMember zusr zcon tid targetMember
   pure empty
 
@@ -1385,7 +1367,7 @@ addTeamMemberInternal ::
   NewTeamMember ->
   TeamMemberList ->
   Sem r TeamSize
-addTeamMemberInternal tid origin originConn (view ntmNewTeamMember -> new) memList = do
+addTeamMemberInternal tid origin originConn (ntmNewTeamMember -> new) memList = do
   P.debug $
     Log.field "targets" (toByteString (new ^. userId))
       . Log.field "action" (Log.val "Teams.addTeamMemberInternal")
diff --git a/services/galley/src/Galley/Cassandra/Team.hs b/services/galley/src/Galley/Cassandra/Team.hs
index 7d0f373a290..a89af42d6d4 100644
--- a/services/galley/src/Galley/Cassandra/Team.hs
+++ b/services/galley/src/Galley/Cassandra/Team.hs
@@ -410,8 +410,8 @@ newTeamMember' lh tid (uid, perms, minvu, minvt, fromMaybe defUserLegalHoldStatu
         UserLegalHoldPending -> UserLegalHoldPending
         UserLegalHoldEnabled -> UserLegalHoldEnabled
 
-    mk (Just invu) (Just invt) = pure $ TeamMember uid perms (Just (invu, invt)) lhStatus
-    mk Nothing Nothing = pure $ TeamMember uid perms Nothing lhStatus
+    mk (Just invu) (Just invt) = pure $ mkTeamMember uid perms (Just (invu, invt)) lhStatus
+    mk Nothing Nothing = pure $ mkTeamMember uid perms Nothing lhStatus
     mk _ _ = throwM $ ErrorCall "TeamMember with incomplete metadata."
 
 teamConversationsForPagination :: TeamId -> Maybe ConvId -> Range 1 HardTruncationLimit Int32 -> Client (Page TeamConversation)
diff --git a/services/galley/test/integration/API/MessageTimer.hs b/services/galley/test/integration/API/MessageTimer.hs
index f0e1d91fb21..e773e3a5491 100644
--- a/services/galley/test/integration/API/MessageTimer.hs
+++ b/services/galley/test/integration/API/MessageTimer.hs
@@ -189,7 +189,7 @@ messageTimerChangeWithoutAllowedAction = do
   -- Create a team and a guest user
   [owner, member, guest] <- randomUsers 3
   connectUsers owner (list1 member [guest])
-  tid <- createNonBindingTeam "team" owner [Member.TeamMember member Teams.fullPermissions Nothing LH.defUserLegalHoldStatus]
+  tid <- createNonBindingTeam "team" owner [Member.mkTeamMember member Teams.fullPermissions Nothing LH.defUserLegalHoldStatus]
   -- Create a conversation
   cid <- createTeamConvWithRole owner tid [member, guest] Nothing Nothing Nothing roleNameWireMember
   -- Try to change the timer (as a non admin, guest user) and observe failure
diff --git a/services/galley/test/integration/API/Teams.hs b/services/galley/test/integration/API/Teams.hs
index 837f499864b..2e0890f7c4a 100644
--- a/services/galley/test/integration/API/Teams.hs
+++ b/services/galley/test/integration/API/Teams.hs
@@ -480,7 +480,7 @@ testAddTeamMember = do
   Util.connectUsers (mem1 ^. userId) (list1 (mem2 ^. userId) [])
   tid <- Util.createNonBindingTeam "foo" owner [mem1, mem2]
   mem3 <- newTeamMember' p1 <$> Util.randomUser
-  let payload = json (newNewTeamMember (mem3 ^. userId) (mem3 ^. permissions) (mem3 ^. invitation))
+  let payload = json (Member.mkNewTeamMember (mem3 ^. userId) (mem3 ^. permissions) (mem3 ^. invitation))
   Util.connectUsers (mem1 ^. userId) (list1 (mem3 ^. userId) [])
   Util.connectUsers (mem2 ^. userId) (list1 (mem3 ^. userId) [])
   -- `mem1` lacks permission to add new team members
@@ -566,7 +566,7 @@ testAddTeamMemberCheckBound = do
     ( g . paths ["teams", toByteString' tidBound, "members"]
         . zUser ownerBound
         . zConn "conn"
-        . json (newNewTeamMember (rndMem ^. userId) (rndMem ^. permissions) (rndMem ^. invitation))
+        . json (Member.mkNewTeamMember (rndMem ^. userId) (rndMem ^. permissions) (rndMem ^. invitation))
     )
     !!! const 403 === statusCode
   owner <- Util.randomUser
@@ -576,7 +576,7 @@ testAddTeamMemberCheckBound = do
   post
     ( g . paths ["teams", toByteString' tid, "members"] . zUser owner
         . zConn "conn"
-        . json (newNewTeamMember (boundMem ^. userId) (boundMem ^. permissions) (boundMem ^. invitation))
+        . json (Member.mkNewTeamMember (boundMem ^. userId) (boundMem ^. permissions) (boundMem ^. invitation))
     )
     !!! const 403 === statusCode
 
@@ -970,7 +970,7 @@ testUpdateTeamConv (rolePermissions -> perms) convRole = do
   owner <- Util.randomUser
   member <- Util.randomUser
   Util.connectUsers owner (list1 member [])
-  tid <- Util.createNonBindingTeam "foo" owner [Member.TeamMember member perms Nothing LH.defUserLegalHoldStatus]
+  tid <- Util.createNonBindingTeam "foo" owner [Member.mkTeamMember member perms Nothing LH.defUserLegalHoldStatus]
   cid <- Util.createTeamConvWithRole owner tid [member] (Just "gossip") Nothing Nothing convRole
   resp <- updateTeamConv member cid (ConversationRename "not gossip")
   -- FUTUREWORK: Ensure that the team role _really_ does not matter
@@ -1459,7 +1459,7 @@ testBillingInLargeTeamWithoutIndexedBillingTeamMembers = do
     foldM
       ( \billingMembers n -> do
           newBillingMemberId <- randomUser
-          let mem = json $ newNewTeamMember newBillingMemberId (rolePermissions RoleOwner) Nothing
+          let mem = json $ Member.mkNewTeamMember newBillingMemberId (rolePermissions RoleOwner) Nothing
           -- We cannot properly add the new owner with an invite as we don't have a way to
           -- override galley settings while making a call to brig
           withoutIndexedBillingTeamMembers $
@@ -1477,7 +1477,7 @@ testBillingInLargeTeamWithoutIndexedBillingTeamMembers = do
 
   -- If we add another owner, one of them won't get notified
   ownerFanoutPlusTwo <- randomUser
-  let memFanoutPlusTwo = json $ newNewTeamMember ownerFanoutPlusTwo (rolePermissions RoleOwner) Nothing
+  let memFanoutPlusTwo = json $ Member.mkNewTeamMember ownerFanoutPlusTwo (rolePermissions RoleOwner) Nothing
   -- We cannot properly add the new owner with an invite as we don't have a way to
   -- override galley settings while making a call to brig
   withoutIndexedBillingTeamMembers $
@@ -1513,7 +1513,7 @@ testBillingInLargeTeamWithoutIndexedBillingTeamMembers = do
   refreshIndex
 
   -- Promotions and demotion should also be kept track of regardless of feature being enabled
-  let demoteFanoutPlusThree = newNewTeamMember ownerFanoutPlusThree (rolePermissions RoleAdmin) Nothing
+  let demoteFanoutPlusThree = Member.mkNewTeamMember ownerFanoutPlusThree (rolePermissions RoleAdmin) Nothing
   withoutIndexedBillingTeamMembers $ updateTeamMember galley team firstOwner demoteFanoutPlusThree !!! const 200 === statusCode
   ensureQueueEmpty
 
@@ -1522,7 +1522,7 @@ testBillingInLargeTeamWithoutIndexedBillingTeamMembers = do
     tUpdateUncertainCount [4, 5] (allOwnersBeforeFanoutLimit <> [ownerFanoutPlusFour, ownerFanoutPlusFive])
   refreshIndex
 
-  let promoteFanoutPlusThree = newNewTeamMember ownerFanoutPlusThree (rolePermissions RoleOwner) Nothing
+  let promoteFanoutPlusThree = Member.mkNewTeamMember ownerFanoutPlusThree (rolePermissions RoleOwner) Nothing
   withoutIndexedBillingTeamMembers $ updateTeamMember galley team firstOwner promoteFanoutPlusThree !!! const 200 === statusCode
   ensureQueueEmpty
 
@@ -1548,28 +1548,28 @@ testUpdateTeamMember = do
   assertQueue "add member" $ tUpdate 2 [owner]
   refreshIndex
   -- non-owner can **NOT** demote owner
-  let demoteOwner = newNewTeamMember owner (rolePermissions RoleAdmin) Nothing
+  let demoteOwner = Member.mkNewTeamMember owner (rolePermissions RoleAdmin) Nothing
   updateTeamMember g tid (member ^. userId) demoteOwner !!! do
     const 403 === statusCode
     const "access-denied" === (Error.label . responseJsonUnsafeWithMsg "error label")
   -- owner can demote non-owner
-  let demoteMember = newNewTeamMember (member ^. userId) noPermissions (member ^. invitation)
+  let demoteMember = Member.mkNewTeamMember (member ^. userId) noPermissions (member ^. invitation)
   WS.bracketR2 c owner (member ^. userId) $ \(wsOwner, wsMember) -> do
     updateTeamMember g tid owner demoteMember !!! do
       const 200 === statusCode
     member' <- Util.getTeamMember owner tid (member ^. userId)
-    liftIO $ assertEqual "permissions" (member' ^. permissions) (demoteMember ^. ntmNewTeamMember . permissions)
+    liftIO $ assertEqual "permissions" (member' ^. permissions) (demoteMember ^. nPermissions)
     checkTeamMemberUpdateEvent tid (member ^. userId) wsOwner (pure noPermissions)
     checkTeamMemberUpdateEvent tid (member ^. userId) wsMember (pure noPermissions)
     WS.assertNoEvent timeout [wsOwner, wsMember]
   assertQueue "Member demoted" $ tUpdate 2 [owner]
   -- owner can promote non-owner
-  let promoteMember = newNewTeamMember (member ^. userId) fullPermissions (member ^. invitation)
+  let promoteMember = Member.mkNewTeamMember (member ^. userId) fullPermissions (member ^. invitation)
   WS.bracketR2 c owner (member ^. userId) $ \(wsOwner, wsMember) -> do
     updateTeamMember g tid owner promoteMember !!! do
       const 200 === statusCode
     member' <- Util.getTeamMember owner tid (member ^. userId)
-    liftIO $ assertEqual "permissions" (member' ^. permissions) (promoteMember ^. ntmNewTeamMember . permissions)
+    liftIO $ assertEqual "permissions" (member' ^. permissions) (promoteMember ^. nPermissions)
     checkTeamMemberUpdateEvent tid (member ^. userId) wsOwner (pure fullPermissions)
     checkTeamMemberUpdateEvent tid (member ^. userId) wsMember (pure fullPermissions)
     WS.assertNoEvent timeout [wsOwner, wsMember]
@@ -1582,7 +1582,7 @@ testUpdateTeamMember = do
     updateTeamMember g tid (member ^. userId) demoteOwner !!! do
       const 200 === statusCode
     owner' <- Util.getTeamMember (member ^. userId) tid owner
-    liftIO $ assertEqual "permissions" (owner' ^. permissions) (demoteOwner ^. ntmNewTeamMember . permissions)
+    liftIO $ assertEqual "permissions" (owner' ^. permissions) (demoteOwner ^. nPermissions)
     -- owner no longer has GetPermissions, but she can still see the update because it's about her!
     checkTeamMemberUpdateEvent tid owner wsOwner (pure (rolePermissions RoleAdmin))
     checkTeamMemberUpdateEvent tid owner wsMember (pure (rolePermissions RoleAdmin))
@@ -1881,7 +1881,7 @@ postCryptoBroadcastMessage100OrMaxConns = do
         (xxx, yyy, _, _) -> error ("Unexpected while connecting users: " ++ show xxx ++ " and " ++ show yyy)
 
 newTeamMember' :: Permissions -> UserId -> TeamMember
-newTeamMember' perms uid = Member.TeamMember uid perms Nothing LH.defUserLegalHoldStatus
+newTeamMember' perms uid = Member.mkTeamMember uid perms Nothing LH.defUserLegalHoldStatus
 
 -- NOTE: all client functions calling @{/i,}/teams/*/features/*@ can be replaced by
 -- hypothetical functions 'getTeamFeatureFlag', 'getTeamFeatureFlagInternal',
diff --git a/services/galley/test/integration/API/Util.hs b/services/galley/test/integration/API/Util.hs
index 31af5c651a5..3a767e13e9a 100644
--- a/services/galley/test/integration/API/Util.hs
+++ b/services/galley/test/integration/API/Util.hs
@@ -122,6 +122,7 @@ import Wire.API.Message
 import qualified Wire.API.Message.Proto as Proto
 import Wire.API.Routes.Internal.Brig.Connection
 import Wire.API.Routes.MultiTablePaging
+import Wire.API.Team.Member (mkNewTeamMember)
 import Wire.API.User.Client (ClientCapability (..), UserClientsFull (UserClientsFull))
 import qualified Wire.API.User.Client as Client
 import Wire.API.User.Identity (mkSimpleSampleUref)
@@ -358,7 +359,7 @@ getTeamMemberInternal tid mid = do
 addTeamMember :: HasCallStack => UserId -> TeamId -> UserId -> Permissions -> Maybe (UserId, UTCTimeMillis) -> TestM ()
 addTeamMember usr tid muid mperms mmbinv = do
   g <- view tsGalley
-  let payload = json (newNewTeamMember muid mperms mmbinv)
+  let payload = json (mkNewTeamMember muid mperms mmbinv)
   post (g . paths ["teams", toByteString' tid, "members"] . zUser usr . zConn "conn" . payload)
     !!! const 200 === statusCode
 
@@ -370,7 +371,7 @@ addTeamMemberInternal tid muid mperms mmbinv = addTeamMemberInternal' tid muid m
 addTeamMemberInternal' :: HasCallStack => TeamId -> UserId -> Permissions -> Maybe (UserId, UTCTimeMillis) -> TestM ResponseLBS
 addTeamMemberInternal' tid muid mperms mmbinv = do
   g <- view tsGalley
-  let payload = json (newNewTeamMember muid mperms mmbinv)
+  let payload = json (mkNewTeamMember muid mperms mmbinv)
   post (g . paths ["i", "teams", toByteString' tid, "members"] . payload)
 
 addUserToTeam :: HasCallStack => UserId -> TeamId -> TestM TeamMember
@@ -417,7 +418,7 @@ addUserToTeamWithSSO hasEmail tid = do
 makeOwner :: HasCallStack => UserId -> TeamMember -> TeamId -> TestM ()
 makeOwner owner mem tid = do
   galley <- view tsGalley
-  let changeMember = newNewTeamMember (mem ^. Team.userId) fullPermissions (mem ^. Team.invitation)
+  let changeMember = mkNewTeamMember (mem ^. Team.userId) fullPermissions (mem ^. Team.invitation)
   put
     ( galley
         . paths ["teams", toByteString' tid, "members"]
diff --git a/services/spar/test-integration/Util/Core.hs b/services/spar/test-integration/Util/Core.hs
index f51f8789748..a621f285f1d 100644
--- a/services/spar/test-integration/Util/Core.hs
+++ b/services/spar/test-integration/Util/Core.hs
@@ -199,6 +199,7 @@ import Wire.API.Routes.Public.Spar
 import Wire.API.Team.Feature (TeamFeatureStatusValue (..))
 import qualified Wire.API.Team.Feature as Public
 import qualified Wire.API.Team.Invitation as TeamInvitation
+import qualified Wire.API.Team.Member as Member
 import Wire.API.User (HandleUpdate (HandleUpdate), UserUpdate)
 import qualified Wire.API.User as User
 import Wire.API.User.Identity (mkSampleUref)
@@ -472,7 +473,7 @@ createTeamMember brigreq galleyreq teamid perms = do
     postUser name False (Just ssoid) (Just teamid) brigreq
       <!! const 201 === statusCode
   let nobody :: UserId = Brig.userId (responseJsonUnsafe @Brig.User resp)
-  addTeamMember galleyreq teamid (Galley.newNewTeamMember nobody perms Nothing)
+  addTeamMember galleyreq teamid (Member.mkNewTeamMember nobody perms Nothing)
   pure nobody
 
 -- | FUTUREWORK(fisx): use the specified & supported flows for scaffolding; this is a hack
@@ -599,7 +600,7 @@ promoteTeamMember :: HasCallStack => UserId -> TeamId -> UserId -> TestSpar ()
 promoteTeamMember usr tid memid = do
   gly <- view teGalley
   let bdy :: Galley.NewTeamMember
-      bdy = Galley.newNewTeamMember memid Galley.fullPermissions Nothing
+      bdy = Member.mkNewTeamMember memid Galley.fullPermissions Nothing
   call $
     put (gly . paths ["teams", toByteString' tid, "members"] . zAuthAccess usr "conn" . json bdy)
       !!! const 200 === statusCode
@@ -1209,7 +1210,7 @@ ssoToUidSpar tid ssoid = do
   veid <- either (error . ("could not parse brig sso_id: " <>)) pure $ Intra.veidFromUserSSOId ssoid
   runSpar $
     runValidExternalId
-      (SAMLUserStore.get)
+      SAMLUserStore.get
       (ScimExternalIdStore.lookup tid)
       veid
 
diff --git a/tools/stern/src/Stern/Types.hs b/tools/stern/src/Stern/Types.hs
index 6f2e43a2729..3fc157ab118 100644
--- a/tools/stern/src/Stern/Types.hs
+++ b/tools/stern/src/Stern/Types.hs
@@ -35,6 +35,7 @@ import Data.Range
 import Galley.Types.Teams
 import Galley.Types.Teams.Intra
 import Imports
+import Wire.API.Team.Member (teamMemberJson)
 
 newtype TeamMemberInfo = TeamMemberInfo {tm :: TeamMember}
 

From fb40c898e41711dc07c3a4c3e6054636fa7e4e28 Mon Sep 17 00:00:00 2001
From: Paolo Capriotti <paolo@capriotti.io>
Date: Mon, 3 Jan 2022 17:05:40 +0100
Subject: [PATCH 44/74] Do not regenerate Swagger doc module if unchanged
 (#2018)

---
 changelog.d/5-internal/brig-faster-doc |  1 +
 services/brig/Setup.hs                 | 26 +++++++++++++++++++++-----
 services/brig/brig.cabal               |  1 +
 services/brig/package.yaml             |  1 +
 4 files changed, 24 insertions(+), 5 deletions(-)
 create mode 100644 changelog.d/5-internal/brig-faster-doc

diff --git a/changelog.d/5-internal/brig-faster-doc b/changelog.d/5-internal/brig-faster-doc
new file mode 100644
index 00000000000..edd39960037
--- /dev/null
+++ b/changelog.d/5-internal/brig-faster-doc
@@ -0,0 +1 @@
+The Swagger documentation module is not regenerated anymore if its content is unchanged
diff --git a/services/brig/Setup.hs b/services/brig/Setup.hs
index b7f084b8ca1..ce0b496ab7c 100644
--- a/services/brig/Setup.hs
+++ b/services/brig/Setup.hs
@@ -1,3 +1,6 @@
+{-# LANGUAGE OverloadedStrings #-}
+{-# LANGUAGE TypeApplications #-}
+
 -- This file is part of the Wire Server implementation.
 --
 -- Copyright (C) 2021 Wire Swiss GmbH <opensource@wire.com>
@@ -15,10 +18,15 @@
 -- You should have received a copy of the GNU Affero General Public License along
 -- with this program. If not, see <https://www.gnu.org/licenses/>.
 
+import Control.Exception
+import Control.Monad
 import Data.Char
 import Data.Foldable
 import qualified Data.Map as Map
 import Data.Maybe
+import Data.Text (Text)
+import qualified Data.Text as Text
+import qualified Data.Text.IO as Text
 import Distribution.Simple
 import Distribution.Simple.BuildPaths
 import Distribution.Simple.LocalBuildInfo
@@ -49,17 +57,25 @@ generateDocs base src = do
   let name = moduleName src
       dest = base </> (moduleName src <> ".hs")
   createDirectoryIfMissing True base
-  putStrLn ("Generating " <> dest <> " ...")
   let out =
-        unlines
-          [ "module Brig.Docs." <> name <> " where",
+        Text.unlines
+          [ "module Brig.Docs." <> Text.pack name <> " where",
             "",
             "import Imports",
             "",
             "contents :: Text",
-            "contents = " ++ show contents
+            "contents = " <> Text.pack (show contents)
           ]
-  writeFile dest out
+  writeFileIfChanged dest out
+
+writeFileIfChanged :: FilePath -> Text -> IO ()
+writeFileIfChanged fp c' = do
+  changed <- handle @IOException (const (pure True)) $ do
+    c <- Text.readFile fp
+    pure $ c /= c'
+  when changed $ do
+    putStrLn ("Generating " <> fp <> " ...")
+    Text.writeFile fp c'
 
 moduleName :: String -> String
 moduleName = go . dropExtension
diff --git a/services/brig/brig.cabal b/services/brig/brig.cabal
index fe097e533ae..dcd60278065 100644
--- a/services/brig/brig.cabal
+++ b/services/brig/brig.cabal
@@ -26,6 +26,7 @@ custom-setup
     , containers
     , directory
     , filepath
+    , text
 
 library
   exposed-modules:
diff --git a/services/brig/package.yaml b/services/brig/package.yaml
index 0f10e5f4b24..b67cac85e5e 100644
--- a/services/brig/package.yaml
+++ b/services/brig/package.yaml
@@ -17,6 +17,7 @@ custom-setup:
     - containers
     - directory
     - filepath
+    - text
 extra-source-files:
   - docs/*
 library:

From 918f988c1bdfc4c0c6b35aec67a342e968f0d0ae Mon Sep 17 00:00:00 2001
From: Paolo Capriotti <paolo@capriotti.io>
Date: Tue, 4 Jan 2022 06:49:52 +0100
Subject: [PATCH 45/74] Simplify `rangedSchema` function (#2017)

---
 changelog.d/5-internal/simplify-ranged-schema |  1 +
 libs/types-common/src/Data/Range.hs           | 10 ++++------
 libs/wire-api/src/Wire/API/Conversation.hs    |  3 +--
 libs/wire-api/src/Wire/API/Team.hs            |  3 +--
 4 files changed, 7 insertions(+), 10 deletions(-)
 create mode 100644 changelog.d/5-internal/simplify-ranged-schema

diff --git a/changelog.d/5-internal/simplify-ranged-schema b/changelog.d/5-internal/simplify-ranged-schema
new file mode 100644
index 00000000000..c6a3e875811
--- /dev/null
+++ b/changelog.d/5-internal/simplify-ranged-schema
@@ -0,0 +1 @@
+`rangedSchema` does not need to be passed singletons explicitly anymore
diff --git a/libs/types-common/src/Data/Range.hs b/libs/types-common/src/Data/Range.hs
index d244a6fa656..6eb80f5de71 100644
--- a/libs/types-common/src/Data/Range.hs
+++ b/libs/types-common/src/Data/Range.hs
@@ -122,14 +122,12 @@ instance (Within a n m, FromJSON a) => FromJSON (Range n m a) where
       msg sn sm = fail (errorMsg (fromSing sn) (fromSing sm) "")
 
 rangedSchema ::
+  forall n m d v w a b.
   (Within a n m, HasRangedSchemaDocModifier d b) =>
-  SNat n ->
-  SNat m ->
   SchemaP d v w a b ->
   SchemaP d v w a (Range n m b)
-rangedSchema sn sm sch = Range <$> untypedRangedSchema (get sn) (get sm) sch
-  where
-    get = toInteger . fromSing
+rangedSchema sch =
+  Range <$> untypedRangedSchema (toInteger (demote @n)) (toInteger (demote @m)) sch
 
 untypedRangedSchema ::
   forall d v w a b.
@@ -181,7 +179,7 @@ instance S.HasSchema d S.Schema => HasRangedSchemaDocModifier d Word32 where ran
 instance S.HasSchema d S.Schema => HasRangedSchemaDocModifier d Word64 where rangedSchemaDocModifier _ = numRangedSchemaDocModifier
 
 instance (Within a n m, ToSchema a, HasRangedSchemaDocModifier NamedSwaggerDoc a) => ToSchema (Range n m a) where
-  schema = fromRange .= rangedSchema sing sing schema
+  schema = fromRange .= rangedSchema schema
 
 instance (Within a n m, Cql a) => Cql (Range n m a) where
   ctype = retag (ctype :: Tagged a ColumnType)
diff --git a/libs/wire-api/src/Wire/API/Conversation.hs b/libs/wire-api/src/Wire/API/Conversation.hs
index 896ac033bf2..36f6cc93dcc 100644
--- a/libs/wire-api/src/Wire/API/Conversation.hs
+++ b/libs/wire-api/src/Wire/API/Conversation.hs
@@ -100,7 +100,6 @@ import Data.Qualified (Qualified (qUnqualified), deprecatedSchema)
 import Data.Range (Range, fromRange, rangedSchema)
 import Data.Schema
 import qualified Data.Set as Set
-import Data.Singletons (sing)
 import Data.String.Conversions (cs)
 import qualified Data.Swagger as S
 import qualified Data.Swagger.Build.Api as Doc
@@ -366,7 +365,7 @@ instance ToSchema ListConversations where
       "ListConversations"
       (description ?~ "A request to list some of a user's conversations, including remote ones. Maximum 1000 qualified conversation IDs")
       $ ListConversations
-        <$> (fromRange . lcQualifiedIds) .= field "qualified_ids" (rangedSchema sing sing (array schema))
+        <$> (fromRange . lcQualifiedIds) .= field "qualified_ids" (rangedSchema (array schema))
 
 data ConversationsResponse = ConversationsResponse
   { crFound :: [Conversation],
diff --git a/libs/wire-api/src/Wire/API/Team.hs b/libs/wire-api/src/Wire/API/Team.hs
index d639b314d06..fda2311e6e1 100644
--- a/libs/wire-api/src/Wire/API/Team.hs
+++ b/libs/wire-api/src/Wire/API/Team.hs
@@ -76,7 +76,6 @@ import Data.Id (TeamId, UserId)
 import Data.Misc (PlainTextPassword (..))
 import Data.Range
 import Data.Schema
-import Data.Singletons (sing)
 import qualified Data.Swagger as S
 import qualified Data.Swagger.Build.Api as Doc
 import Imports
@@ -215,7 +214,7 @@ instance ToSchema NonBindingNewTeam where
       unwrap (NonBindingNewTeam nt) = nt
 
       sch :: ValueSchema SwaggerDoc (Range 1 127 [TeamMember])
-      sch = fromRange .= rangedSchema sing sing (array schema)
+      sch = fromRange .= rangedSchema (array schema)
 
 modelNewNonBindingTeam :: Doc.Model
 modelNewNonBindingTeam = Doc.defineModel "newNonBindingTeam" $ do

From da3800a5ec125337f4647a858db10d3143691ce8 Mon Sep 17 00:00:00 2001
From: Leif Battermann <leif.battermann@gmail.com>
Date: Tue, 4 Jan 2022 11:07:48 +0100
Subject: [PATCH 46/74] SQSERVICES 1011 servantify gally team api (PUT
 /teams/:tid) (#2010)

* ToSchema instances

* change API impl

* update changelog

* error description for the route
---
 changelog.d/5-internal/pr-2008                |  2 +-
 .../wire-api/src/Wire/API/ErrorDescription.hs |  6 ++++++
 .../src/Wire/API/Routes/Public/Galley.hs      | 18 +++++++++++++++++-
 libs/wire-api/src/Wire/API/Team/Member.hs     |  2 +-
 services/galley/src/Galley/API/Public.hs      | 18 ++----------------
 services/galley/src/Galley/API/Teams.hs       | 19 +------------------
 6 files changed, 28 insertions(+), 37 deletions(-)

diff --git a/changelog.d/5-internal/pr-2008 b/changelog.d/5-internal/pr-2008
index a5c36a513b0..a378dfd9c78 100644
--- a/changelog.d/5-internal/pr-2008
+++ b/changelog.d/5-internal/pr-2008
@@ -1 +1 @@
-Servantify Galley Teams API. (#2008)
+Servantify Galley Teams API. (#2008, #2010)
diff --git a/libs/wire-api/src/Wire/API/ErrorDescription.hs b/libs/wire-api/src/Wire/API/ErrorDescription.hs
index 30f7ebf71ba..f6312d19f98 100644
--- a/libs/wire-api/src/Wire/API/ErrorDescription.hs
+++ b/libs/wire-api/src/Wire/API/ErrorDescription.hs
@@ -20,6 +20,7 @@ import Servant.API.Status (KnownStatus, statusVal)
 import Servant.Client.Core
 import Servant.Swagger.Internal
 import Wire.API.Routes.MultiVerb
+import Wire.API.Team.Permission
 
 -- This can be added to an endpoint to document a possible failure
 -- case outside its return type (usually through an exception).
@@ -234,6 +235,11 @@ noIdentity n = ErrorDescription (Text.pack (symbolVal (Proxy @desc)) <> " (code
 
 type OperationDenied = ErrorDescription 403 "operation-denied" "Insufficient permissions"
 
+-- FUTUREWORK(leif): We need this to document possible (operation denied) errors in the servant routes.
+-- Be aware that this is redundant and should be replaced by a more type safe solution in the future.
+type family OperationDeniedError (a :: Perm) :: * where
+  OperationDeniedError 'SetTeamData = ErrorDescription 403 "operation-denied" "Insufficient permissions (missing SetTeamData)"
+
 operationDeniedSpecialized :: String -> OperationDenied
 operationDeniedSpecialized p =
   ErrorDescription $
diff --git a/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs b/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs
index fe3ec2ec6e3..22ed3a43c27 100644
--- a/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs
+++ b/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs
@@ -47,6 +47,7 @@ import Wire.API.ServantProto (Proto, RawProto)
 import Wire.API.Team
 import Wire.API.Team.Conversation
 import Wire.API.Team.Feature
+import Wire.API.Team.Permission (Perm (..))
 
 instance AsHeaders '[ConvId] Conversation Conversation where
   toHeaders c = (I (qUnqualified (cnvQualifiedId c)) :* Nil, c)
@@ -725,7 +726,22 @@ data Api routes = Api
                   TeamId
                   (RespondEmpty 201 "Team ID as `Location` header value")
               ]
-             TeamId
+             TeamId,
+    updateTeam ::
+      routes
+        :- Summary "Update team properties"
+        :> ZUser
+        :> ZConn
+        :> CanThrow NotATeamMember
+        :> CanThrow (OperationDeniedError 'SetTeamData)
+        :> "teams"
+        :> Capture "tid" TeamId
+        :> ReqBody '[JSON] TeamUpdateData
+        :> MultiVerb
+             'PUT
+             '[JSON]
+             '[RespondEmpty 200 "Team updated"]
+             ()
   }
   deriving (Generic)
 
diff --git a/libs/wire-api/src/Wire/API/Team/Member.hs b/libs/wire-api/src/Wire/API/Team/Member.hs
index 9a7cfda570e..600978c6b12 100644
--- a/libs/wire-api/src/Wire/API/Team/Member.hs
+++ b/libs/wire-api/src/Wire/API/Team/Member.hs
@@ -336,7 +336,7 @@ invitedSchema' :: ObjectSchema SwaggerDoc (Maybe (UserId, UTCTimeMillis))
 invitedSchema' = withParser invitedSchema $ \(invby, invat) ->
   case (invby, invat) of
     (Just b, Just a) -> pure $ Just (b, a)
-    (Nothing, Nothing) -> pure $ Nothing
+    (Nothing, Nothing) -> pure Nothing
     _ -> fail "created_by, created_at"
 
 instance ToSchema NewTeamMember where
diff --git a/services/galley/src/Galley/API/Public.hs b/services/galley/src/Galley/API/Public.hs
index 42db3104f91..4ee1c27b97d 100644
--- a/services/galley/src/Galley/API/Public.hs
+++ b/services/galley/src/Galley/API/Public.hs
@@ -188,28 +188,14 @@ servantSitemap =
         GalleyAPI.featureConfigConferenceCallingGet = Features.getFeatureConfig @'Public.WithoutLockStatus @'Public.TeamFeatureConferenceCalling Features.getConferenceCallingInternal,
         GalleyAPI.featureConfigSelfDeletingMessagesGet = Features.getFeatureConfig @'Public.WithLockStatus @'Public.TeamFeatureSelfDeletingMessages Features.getSelfDeletingMessagesInternal,
         GalleyAPI.featureConfigGuestLinksGet = Features.getFeatureConfig @'Public.WithLockStatus @'Public.TeamFeatureGuestLinks Features.getGuestLinkInternal,
-        GalleyAPI.createNonBindingTeam = Teams.createNonBindingTeamH
+        GalleyAPI.createNonBindingTeam = Teams.createNonBindingTeamH,
+        GalleyAPI.updateTeam = Teams.updateTeamH
       }
 
 sitemap :: Routes ApiBuilder (Sem GalleyEffects) ()
 sitemap = do
   -- Team API -----------------------------------------------------------
 
-  put "/teams/:tid" (continue Teams.updateTeamH) $
-    zauthUserId
-      .&. zauthConnId
-      .&. capture "tid"
-      .&. jsonRequest @Public.TeamUpdateData
-      .&. accept "application" "json"
-  document "PUT" "updateTeam" $ do
-    summary "Update team properties"
-    parameter Path "tid" bytes' $
-      description "Team ID"
-    body (ref Public.modelUpdateData) $
-      description "JSON body"
-    errorResponse (Error.errorDescriptionTypeToWai @Error.NotATeamMember)
-    errorResponse (Error.errorDescriptionToWai (Error.operationDenied Public.SetTeamData))
-
   get "/teams" (continue Teams.getManyTeamsH) $
     zauthUserId
       .&. opt (query "ids" ||| query "start")
diff --git a/services/galley/src/Galley/API/Teams.hs b/services/galley/src/Galley/API/Teams.hs
index 34e27ae7fc1..5883ebdb88c 100644
--- a/services/galley/src/Galley/API/Teams.hs
+++ b/services/galley/src/Galley/API/Teams.hs
@@ -326,23 +326,6 @@ updateTeamStatus tid (TeamStatusUpdate newStatus cur) = do
       (_, _) -> throw InvalidTeamStatusUpdate
 
 updateTeamH ::
-  Members
-    '[ Error ActionError,
-       Error NotATeamMember,
-       GundeckAccess,
-       Input UTCTime,
-       TeamStore,
-       WaiRoutes
-     ]
-    r =>
-  UserId ::: ConnId ::: TeamId ::: JsonRequest Public.TeamUpdateData ::: JSON ->
-  Sem r Response
-updateTeamH (zusr ::: zcon ::: tid ::: req ::: _) = do
-  updateData <- fromJsonBody req
-  updateTeam zusr zcon tid updateData
-  pure empty
-
-updateTeam ::
   Members
     '[ Error ActionError,
        Error NotATeamMember,
@@ -356,7 +339,7 @@ updateTeam ::
   TeamId ->
   Public.TeamUpdateData ->
   Sem r ()
-updateTeam zusr zcon tid updateData = do
+updateTeamH zusr zcon tid updateData = do
   zusrMembership <- E.getTeamMember tid zusr
   -- let zothers = map (view userId) membs
   -- Log.debug $

From 81cb9405ee58c79997dfbc830b581c3c353314d4 Mon Sep 17 00:00:00 2001
From: Leif Battermann <leif.battermann@gmail.com>
Date: Tue, 4 Jan 2022 16:46:03 +0100
Subject: [PATCH 47/74] Return specific error when a domain is blocked (#2023)

---
 changelog.d/5-internal/pr-2023       | 1 +
 services/brig/src/Brig/API/Public.hs | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)
 create mode 100644 changelog.d/5-internal/pr-2023

diff --git a/changelog.d/5-internal/pr-2023 b/changelog.d/5-internal/pr-2023
new file mode 100644
index 00000000000..826977a5870
--- /dev/null
+++ b/changelog.d/5-internal/pr-2023
@@ -0,0 +1 @@
+When sending an activation code, the blocked domains are checked before the whitelist. This only affects the wire SaaS staging environment (there is no whitelist configuration in prod, and blocked domains are not applicable to on-prem installations).
diff --git a/services/brig/src/Brig/API/Public.hs b/services/brig/src/Brig/API/Public.hs
index 7bf438b4186..a4685355fa4 100644
--- a/services/brig/src/Brig/API/Public.hs
+++ b/services/brig/src/Brig/API/Public.hs
@@ -999,8 +999,8 @@ sendActivationCodeH req =
 -- docs/reference/user/registration.md {#RefRegistration}
 sendActivationCode :: Public.SendActivationCode -> Handler ()
 sendActivationCode Public.SendActivationCode {..} = do
+  either customerExtensionCheckBlockedDomains (const $ pure ()) saUserKey
   checkWhitelist saUserKey
-  either customerExtensionCheckBlockedDomains (\_ -> pure ()) saUserKey
   API.sendActivationCode saUserKey saLocale saCall !>> sendActCodeError
 
 -- | If the user presents an email address from a blocked domain, throw an error.

From 7cf3b24d89a7a4b64bd7ad8cbfb498a0443df6de Mon Sep 17 00:00:00 2001
From: jschaul <jschaul@users.noreply.github.com>
Date: Tue, 4 Jan 2022 20:38:34 +0100
Subject: [PATCH 48/74] Sftd helm chart: provide a list of all sftd urls over
 http(s) using sftd_disco sidecar process. (#2019)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Related to https://wearezeta.atlassian.net/browse/FS-266.

Implements querying the list of all SFT servers from the sftd's sidecar nginx pod. This is a different take on the above issue and if this list provided by sft servers is made use of; then that makes some of the work introduced in #2012 #2014 #2015 obsolete (sorry 😟 ).

From brig, using the url configured in `setSftStaticUrl`, and calling `/sft_servers_all.json` on that URL, this PR provides a list of all SFT servers available. The list is computed on the SFTD chart itself (using a sftd_disco sidecar container). This has the advantage of allowing brig to be hosted on a separate kubernetes cluster to sftd, and moves the business logic of knowing sftd servers to sftd itself.

From a brig pod on a test cluster:

```
 # cat /etc/wire/brig/conf/brig.yaml | grep sft
  setSftStaticUrl: https://sftd.a.adhoc-testing.wire.link:443
/ # curl -ks https://sftd.a.adhoc-testing.wire.link:443/sft_servers_all.json
{
  "sft_servers_all": [
    "https://sftd.a.adhoc-testing.wire.link/sfts/wire-server-a-sftd-0"
  ]
}
```

Co-authored-by: Marko Dimjašević <marko.dimjasevic@wire.com>
---
 .dockerignore                                 |  1 +
 Makefile                                      |  2 +-
 changelog.d/6-federation/sftd_disco           |  1 +
 .../sftd/templates/configmap-join-call.yaml   |  4 +
 .../sftd/templates/deployment-join-call.yaml  | 16 ++++
 charts/sftd/templates/ingress.yaml            |  4 +
 tools/nginz_disco/Dockerfile                  |  2 +-
 tools/nginz_disco/README.md                   |  4 +-
 tools/sftd_disco/Dockerfile                   |  7 ++
 tools/sftd_disco/Makefile                     |  6 ++
 tools/sftd_disco/README.md                    |  5 ++
 tools/sftd_disco/sftd_disco.sh                | 77 +++++++++++++++++++
 12 files changed, 125 insertions(+), 4 deletions(-)
 create mode 100644 changelog.d/6-federation/sftd_disco
 create mode 100644 tools/sftd_disco/Dockerfile
 create mode 100644 tools/sftd_disco/Makefile
 create mode 100644 tools/sftd_disco/README.md
 create mode 100755 tools/sftd_disco/sftd_disco.sh

diff --git a/.dockerignore b/.dockerignore
index e3606f86bea..f23c963a415 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,5 +1,6 @@
 **/.*
 **/dist
+**/dist-buildah
 **/target
 **/*.aci
 **/*.tgz
diff --git a/Makefile b/Makefile
index 1401d4d4c49..6d54583ecf8 100644
--- a/Makefile
+++ b/Makefile
@@ -8,7 +8,7 @@ DOCKER_TAG            ?= $(USER)
 # default helm chart version must be 0.0.42 for local development (because 42 is the answer to the universe and everything)
 HELM_SEMVER           ?= 0.0.42
 # The list of helm charts needed for integration tests on kubernetes
-CHARTS_INTEGRATION    := wire-server databases-ephemeral fake-aws nginx-ingress-controller nginx-ingress-services wire-server-metrics fluent-bit kibana
+CHARTS_INTEGRATION    := wire-server databases-ephemeral fake-aws nginx-ingress-controller nginx-ingress-services wire-server-metrics fluent-bit kibana sftd
 # The list of helm charts to publish on S3
 # FUTUREWORK: after we "inline local subcharts",
 # (e.g. move charts/brig to charts/wire-server/brig)
diff --git a/changelog.d/6-federation/sftd_disco b/changelog.d/6-federation/sftd_disco
new file mode 100644
index 00000000000..f7754d070a9
--- /dev/null
+++ b/changelog.d/6-federation/sftd_disco
@@ -0,0 +1 @@
+SFTD chart: provide a /sft_servers_all.json url that can be used by brig to populate /calls/config/v2
diff --git a/charts/sftd/templates/configmap-join-call.yaml b/charts/sftd/templates/configmap-join-call.yaml
index fd4ec86717a..523d741a2b5 100644
--- a/charts/sftd/templates/configmap-join-call.yaml
+++ b/charts/sftd/templates/configmap-join-call.yaml
@@ -17,4 +17,8 @@ data:
         proxy_pass http://$1.{{ include "sftd.fullname" . }}.${POD_NAMESPACE}.svc.cluster.local:8585/$2;
       }
 
+      location ~ ^/sft_servers_all.json$ {
+        root /etc/wire/sftd-disco/;
+      }
+
     }
diff --git a/charts/sftd/templates/deployment-join-call.yaml b/charts/sftd/templates/deployment-join-call.yaml
index 0c247f7e6f7..3574bf04815 100644
--- a/charts/sftd/templates/deployment-join-call.yaml
+++ b/charts/sftd/templates/deployment-join-call.yaml
@@ -26,7 +26,20 @@ spec:
         - name: nginx-config
           configMap:
             name: {{ include "sftd.fullname" . }}-join-call
+        - name: sftd-disco
+          emptyDir: {}
       containers:
+        - name: sftd-disco
+          image: quay.io/wire/sftd_disco:wip-2 # TODO configure + version
+          volumeMounts:
+          - name: sftd-disco
+            mountPath: /etc/wire/sftd-disco
+            readOnly: false
+          command:
+            - "/bin/sh"
+            - "-c"
+            - |
+              /usr/bin/sftd_disco.sh _sft._tcp.{{ include "sftd.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local
         - name: nginx
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
@@ -50,6 +63,9 @@ spec:
             - mountPath: /etc/nginx/conf.d/default.conf.template
               name: nginx-config
               subPath: default.conf.template
+            - name: sftd-disco
+              mountPath: /etc/wire/sftd-disco
+              readOnly: true
           env:
             - name: POD_NAMESPACE
               valueFrom:
diff --git a/charts/sftd/templates/ingress.yaml b/charts/sftd/templates/ingress.yaml
index a14c53981a6..9bf7958fa0b 100644
--- a/charts/sftd/templates/ingress.yaml
+++ b/charts/sftd/templates/ingress.yaml
@@ -25,3 +25,7 @@ spec:
             backend:
               serviceName: "{{ include "sftd.fullname" . }}-join-call"
               servicePort: http
+          - path: /sft_servers_all.json
+            backend:
+              serviceName: "{{ include "sftd.fullname" . }}-join-call"
+              servicePort: http
diff --git a/tools/nginz_disco/Dockerfile b/tools/nginz_disco/Dockerfile
index 9d15426f594..67c5a5b1ee4 100644
--- a/tools/nginz_disco/Dockerfile
+++ b/tools/nginz_disco/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.12.3
+FROM alpine:3.15.0
 
 RUN apk add --no-cache curl bash openssl bind-tools
 
diff --git a/tools/nginz_disco/README.md b/tools/nginz_disco/README.md
index 5571c7a1a38..33fa7f108db 100644
--- a/tools/nginz_disco/README.md
+++ b/tools/nginz_disco/README.md
@@ -1,6 +1,6 @@
 # nginz-disco
 
-Due to nginx not supporting DNS names for its list of upstream servers (unless you pay extra), the nginz-disco container is a simple bash script to do DNS lookups and write the resulting IPs to a file. Nginz reloads on changes to this file. 
+Due to nginx not supporting DNS names for its list of upstream servers (unless you pay extra), the nginz-disco container is a simple bash script to do DNS lookups and write the resulting IPs to a file. Nginz reloads on changes to this file.
 
-This is useful as a sidecar container to nginz in kubernetes. See also [wire-server-deploy/nginz](https://github.com/wireapp/wire-server-deploy/charts/nginz/) <!-- todo: this link is broken >
+This is useful as a sidecar container to nginz in kubernetes. See also [the nginz helm chart](https://github.com/wireapp/wire-server/tree/develop/charts/nginz/)
 
diff --git a/tools/sftd_disco/Dockerfile b/tools/sftd_disco/Dockerfile
new file mode 100644
index 00000000000..0ece592c57a
--- /dev/null
+++ b/tools/sftd_disco/Dockerfile
@@ -0,0 +1,7 @@
+FROM alpine:3.15.0
+
+RUN apk add --no-cache curl bash openssl bind-tools jq
+
+COPY tools/sftd_disco/sftd_disco.sh /usr/bin/sftd_disco.sh
+
+ENTRYPOINT ["/usr/bin/sftd_disco.sh"]
diff --git a/tools/sftd_disco/Makefile b/tools/sftd_disco/Makefile
new file mode 100644
index 00000000000..78b2520b526
--- /dev/null
+++ b/tools/sftd_disco/Makefile
@@ -0,0 +1,6 @@
+.PHONY: docker
+
+DOCKER_TAG = wip-2
+
+docker:
+	docker build -t quay.io/wire/sftd_disco:$(DOCKER_TAG) -f Dockerfile ../..
diff --git a/tools/sftd_disco/README.md b/tools/sftd_disco/README.md
new file mode 100644
index 00000000000..e78f7679ebe
--- /dev/null
+++ b/tools/sftd_disco/README.md
@@ -0,0 +1,5 @@
+# sftd-disco
+
+This DISCOvery docker image/bash script converts the result from an SRV DNS lookup of a kubernetes service to a file which can be served by nginx or similar.
+
+This is useful as a sidecar container to the sftd chart in kubernetes to expose the full list of running sftd servers in cases where sftd runs independently from other backend services. See also [the sftd helm chart](https://github.com/wireapp/wire-server/tree/develop/charts/sftd/)
diff --git a/tools/sftd_disco/sftd_disco.sh b/tools/sftd_disco/sftd_disco.sh
new file mode 100755
index 00000000000..63a603df963
--- /dev/null
+++ b/tools/sftd_disco/sftd_disco.sh
@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+
+set -eo pipefail
+exec 2>&1
+
+# Assumes /etc/wire/sftd-disco/ directory exists.
+
+USAGE="example usage: $0 _sft._tcp.wire-server-sftd.wire.svc.cluster.local"
+srv_name=${1?$USAGE}
+
+old="/etc/wire/sftd-disco/sft_servers_all.json"
+new="${old}.new"
+
+function valid_entry() {
+    local line=$1
+    # TODO sanity check that this is real dig output
+    return 0
+}
+
+function valid_url() {
+    local url=$1
+    #TODO basic sanity check
+    return 0
+}
+
+# for a given SRV record
+# 1. lookup the record
+# 2. for each entry: extract host and port and call 'curl host:port/sft/url'
+# 4. save the resulting URLs as a json array to a file
+# this file can then be served from nginx running besides sft
+function upstream() {
+    name=$1
+    port=${2:-'8585'}
+    entries=$(dig +short +retries=3 +search SRV ${name} | sort)
+    unset servers
+    comma=""
+    IFS=$'\n'
+    for entry in ${entries[@]}; do
+        if valid_entry "$entry"; then
+            sft_host_port=$(echo "$entry" | awk '{print $4":"$3}')
+            sft_url=$(curl -s http://$sft_host_port/sft/url | xargs)
+            if valid_url "$sft_url"; then
+                servers+=(${comma}'"'${sft_url}'"')
+                comma=","
+            fi
+        fi
+    done
+    if [ -n "$servers" ]; then
+        echo '{"sft_servers_all": ['${servers[@]}']}' | jq >${new}
+    else
+        printf "" >>${new}
+    fi
+}
+
+function routing_disco() {
+    srv_name=$1
+    ivl=$(echo | awk '{ srand(); printf("%f", 2.5 + rand() * 1.5) }')
+
+    [[ -f $old ]] || touch -d "1970-01-01" $old
+
+    echo "" >${new}
+    upstream "$srv_name"
+
+    diff -q $old $new || {
+        echo upstream change found, replacing $old with $new
+        mv $new $old
+    }
+
+    rm -f $new
+
+    echo done, sleeping $ivl
+    sleep $ivl
+}
+
+while true; do
+    routing_disco $srv_name
+done

From 7f3fcf27e985cfc23e9f26cb31a1be4065e78412 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marko=20Dimja=C5=A1evi=C4=87?= <marko.dimjasevic@wire.com>
Date: Wed, 5 Jan 2022 10:17:55 +0100
Subject: [PATCH 49/74] Introduce logging of discovered IPv4 addresses

---
 services/brig/brig.cabal                     |  3 ++-
 services/brig/package.yaml                   |  1 +
 services/brig/src/Brig/Calling.hs            |  4 +++-
 services/brig/test/unit/Test/Brig/Calling.hs | 10 +++++++++-
 4 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/services/brig/brig.cabal b/services/brig/brig.cabal
index dcd60278065..c615cedc1ca 100644
--- a/services/brig/brig.cabal
+++ b/services/brig/brig.cabal
@@ -4,7 +4,7 @@ cabal-version: 2.0
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: addf4b080e564149f44c6cdb33c824734aa68cc9ff021f41268938902e2958b0
+-- hash: 2f8a3d719633015dac9204d43e0b4c79ce5b21b022cd9d4cce3868feea9460e8
 
 name:           brig
 version:        2.0
@@ -506,6 +506,7 @@ test-suite brig-tests
     , polysemy-wire-zoo
     , retry
     , servant-client-core
+    , string-conversions
     , tasty
     , tasty-hunit
     , tasty-quickcheck
diff --git a/services/brig/package.yaml b/services/brig/package.yaml
index b67cac85e5e..bcc149f1b93 100644
--- a/services/brig/package.yaml
+++ b/services/brig/package.yaml
@@ -169,6 +169,7 @@ tests:
     - polysemy-wire-zoo
     - retry
     - servant-client-core
+    - string-conversions
     - tasty
     - tasty-hunit
     - tasty-quickcheck
diff --git a/services/brig/src/Brig/Calling.hs b/services/brig/src/Brig/Calling.hs
index 97537d82cbe..8abea5ebdf8 100644
--- a/services/brig/src/Brig/Calling.hs
+++ b/services/brig/src/Brig/Calling.hs
@@ -140,7 +140,9 @@ discoverSFTServers domain =
 discoverSFTServersAll :: Members [DNSLookup, TinyLog] r => DNS.Domain -> Sem r (Maybe [IPv4])
 discoverSFTServersAll domain =
   lookupA domain >>= \case
-    AIPv4s ips -> pure . Just $ ips
+    AIPv4s ips -> do
+      info (Log.msg ("Found the following IP addresses for SFT servers" :: ByteString) . Log.field "addresses" (show ips))
+      pure . Just $ ips
     AResponseError e -> do
       err (Log.msg ("DNS Lookup failed for SFT Discovery" :: ByteString) . Log.field "Error" (show e))
       pure Nothing
diff --git a/services/brig/test/unit/Test/Brig/Calling.hs b/services/brig/test/unit/Test/Brig/Calling.hs
index 192262f7cd4..6a27dcc2afd 100644
--- a/services/brig/test/unit/Test/Brig/Calling.hs
+++ b/services/brig/test/unit/Test/Brig/Calling.hs
@@ -27,6 +27,7 @@ import Data.List.NonEmpty (NonEmpty (..))
 import qualified Data.List.NonEmpty as NonEmpty
 import Data.Range
 import qualified Data.Set as Set
+import Data.String.Conversions
 import Imports
 import Network.DNS
 import Polysemy
@@ -264,7 +265,14 @@ testSFTDiscoverAWhenAvailable = do
     =<< ( runM . recordLogs logRecorder . runFakeDNSLookup fakeDNSEnv $
             discoverSFTServersAll "foo.example.com"
         )
-  assertEqual "nothing should be logged" []
+  assertEqual
+    "should report discovered IP addresses"
+    [ ( Log.Info,
+        "Found the following IP addresses for SFT servers, addresses="
+          <> (cs . show $ returnedEntries)
+          <> "\n"
+      )
+    ]
     =<< readIORef (recordedLogs logRecorder)
 
 testSFTDiscoverAWhenDNSFails :: IO ()

From 401c5a387fbae329217a6cf431621326207427ab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marko=20Dimja=C5=A1evi=C4=87?= <marko.dimjasevic@wire.com>
Date: Wed, 5 Jan 2022 10:19:30 +0100
Subject: [PATCH 50/74] Use plain HTTP instead of HTTPS

- This is for making an HTTP IPv4-based request to an SFT server to get
a URL that clients can use
---
 services/brig/src/Brig/Effects/SFT.hs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/brig/src/Brig/Effects/SFT.hs b/services/brig/src/Brig/Effects/SFT.hs
index 2297a7a1df1..0b0c7a20b0d 100644
--- a/services/brig/src/Brig/Effects/SFT.hs
+++ b/services/brig/src/Brig/Effects/SFT.hs
@@ -44,7 +44,7 @@ interpretSFT httpManager = interpret $ \(SFTGetClientUrl ipAddr port) -> do
   let req =
         parseRequest_ $
           mconcat
-            [ "GET https://",
+            [ "GET http://",
               show ipAddr,
               ":",
               show . portNumber $ port,

From 424e5fdc62f4a8aa5f0ac7eb1c9c3b81cb52cdb8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marko=20Dimja=C5=A1evi=C4=87?= <marko.dimjasevic@wire.com>
Date: Wed, 5 Jan 2022 13:44:24 +0100
Subject: [PATCH 51/74] Add a proper integration test for sft_servers_all

---
 services/brig/brig.integration.yaml           |  2 +-
 services/brig/test/integration/API/Calling.hs | 22 +++++++++++++++++--
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/services/brig/brig.integration.yaml b/services/brig/brig.integration.yaml
index 07175fdd7be..b658be1135b 100644
--- a/services/brig/brig.integration.yaml
+++ b/services/brig/brig.integration.yaml
@@ -182,7 +182,7 @@ optSettings:
   # to be added to the CI environment
   setSftLookup:
     domain: sftd.integration-tests.zinfra.io
-    port: 443
+    port: 80
     isTestingEnvironment: true
 
 logLevel: Warn
diff --git a/services/brig/test/integration/API/Calling.hs b/services/brig/test/integration/API/Calling.hs
index 7b06963fdab..25e05adfb9b 100644
--- a/services/brig/test/integration/API/Calling.hs
+++ b/services/brig/test/integration/API/Calling.hs
@@ -54,8 +54,10 @@ tests m b opts turn turnV2 = do
             test m "multiple servers /calls/config - 200" . withTurnFile turn $ testCallsConfigMultiple b,
             test m "multiple servers /calls/config/v2 - 200" . withTurnFile turnV2 $ testCallsConfigMultipleV2 b
           ],
-        testGroup "sft" $
+        testGroup
+          "sft"
           [ test m "SFT servers /calls/config/v2 - 200" $ testSFT b opts,
+            test m "SFT servers all /calls/config/v2 - 200" $ testSFTServersAll b opts,
             test m "SFT servers static URI - 200" $ testSFTStatic b opts
           ]
       ]
@@ -122,7 +124,23 @@ testSFT b opts = do
         "when SFT discovery is enabled, sft_servers should be returned"
         (Set.fromList [sftServer server1, sftServer server2])
         (Set.fromList $ maybe [] NonEmpty.toList $ cfg1 ^. rtcConfSftServers)
-      void . for (cfg1 ^. rtcConfSftServersAll) $ \allServers -> do
+
+testSFTServersAll :: Brig -> Opts.Opts -> Http ()
+testSFTServersAll b opts = do
+  uid <- userId <$> randomUser b
+  let lookupSettings = Opts.SFTLookup (Opts.LookupDomain "sftd.integration-tests.zinfra.io") (Port 80) True
+  let newOptSettings = (Opts.optSettings opts) {Opts.setSftLookup = Just lookupSettings}
+  let opts' =
+        opts
+          { Opts.sft = Just $ Opts.SFTOptions "integration-tests.zinfra.io" Nothing (Just 0.001) Nothing,
+            Opts.optSettings = newOptSettings
+          }
+  withSettingsOverrides opts' $ do
+    cfg1 <- retryWhileN 10 (isNothing . view rtcConfSftServersAll) (getTurnConfigurationV2 uid b)
+    -- These values are controlled by https://github.com/zinfra/cailleach/blob/459591512a02333e62abebe28656874cab3b4380/environments/dns-integration-tests
+    liftIO $ case cfg1 ^. rtcConfSftServersAll of
+      Nothing -> assertFailure "sft_servers_all not configured"
+      Just allServers -> do
         let Right clientUrl = mkHttpsUrl =<< first show (parseURI laxURIParserOptions "https://sft01.avs.zinfra.io")
         assertEqual
           "when SFT discovery is enabled and SFT lookup configured, sft_servers_all should be returned"

From 5bcdddb878c5d2173bfd07877541b09635f9a699 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marko=20Dimja=C5=A1evi=C4=87?= <marko.dimjasevic@wire.com>
Date: Wed, 5 Jan 2022 13:48:51 +0100
Subject: [PATCH 52/74] Add a changelog

---
 changelog.d/6-federation/sft-fix-ipv4-http | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 changelog.d/6-federation/sft-fix-ipv4-http

diff --git a/changelog.d/6-federation/sft-fix-ipv4-http b/changelog.d/6-federation/sft-fix-ipv4-http
new file mode 100644
index 00000000000..bc0be239d8f
--- /dev/null
+++ b/changelog.d/6-federation/sft-fix-ipv4-http
@@ -0,0 +1 @@
+Allow making HTTP-only requests to SFTs via an IPv4 address

From 425ee235e1bdcad21aae9e3f1e844bd5c06fec56 Mon Sep 17 00:00:00 2001
From: Akshay Mankar <akshay@wire.com>
Date: Wed, 5 Jan 2022 14:32:50 +0100
Subject: [PATCH 53/74] charts/brig: Make setDefaultLocale configurable (#2025)

---
 changelog.d/2-features/helm-brig-setDefaultLocale | 1 +
 charts/brig/templates/configmap.yaml              | 2 +-
 charts/brig/values.yaml                           | 1 +
 3 files changed, 3 insertions(+), 1 deletion(-)
 create mode 100644 changelog.d/2-features/helm-brig-setDefaultLocale

diff --git a/changelog.d/2-features/helm-brig-setDefaultLocale b/changelog.d/2-features/helm-brig-setDefaultLocale
new file mode 100644
index 00000000000..7fcdf370267
--- /dev/null
+++ b/changelog.d/2-features/helm-brig-setDefaultLocale
@@ -0,0 +1 @@
+Allow configuring setDefaultLocale in brig using helm chart
\ No newline at end of file
diff --git a/charts/brig/templates/configmap.yaml b/charts/brig/templates/configmap.yaml
index 2f7a0be6735..ead9b23f7f9 100644
--- a/charts/brig/templates/configmap.yaml
+++ b/charts/brig/templates/configmap.yaml
@@ -204,7 +204,7 @@ data:
         suspendTimeout: {{ .setSuspendInactiveUsers.suspendTimeout }}
       {{- end }}
       setRichInfoLimit: {{ .setRichInfoLimit }}
-      setDefaultLocale: en
+      setDefaultLocale: {{ .setDefaultLocale }}
       setMaxTeamSize: {{ .setMaxTeamSize }}
       setMaxConvSize: {{ .setMaxConvSize }}
       setEmailVisibility: {{ .setEmailVisibility }}
diff --git a/charts/brig/values.yaml b/charts/brig/values.yaml
index e609dbd00e4..05616c32493 100644
--- a/charts/brig/values.yaml
+++ b/charts/brig/values.yaml
@@ -53,6 +53,7 @@ config:
     legalholdUserTokenTimeout: 4838400
     legalholdAccessTokenTimeout: 900
   optSettings:
+    setDefaultLocale: en
     setActivationTimeout: 1209600
     setTeamInvitationTimeout: 1814400
     setUserMaxConnections: 1000

From be24d660286c43daff29bbc59b5289bda104b60c Mon Sep 17 00:00:00 2001
From: Leif Battermann <leif.battermann@gmail.com>
Date: Thu, 6 Jan 2022 16:25:05 +0100
Subject: [PATCH 54/74] SQSERVICES 1011 Servantify Gally Team API (GET /teams)
 (#2027)

Co-authored-by: Matthias Fischmann <mf@zerobuzz.net>
---
 changelog.d/1-api-changes/pr-2027             |  1 +
 changelog.d/5-internal/pr-2008                |  2 +-
 .../src/Wire/API/Routes/Public/Galley.hs      | 10 ++++++-
 services/galley/src/Galley/API/Public.hs      | 22 ++------------
 services/galley/src/Galley/API/Teams.hs       | 29 +++++++++++--------
 services/galley/test/integration/API/Teams.hs | 29 +++++++++++++++++--
 services/galley/test/integration/API/Util.hs  |  7 +++--
 7 files changed, 60 insertions(+), 40 deletions(-)
 create mode 100644 changelog.d/1-api-changes/pr-2027

diff --git a/changelog.d/1-api-changes/pr-2027 b/changelog.d/1-api-changes/pr-2027
new file mode 100644
index 00000000000..4c7f70a85f5
--- /dev/null
+++ b/changelog.d/1-api-changes/pr-2027
@@ -0,0 +1 @@
+The deprecated endpoint `GET /teams` now ignores query parameters `ids`, `start`
diff --git a/changelog.d/5-internal/pr-2008 b/changelog.d/5-internal/pr-2008
index a378dfd9c78..49afa225615 100644
--- a/changelog.d/5-internal/pr-2008
+++ b/changelog.d/5-internal/pr-2008
@@ -1 +1 @@
-Servantify Galley Teams API. (#2008, #2010)
+Servantify Galley Teams API. (#2008, #2010, #2027)
diff --git a/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs b/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs
index 22ed3a43c27..5aa972b25df 100644
--- a/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs
+++ b/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs
@@ -49,6 +49,8 @@ import Wire.API.Team.Conversation
 import Wire.API.Team.Feature
 import Wire.API.Team.Permission (Perm (..))
 
+-- import Wire.API.Team.Permission (Perm (..))
+
 instance AsHeaders '[ConvId] Conversation Conversation where
   toHeaders c = (I (qUnqualified (cnvQualifiedId c)) :* Nil, c)
   fromHeaders = snd
@@ -741,7 +743,13 @@ data Api routes = Api
              'PUT
              '[JSON]
              '[RespondEmpty 200 "Team updated"]
-             ()
+             (),
+    getTeams ::
+      routes
+        :- Summary "Get teams (deprecated); use `GET /teams/:tid`"
+        :> ZUser
+        :> "teams"
+        :> Get '[JSON] TeamList
   }
   deriving (Generic)
 
diff --git a/services/galley/src/Galley/API/Public.hs b/services/galley/src/Galley/API/Public.hs
index 4ee1c27b97d..d92059d6bcb 100644
--- a/services/galley/src/Galley/API/Public.hs
+++ b/services/galley/src/Galley/API/Public.hs
@@ -189,32 +189,14 @@ servantSitemap =
         GalleyAPI.featureConfigSelfDeletingMessagesGet = Features.getFeatureConfig @'Public.WithLockStatus @'Public.TeamFeatureSelfDeletingMessages Features.getSelfDeletingMessagesInternal,
         GalleyAPI.featureConfigGuestLinksGet = Features.getFeatureConfig @'Public.WithLockStatus @'Public.TeamFeatureGuestLinks Features.getGuestLinkInternal,
         GalleyAPI.createNonBindingTeam = Teams.createNonBindingTeamH,
-        GalleyAPI.updateTeam = Teams.updateTeamH
+        GalleyAPI.updateTeam = Teams.updateTeamH,
+        GalleyAPI.getTeams = Teams.getManyTeams
       }
 
 sitemap :: Routes ApiBuilder (Sem GalleyEffects) ()
 sitemap = do
   -- Team API -----------------------------------------------------------
 
-  get "/teams" (continue Teams.getManyTeamsH) $
-    zauthUserId
-      .&. opt (query "ids" ||| query "start")
-      .&. def (unsafeRange 100) (query "size")
-      .&. accept "application" "json"
-  document "GET" "getManyTeams" $ do
-    parameter Query "ids" (array string') $ do
-      optional
-      description "At most 32 team IDs per request. Mutually exclusive with `start`."
-    parameter Query "start" string' $ do
-      optional
-      description "Team ID to start from (exclusive). Mutually exclusive with `ids`."
-    parameter Query "size" (int32Between 1 100) $ do
-      optional
-      description "Max. number of teams to return"
-    summary "Get teams"
-    returns (ref Public.modelTeamList)
-    response 200 "Teams list" end
-
   get "/teams/:tid" (continue Teams.getTeamH) $
     zauthUserId
       .&. capture "tid"
diff --git a/services/galley/src/Galley/API/Teams.hs b/services/galley/src/Galley/API/Teams.hs
index 5883ebdb88c..4ecb0b6020d 100644
--- a/services/galley/src/Galley/API/Teams.hs
+++ b/services/galley/src/Galley/API/Teams.hs
@@ -25,7 +25,7 @@ module Galley.API.Teams
     getTeamNameInternalH,
     getBindingTeamIdH,
     getBindingTeamMembersH,
-    getManyTeamsH,
+    getManyTeams,
     deleteTeamH,
     uncheckedDeleteTeam,
     addTeamMemberH,
@@ -73,6 +73,7 @@ import Data.List1 (list1)
 import qualified Data.Map as Map
 import qualified Data.Map.Strict as M
 import Data.Misc (HttpsUrl, mkHttpsUrl)
+import Data.Proxy
 import Data.Qualified
 import Data.Range as Range
 import qualified Data.Set as Set
@@ -170,21 +171,25 @@ getTeamNameInternalH (tid ::: _) =
 getTeamNameInternal :: Member TeamStore r => TeamId -> Sem r (Maybe TeamName)
 getTeamNameInternal = fmap (fmap TeamName) . E.getTeamName
 
-getManyTeamsH ::
-  (Members '[TeamStore, Queue DeleteItem, ListItems LegacyPaging TeamId] r) =>
-  UserId ::: Maybe (Either (Range 1 32 (List TeamId)) TeamId) ::: Range 1 100 Int32 ::: JSON ->
-  Sem r Response
-getManyTeamsH (zusr ::: range ::: size ::: _) =
-  json <$> getManyTeams zusr range size
-
+-- | DEPRECATED.
+--
+-- The endpoint was designed to query non-binding teams. However, non-binding teams is a feature
+-- that has never been adopted by clients, but the endpoint also returns the binding team of a user and it is
+-- possible that this is being used by a client, even though unlikely.
+--
+-- The following functionality has been changed: query parameters will be ignored, which has the effect
+-- that regardless of the parameters the response will always contain the binding team of the user if
+-- it exists. Even though they are ignored, the use of query parameters will not result in an error.
+--
+-- (If you want to be pedantic, the `size` parameter is still honored: its allowed range is
+-- between 1 and 100, and that will always be an upper bound of the result set of size 0 or
+-- one.)
 getManyTeams ::
   (Members '[TeamStore, Queue DeleteItem, ListItems LegacyPaging TeamId] r) =>
   UserId ->
-  Maybe (Either (Range 1 32 (List TeamId)) TeamId) ->
-  Range 1 100 Int32 ->
   Sem r Public.TeamList
-getManyTeams zusr range size =
-  withTeamIds zusr range size $ \more ids -> do
+getManyTeams zusr =
+  withTeamIds zusr Nothing (toRange (Proxy @100)) $ \more ids -> do
     teams <- mapM (lookupTeam zusr) ids
     pure (Public.newTeamList (catMaybes teams) more)
 
diff --git a/services/galley/test/integration/API/Teams.hs b/services/galley/test/integration/API/Teams.hs
index 2e0890f7c4a..25c5d03f4a3 100644
--- a/services/galley/test/integration/API/Teams.hs
+++ b/services/galley/test/integration/API/Teams.hs
@@ -83,7 +83,8 @@ tests :: IO TestSetup -> TestTree
 tests s =
   testGroup "Teams API" $
     [ test s "create team" testCreateTeam,
-      test s "create multiple binding teams fail" testCreateMulitpleBindingTeams,
+      test s "GET /teams (deprecated)" testGetTeams,
+      test s "create multiple binding teams fail" testCreateMultipleBindingTeams,
       test s "create binding team with currency" testCreateBindingTeamWithCurrency,
       test s "create team with members" testCreateTeamWithMembers,
       testGroup "List Team Members" $
@@ -164,8 +165,30 @@ testCreateTeam = do
         e ^. eventData @?= Just (EdTeamCreate team)
       void $ WS.assertSuccess eventChecks
 
-testCreateMulitpleBindingTeams :: TestM ()
-testCreateMulitpleBindingTeams = do
+testGetTeams :: TestM ()
+testGetTeams = do
+  owner <- Util.randomUser
+  Util.getTeams owner [] >>= checkTeamList Nothing
+  tid <- Util.createBindingTeamInternal "foo" owner <* assertQueue "create team" tActivate
+  wrongTid <- (Util.randomUser >>= Util.createBindingTeamInternal "foobar") <* assertQueue "create team" tActivate
+  Util.getTeams owner [] >>= checkTeamList (Just tid)
+  Util.getTeams owner [("size", Just "1")] >>= checkTeamList (Just tid)
+  Util.getTeams owner [("ids", Just $ toByteString' tid)] >>= checkTeamList (Just tid)
+  Util.getTeams owner [("ids", Just $ toByteString' tid <> "," <> toByteString' wrongTid)] >>= checkTeamList (Just tid)
+  -- these two queries do not yield responses that are equivalent to the old wai route API
+  Util.getTeams owner [("ids", Just $ toByteString' wrongTid)] >>= checkTeamList (Just tid)
+  Util.getTeams owner [("start", Just $ toByteString' tid)] >>= checkTeamList (Just tid)
+  where
+    checkTeamList :: Maybe TeamId -> TeamList -> TestM ()
+    checkTeamList mbTid tl = liftIO $ do
+      let teams = tl ^. teamListTeams
+      assertEqual "teamListHasMore" False (tl ^. teamListHasMore)
+      case mbTid of
+        Just tid -> assertEqual "teamId" tid (Imports.head teams ^. teamId)
+        Nothing -> assertEqual "teams size" 0 (length teams)
+
+testCreateMultipleBindingTeams :: TestM ()
+testCreateMultipleBindingTeams = do
   g <- view tsGalley
   owner <- Util.randomUser
   _ <- Util.createBindingTeamInternal "foo" owner
diff --git a/services/galley/test/integration/API/Util.hs b/services/galley/test/integration/API/Util.hs
index 3a767e13e9a..f6f7f401d28 100644
--- a/services/galley/test/integration/API/Util.hs
+++ b/services/galley/test/integration/API/Util.hs
@@ -149,7 +149,7 @@ symmPermissions p = let s = Set.fromList p in fromJust (newPermissions s s)
 createBindingTeam :: HasCallStack => TestM (UserId, TeamId)
 createBindingTeam = do
   ownerid <- randomTeamCreator
-  teams <- getTeams ownerid
+  teams <- getTeams ownerid []
   let [team] = view teamListTeams teams
   let tid = view teamId team
   SQS.assertQueue "create team" SQS.tActivate
@@ -176,13 +176,14 @@ createBindingTeamWithQualifiedMembers num = do
   (tid, owner, users) <- createBindingTeamWithMembers num
   pure (tid, Qualified owner localDomain, map (`Qualified` localDomain) users)
 
-getTeams :: UserId -> TestM TeamList
-getTeams u = do
+getTeams :: UserId -> [(ByteString, Maybe ByteString)] -> TestM TeamList
+getTeams u queryItems = do
   g <- view tsGalley
   r <-
     get
       ( g
           . paths ["teams"]
+          . query queryItems
           . zUser u
           . zConn "conn"
           . zType "access"

From 8ba383c0cb759b0a4b0d8f9b029c335f4f3acda3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marko=20Dimja=C5=A1evi=C4=87?= <marko.dimjasevic@wire.com>
Date: Mon, 10 Jan 2022 10:01:44 +0100
Subject: [PATCH 55/74] [FS-266] Replace IPv4-HTTP-only Approach to SFT Server
 Lookup with /sft_servers_all.json (#2030)

* Generalize getRandomSFTServers function
* Use SFTs provided at GET /sft_servers_all.json
* Polysemyize newConfig
* Fix how SFT environments are constructed
- This fixes the logic of how values around the sft_servers_all feature
  are computed. Now it only depends on either the SFT static URL or the
  SFT environment (the "sft" object in Brig's configmap.yaml).
- Also promote an SFT static URL integration into several unit tests
that provide better coverage
* Clean up helm charts and integration test configuration
---
 .../6-federation/sft-replace-ipv4-w-disco     |   1 +
 charts/brig/templates/configmap.yaml          |  10 -
 libs/dns-util/dns-util.cabal                  |   3 +-
 libs/dns-util/src/Wire/Network/DNS/A.hs       |  32 ----
 libs/dns-util/src/Wire/Network/DNS/Effect.hs  |  21 +-
 libs/wire-api/src/Wire/API/Call/Config.hs     |   2 +-
 .../golden/Test/Wire/API/Golden/Generated.hs  |   3 +-
 .../Golden/Generated/RTCConfiguration_user.hs |  42 ++++
 .../testObject_RTCConfiguration_user_7.json   |  22 +++
 services/brig/brig.cabal                      |   8 +-
 services/brig/brig.integration.yaml           |   6 -
 services/brig/package.yaml                    |   6 +-
 services/brig/src/Brig/App.hs                 |   2 +-
 services/brig/src/Brig/Calling.hs             |  38 ++--
 services/brig/src/Brig/Calling/API.hs         |  88 +++++----
 services/brig/src/Brig/Effects/SFT.hs         | 101 ++++++----
 services/brig/src/Brig/Options.hs             |  40 +---
 services/brig/test/integration/API/Calling.hs |  44 +----
 services/brig/test/unit/Test/Brig/Calling.hs  | 179 ++++++++++++------
 19 files changed, 329 insertions(+), 319 deletions(-)
 create mode 100644 changelog.d/6-federation/sft-replace-ipv4-w-disco
 delete mode 100644 libs/dns-util/src/Wire/Network/DNS/A.hs
 create mode 100644 libs/wire-api/test/golden/testObject_RTCConfiguration_user_7.json

diff --git a/changelog.d/6-federation/sft-replace-ipv4-w-disco b/changelog.d/6-federation/sft-replace-ipv4-w-disco
new file mode 100644
index 00000000000..569d5284c7c
--- /dev/null
+++ b/changelog.d/6-federation/sft-replace-ipv4-w-disco
@@ -0,0 +1 @@
+Replace IPv4-HTTP-only Approach to SFT Server Lookup with /sft_servers_all.json
diff --git a/charts/brig/templates/configmap.yaml b/charts/brig/templates/configmap.yaml
index ead9b23f7f9..a127f33559c 100644
--- a/charts/brig/templates/configmap.yaml
+++ b/charts/brig/templates/configmap.yaml
@@ -228,15 +228,5 @@ data:
       {{- if .setSftStaticUrl }}
       setSftStaticUrl: {{ .setSftStaticUrl }}
       {{- end }}
-      {{- if .setSftLookup }}
-      {{- with .setSftLookup }}
-      setSftLookup:
-        domain: {{ required "Missing value: .setSftLookup.domain" .domain }}
-        port: {{ required "Missing value: .setSftLookup.port" .port }}
-        {{- if .isTestingEnvironment }}
-        isTestingEnvironment: {{ .isTestingEnvironment }}
-        {{- end }}
-      {{- end }}
-      {{- end }}
     {{- end }}
   {{- end }}
diff --git a/libs/dns-util/dns-util.cabal b/libs/dns-util/dns-util.cabal
index 63bc4a8e470..e74687b6ab4 100644
--- a/libs/dns-util/dns-util.cabal
+++ b/libs/dns-util/dns-util.cabal
@@ -4,7 +4,7 @@ cabal-version: 1.12
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: d71d0f07f44620f73670692eb75544d71d97efd5ddfd25d72388d073f8cf2494
+-- hash: 2025228a75d939373b4d108c8d9848c70c7e85debb5f2380344806e5b5b0314d
 
 name:           dns-util
 version:        0.1.0
@@ -20,7 +20,6 @@ build-type:     Simple
 
 library
   exposed-modules:
-      Wire.Network.DNS.A
       Wire.Network.DNS.Effect
       Wire.Network.DNS.Helper
       Wire.Network.DNS.SRV
diff --git a/libs/dns-util/src/Wire/Network/DNS/A.hs b/libs/dns-util/src/Wire/Network/DNS/A.hs
deleted file mode 100644
index ecac28be2cf..00000000000
--- a/libs/dns-util/src/Wire/Network/DNS/A.hs
+++ /dev/null
@@ -1,32 +0,0 @@
--- This file is part of the Wire Server implementation.
---
--- Copyright (C) 2021 Wire Swiss GmbH <opensource@wire.com>
---
--- This program is free software: you can redistribute it and/or modify it under
--- the terms of the GNU Affero General Public License as published by the Free
--- Software Foundation, either version 3 of the License, or (at your option) any
--- later version.
---
--- This program is distributed in the hope that it will be useful, but WITHOUT
--- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
--- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
--- details.
---
--- You should have received a copy of the GNU Affero General Public License along
--- with this program. If not, see <https://www.gnu.org/licenses/>.
-
-module Wire.Network.DNS.A where
-
-import Data.IP
-import Imports
-import Network.DNS
-
--- | A response to lookupA, i.e., a reponse to a lookup of IPv4 addresses of a
--- domain.
-data AResponse
-  = AIPv4s [IPv4]
-  | AResponseError DNSError
-  deriving (Eq)
-
-interpretResponse :: Either DNSError [IPv4] -> AResponse
-interpretResponse = either AResponseError AIPv4s
diff --git a/libs/dns-util/src/Wire/Network/DNS/Effect.hs b/libs/dns-util/src/Wire/Network/DNS/Effect.hs
index b7e3bafd23c..0b55358f46b 100644
--- a/libs/dns-util/src/Wire/Network/DNS/Effect.hs
+++ b/libs/dns-util/src/Wire/Network/DNS/Effect.hs
@@ -21,29 +21,20 @@ import Imports
 import Network.DNS (Domain, Resolver)
 import qualified Network.DNS as DNS
 import Polysemy
-import qualified Wire.Network.DNS.A as A
 import qualified Wire.Network.DNS.SRV as SRV
 
 data DNSLookup m a where
   LookupSRV :: Domain -> DNSLookup m SRV.SrvResponse
-  LookupA :: Domain -> DNSLookup m A.AResponse
 
 makeSem ''DNSLookup
 
 runDNSLookupDefault :: Member (Embed IO) r => Sem (DNSLookup ': r) a -> Sem r a
 runDNSLookupDefault =
-  interpret $ \case
-    LookupSRV domain -> embed $ do
-      rs <- DNS.makeResolvSeed DNS.defaultResolvConf
-      DNS.withResolver rs $ \resolver ->
-        SRV.interpretResponse <$> DNS.lookupSRV resolver domain
-    LookupA domain -> embed $ do
-      rs <- DNS.makeResolvSeed DNS.defaultResolvConf
-      DNS.withResolver rs $ \resolver ->
-        A.interpretResponse <$> DNS.lookupA resolver domain
+  interpret $ \(LookupSRV domain) -> embed $ do
+    rs <- DNS.makeResolvSeed DNS.defaultResolvConf
+    DNS.withResolver rs $ \resolver ->
+      SRV.interpretResponse <$> DNS.lookupSRV resolver domain
 
 runDNSLookupWithResolver :: Member (Embed IO) r => Resolver -> Sem (DNSLookup ': r) a -> Sem r a
-runDNSLookupWithResolver resolver =
-  interpret $ \case
-    LookupSRV domain -> embed (SRV.interpretResponse <$> DNS.lookupSRV resolver domain)
-    LookupA domain -> embed (A.interpretResponse <$> DNS.lookupA resolver domain)
+runDNSLookupWithResolver resolver = interpret $ \(LookupSRV domain) ->
+  embed (SRV.interpretResponse <$> DNS.lookupSRV resolver domain)
diff --git a/libs/wire-api/src/Wire/API/Call/Config.hs b/libs/wire-api/src/Wire/API/Call/Config.hs
index 85c315254be..2a68c3025f7 100644
--- a/libs/wire-api/src/Wire/API/Call/Config.hs
+++ b/libs/wire-api/src/Wire/API/Call/Config.hs
@@ -129,7 +129,7 @@ modelRtcConfiguration = Doc.defineModel "RTCConfiguration" $ do
   Doc.property "ttl" Doc.int32' $
     Doc.description "Number of seconds after which the configuration should be refreshed (advisory)"
   Doc.property "sft_servers_all" (Doc.array (Doc.ref modelRtcSftServerUrl)) $
-    Doc.description "Array of 'SFTServer' URLs (optional)"
+    Doc.description "Array of all SFT servers"
 
 instance ToJSON RTCConfiguration where
   toJSON (RTCConfiguration srvs sfts ttl all_servers) =
diff --git a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated.hs b/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated.hs
index f4a5dff0652..cefc6936c64 100644
--- a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated.hs
+++ b/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated.hs
@@ -348,7 +348,8 @@ tests =
             (Test.Wire.API.Golden.Generated.RTCConfiguration_user.testObject_RTCConfiguration_user_3, "testObject_RTCConfiguration_user_3.json"),
             (Test.Wire.API.Golden.Generated.RTCConfiguration_user.testObject_RTCConfiguration_user_4, "testObject_RTCConfiguration_user_4.json"),
             (Test.Wire.API.Golden.Generated.RTCConfiguration_user.testObject_RTCConfiguration_user_5, "testObject_RTCConfiguration_user_5.json"),
-            (Test.Wire.API.Golden.Generated.RTCConfiguration_user.testObject_RTCConfiguration_user_6, "testObject_RTCConfiguration_user_6.json")
+            (Test.Wire.API.Golden.Generated.RTCConfiguration_user.testObject_RTCConfiguration_user_6, "testObject_RTCConfiguration_user_6.json"),
+            (Test.Wire.API.Golden.Generated.RTCConfiguration_user.testObject_RTCConfiguration_user_7, "testObject_RTCConfiguration_user_7.json")
           ],
       testGroup "Golden: SFTServer_user" $
         testObjects
diff --git a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/RTCConfiguration_user.hs b/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/RTCConfiguration_user.hs
index 5ef3d79325d..9b75aa71b71 100644
--- a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/RTCConfiguration_user.hs
+++ b/libs/wire-api/test/golden/Test/Wire/API/Golden/Generated/RTCConfiguration_user.hs
@@ -757,3 +757,45 @@ testObject_RTCConfiguration_user_6 =
       (2)
       Nothing
   )
+
+testObject_RTCConfiguration_user_7 :: RTCConfiguration
+testObject_RTCConfiguration_user_7 =
+  ( rtcConfiguration
+      ( ( rtcIceServer
+            ( (turnURI (SchemeTurns) (TurnHostIp (IpAddr (read "248.187.155.126"))) (read "1") (Nothing))
+                :| [ (turnURI (SchemeTurn) (TurnHostIp (IpAddr (read "166.155.90.230"))) (read "0") (Just TransportTCP)),
+                     (turnURI (SchemeTurns) (TurnHostName "xn--mgbh0fb.xn--kgbechtv") (read "1") (Just TransportTCP)),
+                     (turnURI (SchemeTurn) (TurnHostName "host.name") (read "1") (Just TransportTCP))
+                   ]
+            )
+            ( ( turnUsername (secondsToNominalDiffTime (2.000000000000)) ("tj") & tuVersion .~ (0) & tuKeyindex .~ (0)
+                  & tuT .~ ('\1011805')
+              )
+            )
+            ((fromRight undefined (validate (""))))
+        )
+          :| []
+      )
+      Nothing
+      (2)
+      ( Just
+          [ sftServer
+              ( coerce
+                  URI
+                    { uriScheme = Scheme {schemeBS = "https"},
+                      uriAuthority =
+                        Just
+                          ( Authority
+                              { authorityUserInfo = Nothing,
+                                authorityHost = Host {hostBS = "example.com"},
+                                authorityPort = Nothing
+                              }
+                          ),
+                      uriPath = "",
+                      uriQuery = Query {queryPairs = []},
+                      uriFragment = Nothing
+                    }
+              )
+          ]
+      )
+  )
diff --git a/libs/wire-api/test/golden/testObject_RTCConfiguration_user_7.json b/libs/wire-api/test/golden/testObject_RTCConfiguration_user_7.json
new file mode 100644
index 00000000000..8e9fa8b7808
--- /dev/null
+++ b/libs/wire-api/test/golden/testObject_RTCConfiguration_user_7.json
@@ -0,0 +1,22 @@
+{
+    "ice_servers": [
+        {
+            "credential": "",
+            "urls": [
+                "turns:248.187.155.126:1",
+                "turn:166.155.90.230:0?transport=tcp",
+                "turns:xn--mgbh0fb.xn--kgbechtv:1?transport=tcp",
+                "turn:host.name:1?transport=tcp"
+            ],
+            "username": "d=2.v=0.k=0.t=󷁝.r=tj"
+        }
+    ],
+    "sft_servers_all": [
+        {
+            "urls": [
+                "https://example.com"
+            ]
+        }
+    ],
+    "ttl": 2
+}
diff --git a/services/brig/brig.cabal b/services/brig/brig.cabal
index c615cedc1ca..fbefb12ab31 100644
--- a/services/brig/brig.cabal
+++ b/services/brig/brig.cabal
@@ -4,7 +4,7 @@ cabal-version: 2.0
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 2f8a3d719633015dac9204d43e0b4c79ce5b21b022cd9d4cce3868feea9460e8
+-- hash: 350e615ec20264419ad3244b5ba5b93c8a0bbea7dc35db5f300a3fbf3ef4e4c0
 
 name:           brig
 version:        2.0
@@ -156,7 +156,6 @@ library
     , cassandra-util >=0.16.2
     , comonad
     , conduit >=1.2.8
-    , connection
     , containers >=0.5
     , cookie >=0.4
     , cryptobox-haskell >=0.1.1
@@ -170,7 +169,6 @@ library
     , errors >=1.4
     , exceptions >=0.5
     , extended
-    , extra
     , filepath >=1.3
     , fsnotify >=0.2
     , galley-types >=0.75.3
@@ -180,7 +178,6 @@ library
     , html-entities >=1.1
     , http-client >=0.5
     , http-client-openssl >=0.2
-    , http-client-tls
     , http-media
     , http-types >=0.8
     , imports
@@ -212,6 +209,7 @@ library
     , safe >=0.3
     , safe-exceptions >=0.1
     , saml2-web-sso
+    , schema-profunctor
     , scientific >=0.3.4
     , scrypt >=0.5
     , servant
@@ -501,7 +499,7 @@ test-suite brig-tests
     , dns-util
     , http-types
     , imports
-    , iproute
+    , lens
     , polysemy
     , polysemy-wire-zoo
     , retry
diff --git a/services/brig/brig.integration.yaml b/services/brig/brig.integration.yaml
index b658be1135b..b5ca314dfb9 100644
--- a/services/brig/brig.integration.yaml
+++ b/services/brig/brig.integration.yaml
@@ -178,12 +178,6 @@ optSettings:
   #   Remember to keep it the same in Galley.
   setFederationDomain: example.com
   setFeatureFlags:  # see #RefConfigOptions in `/docs/reference`
-  # FUTUREWORK: Replace the following SFT DNS lookup parameters with something
-  # to be added to the CI environment
-  setSftLookup:
-    domain: sftd.integration-tests.zinfra.io
-    port: 80
-    isTestingEnvironment: true
 
 logLevel: Warn
 # ^ NOTE: We log too much in brig, if we set this to Info like other services, running tests
diff --git a/services/brig/package.yaml b/services/brig/package.yaml
index bcc149f1b93..f37fbc001b8 100644
--- a/services/brig/package.yaml
+++ b/services/brig/package.yaml
@@ -45,7 +45,6 @@ library:
   - cassandra-util >=0.16.2
   - comonad
   - conduit >=1.2.8
-  - connection
   - containers >=0.5
   - cookie >=0.4
   - cryptobox-haskell >=0.1.1
@@ -59,7 +58,6 @@ library:
   - errors >=1.4
   - exceptions >=0.5
   - extended
-  - extra
   - filepath >=1.3
   - fsnotify >=0.2
   - galley-types >=0.75.3
@@ -73,7 +71,6 @@ library:
   - html-entities >=1.1
   - http-client >=0.5
   - http-client-openssl >=0.2
-  - http-client-tls
   - http-media
   - http-types >=0.8
   - imports
@@ -106,6 +103,7 @@ library:
   - safe >=0.3
   - safe-exceptions >=0.1
   - saml2-web-sso
+  - schema-profunctor
   - scientific >=0.3.4
   - scrypt >=0.5
   - servant
@@ -164,7 +162,7 @@ tests:
     - dns-util
     - http-types
     - imports
-    - iproute
+    - lens
     - polysemy
     - polysemy-wire-zoo
     - retry
diff --git a/services/brig/src/Brig/App.hs b/services/brig/src/Brig/App.hs
index 6f68e03adf2..326ca0b0a24 100644
--- a/services/brig/src/Brig/App.hs
+++ b/services/brig/src/Brig/App.hs
@@ -214,7 +214,7 @@ newEnv o = do
   eventsQueue <- case Opt.internalEventsQueue (Opt.internalEvents o) of
     StompQueue q -> pure (StompQueue q)
     SqsQueue q -> SqsQueue <$> AWS.getQueueUrl (aws ^. AWS.amazonkaEnv) q
-  mSFTEnv <- mapM Calling.mkSFTEnv $ (,Opt.setSftLookup . Opt.optSettings $ o) <$> Opt.sft o
+  mSFTEnv <- mapM Calling.mkSFTEnv $ Opt.sft o
   prekeyLocalLock <- case Opt.randomPrekeys o of
     Just True -> Just <$> newMVar ()
     _ -> pure Nothing
diff --git a/services/brig/src/Brig/Calling.hs b/services/brig/src/Brig/Calling.hs
index 8abea5ebdf8..acd77634009 100644
--- a/services/brig/src/Brig/Calling.hs
+++ b/services/brig/src/Brig/Calling.hs
@@ -18,9 +18,10 @@
 -- with this program. If not, see <https://www.gnu.org/licenses/>.
 
 module Brig.Calling
-  ( getRandomSFTServers,
+  ( getRandomElements,
     mkSFTDomain,
     SFTServers, -- See NOTE SFTServers
+    unSFTServers,
     mkSFTServers,
     SFTEnv (..),
     Discovery (..),
@@ -29,7 +30,6 @@ module Brig.Calling
     newEnv,
     sftDiscoveryLoop,
     discoverSFTServers,
-    discoverSFTServersAll,
     discoveryToMaybe,
     randomize,
     startSFTServiceDiscovery,
@@ -47,7 +47,6 @@ import qualified Brig.Options as Opts
 import Brig.Types (TurnURI)
 import Control.Lens
 import Control.Monad.Random.Class (MonadRandom)
-import Data.IP
 import Data.List.NonEmpty (NonEmpty (..))
 import qualified Data.List.NonEmpty as NonEmpty
 import Data.List1
@@ -61,7 +60,6 @@ import Polysemy.TinyLog
 import qualified System.Logger as Log
 import System.Random.MWC (GenIO, createSystemRandom)
 import System.Random.Shuffle
-import Wire.Network.DNS.A
 import Wire.Network.DNS.Effect
 import Wire.Network.DNS.SRV
 
@@ -71,7 +69,7 @@ import Wire.Network.DNS.SRV
 -- And limited since client currently try contacting all servers returned
 -- (and we don't want them to open 100 parallel connections unnecessarily)
 -- Therefore, we hide the constructor from the module export.
-newtype SFTServers = SFTServers (NonEmpty SrvEntry)
+newtype SFTServers = SFTServers {unSFTServers :: NonEmpty SrvEntry}
   deriving (Eq, Show)
 
 mkSFTServers :: NonEmpty SrvEntry -> SFTServers
@@ -88,10 +86,14 @@ type MaximumSFTServers = 100
 -- Currently (Sept 2020) the client initiating an SFT call will try all
 -- servers in this list. Limit this list to a smaller subset in case many
 -- SFT servers are advertised in a given environment.
-getRandomSFTServers :: MonadRandom m => Range 1 MaximumSFTServers Int -> SFTServers -> m (NonEmpty SrvEntry)
-getRandomSFTServers limit (SFTServers list) = subsetSft limit <$> randomize list
-
-subsetSft :: Range 1 100 Int -> NonEmpty a -> NonEmpty a
+getRandomElements ::
+  MonadRandom f =>
+  Range 1 MaximumSFTServers Int ->
+  NonEmpty a ->
+  f (NonEmpty a)
+getRandomElements limit list = subsetSft limit <$> randomize list
+
+subsetSft :: Range 1 MaximumSFTServers Int -> NonEmpty a -> NonEmpty a
 subsetSft l entries = do
   let entry1 = NonEmpty.head entries
   let entryTail = take (fromRange l - 1) (NonEmpty.tail entries)
@@ -112,8 +114,7 @@ data SFTEnv = SFTEnv
     sftDiscoveryInterval :: Int,
     -- | maximum amount of servers to give out,
     -- even if more are in the SRV record
-    sftListLength :: Range 1 100 Int,
-    sftLookup :: Maybe Opts.SFTLookup
+    sftListLength :: Range 1 100 Int
   }
 
 data Discovery a
@@ -137,16 +138,6 @@ discoverSFTServers domain =
       err (Log.msg ("DNS Lookup failed for SFT Discovery" :: ByteString) . Log.field "Error" (show e))
       pure Nothing
 
-discoverSFTServersAll :: Members [DNSLookup, TinyLog] r => DNS.Domain -> Sem r (Maybe [IPv4])
-discoverSFTServersAll domain =
-  lookupA domain >>= \case
-    AIPv4s ips -> do
-      info (Log.msg ("Found the following IP addresses for SFT servers" :: ByteString) . Log.field "addresses" (show ips))
-      pure . Just $ ips
-    AResponseError e -> do
-      err (Log.msg ("DNS Lookup failed for SFT Discovery" :: ByteString) . Log.field "Error" (show e))
-      pure Nothing
-
 mkSFTDomain :: SFTOptions -> DNS.Domain
 mkSFTDomain SFTOptions {..} = DNS.normalize $ maybe defSftServiceName ("_" <>) sftSRVServiceName <> "._tcp." <> sftBaseDomain
 
@@ -160,14 +151,13 @@ sftDiscoveryLoop SFTEnv {..} = forever $ do
     Just es -> atomicWriteIORef sftServers (Discovered (SFTServers es))
   threadDelay sftDiscoveryInterval
 
-mkSFTEnv :: (SFTOptions, Maybe Opts.SFTLookup) -> IO SFTEnv
-mkSFTEnv (opts, msftLookup) =
+mkSFTEnv :: SFTOptions -> IO SFTEnv
+mkSFTEnv opts =
   SFTEnv
     <$> newIORef NotDiscoveredYet
     <*> pure (mkSFTDomain opts)
     <*> pure (diffTimeToMicroseconds (fromMaybe defSftDiscoveryIntervalSeconds (Opts.sftDiscoveryIntervalSeconds opts)))
     <*> pure (fromMaybe defSftListLength (Opts.sftListLength opts))
-    <*> pure msftLookup
 
 startSFTServiceDiscovery :: Log.Logger -> SFTEnv -> IO ()
 startSFTServiceDiscovery logger =
diff --git a/services/brig/src/Brig/Calling/API.hs b/services/brig/src/Brig/Calling/API.hs
index 44c1d2b7d2a..b4ba4619956 100644
--- a/services/brig/src/Brig/Calling/API.hs
+++ b/services/brig/src/Brig/Calling/API.hs
@@ -19,6 +19,10 @@
 
 module Brig.Calling.API
   ( routesPublic,
+
+    -- * Exposed for testing purposes
+    newConfig,
+    CallsConfigVersion (..),
   )
 where
 
@@ -32,7 +36,6 @@ import qualified Brig.Options as Opt
 import Control.Lens
 import Data.ByteString.Conversion
 import Data.ByteString.Lens
-import Data.Either.Extra (eitherToMaybe)
 import Data.Id
 import Data.List.NonEmpty (NonEmpty (..))
 import qualified Data.List.NonEmpty as NonEmpty
@@ -44,21 +47,17 @@ import Data.Text.Ascii (AsciiBase64, encodeBase64)
 import Data.Text.Strict.Lens
 import Data.Time.Clock.POSIX (getPOSIXTime)
 import Imports hiding (head)
-import Network.Connection
-import Network.HTTP.Client.TLS (mkManagerSettings, newTlsManager, newTlsManagerWith)
 import Network.Wai (Response)
 import Network.Wai.Predicate hiding (and, result, setStatus, (#))
 import Network.Wai.Routing hiding (toList)
 import Network.Wai.Utilities hiding (code, message)
 import Network.Wai.Utilities.Swagger (document)
 import OpenSSL.EVP.Digest (Digest, hmacBS)
-import Polysemy (runM)
+import Polysemy
 import Polysemy.TinyLog
-import System.Logger (Logger)
 import qualified System.Random.MWC as MWC
 import Wire.API.Call.Config (SFTServer)
 import qualified Wire.API.Call.Config as Public
-import Wire.Network.DNS.Effect
 import Wire.Network.DNS.SRV (srvTarget)
 
 routesPublic :: Routes Doc.ApiBuilder Handler ()
@@ -104,7 +103,12 @@ getCallsConfigV2 _ _ limit = do
   staticUrl <- view $ settings . Opt.sftStaticUrl
   sftEnv' <- view sftEnv
   logger <- view applog
-  newConfig env staticUrl sftEnv' limit logger
+  manager <- view httpManager
+  liftIO
+    . runM @IO
+    . runTinyLog logger
+    . interpretSFT manager
+    $ newConfig env staticUrl sftEnv' limit CallsConfigV2
 
 getCallsConfigH :: JSON ::: UserId ::: ConnId -> Handler Response
 getCallsConfigH (_ ::: uid ::: connid) =
@@ -114,7 +118,13 @@ getCallsConfig :: UserId -> ConnId -> Handler Public.RTCConfiguration
 getCallsConfig _ _ = do
   env <- liftIO . readIORef =<< view turnEnv
   logger <- view applog
-  dropTransport <$> newConfig env Nothing Nothing Nothing logger
+  manager <- view httpManager
+  fmap dropTransport
+    . liftIO
+    . runM @IO
+    . runTinyLog logger
+    . interpretSFT manager
+    $ newConfig env Nothing Nothing Nothing CallsConfigDeprecated
   where
     -- In order to avoid being backwards incompatible, remove the `transport` query param from the URIs
     dropTransport :: Public.RTCConfiguration -> Public.RTCConfiguration
@@ -123,15 +133,24 @@ getCallsConfig _ _ = do
         (Public.rtcConfIceServers . traverse . Public.iceURLs . traverse . Public.turiTransport)
         Nothing
 
+data CallsConfigVersion
+  = CallsConfigDeprecated
+  | CallsConfigV2
+
+-- | FUTUREWORK: It is not reflected in the function type the part of the
+-- business logic that says that the SFT static URL parameter cannot be set at
+-- the same time as the SFT environment parameter. See how to allow either none
+-- to be set or only one of them (perhaps Data.These combined with error
+-- handling).
 newConfig ::
-  MonadIO m =>
+  Members [Embed IO, SFT] r =>
   Calling.Env ->
   Maybe HttpsUrl ->
   Maybe SFTEnv ->
   Maybe (Range 1 10 Int) ->
-  Logger ->
-  m Public.RTCConfiguration
-newConfig env sftStaticUrl mSftEnv limit logger = do
+  CallsConfigVersion ->
+  Sem r Public.RTCConfiguration
+newConfig env sftStaticUrl mSftEnv limit version = do
   let (sha, secret, tTTL, cTTL, prng) = (env ^. turnSHA512, env ^. turnSecret, env ^. turnTokenTTL, env ^. turnConfigTTL, env ^. turnPrng)
   -- randomize list of servers (before limiting the list, to ensure not always the same servers are chosen if limit is set)
   randomizedUris <- liftIO $ randomize (List1.toNonEmpty $ env ^. turnServers)
@@ -142,38 +161,27 @@ newConfig env sftStaticUrl mSftEnv limit logger = do
   finalUris <- liftIO $ randomize limitedUris
   srvs <- for finalUris $ \uri -> do
     u <- liftIO $ genUsername tTTL prng
-    pure $ Public.rtcIceServer (uri :| []) u (computeCred sha secret u)
+    pure $ Public.rtcIceServer (pure uri) u (computeCred sha secret u)
 
-  let staticSft = (\url -> Public.sftServer url :| []) <$> sftStaticUrl
-  sftEntries <- case mSftEnv of
-    Nothing -> pure Nothing
-    Just actualSftEnv -> do
-      sftSrvEntries <- fmap discoveryToMaybe . readIORef . sftServers $ actualSftEnv
+  let staticSft = pure . Public.sftServer <$> sftStaticUrl
+  allSrvEntries <-
+    fmap join $
+      for mSftEnv $
+        (unSFTServers <$$>) . fmap discoveryToMaybe . readIORef . sftServers
+  srvEntries <- fmap join $
+    for mSftEnv $ \actualSftEnv -> liftIO $ do
       let subsetLength = Calling.sftListLength actualSftEnv
-      liftIO $ mapM (getRandomSFTServers subsetLength) sftSrvEntries
+      mapM (getRandomElements subsetLength) allSrvEntries
 
-  mSftServersAll :: Maybe (Maybe [SFTServer]) <- for (mSftEnv >>= sftLookup) $ \sftl -> liftIO $ do
-    httpMan <-
-      if Opt.sftlIsTestEnv sftl
-        then
-          let s = TLSSettingsSimple True False True
-           in newTlsManagerWith $ mkManagerSettings s Nothing
-        else newTlsManager
-    response <-
-      runM
-        . runTinyLog logger
-        . runDNSLookupDefault
-        . discoverSFTServersAll
-        . Opt.unLookupDomain
-        . Opt.sftlDomain
-        $ sftl
-    case response of
-      Nothing -> pure $ Nothing @[SFTServer]
-      Just ips -> fmap (eitherToMaybe @SFTError @[SFTServer] . sequence) $
-        for ips $ \ip -> runM . interpretSFT httpMan $ sftGetClientUrl ip (Opt.sftlPort sftl)
+  mSftServersAll :: Maybe [SFTServer] <- case version of
+    CallsConfigDeprecated -> pure Nothing
+    CallsConfigV2 ->
+      Just <$> case sftStaticUrl of
+        Nothing -> pure $ sftServerFromSrvTarget . srvTarget <$> maybe [] toList allSrvEntries
+        Just url -> fromRight [] . unSFTGetResponse <$> sftGetAllServers url
 
-  let mSftServers = staticSft <|> sftServerFromSrvTarget . srvTarget <$$> sftEntries
-  pure $ Public.rtcConfiguration srvs mSftServers cTTL (join mSftServersAll)
+  let mSftServers = staticSft <|> sftServerFromSrvTarget . srvTarget <$$> srvEntries
+  pure $ Public.rtcConfiguration srvs mSftServers cTTL mSftServersAll
   where
     limitedList :: NonEmpty Public.TurnURI -> Range 1 10 Int -> NonEmpty Public.TurnURI
     limitedList uris lim =
diff --git a/services/brig/src/Brig/Effects/SFT.hs b/services/brig/src/Brig/Effects/SFT.hs
index 0b0c7a20b0d..0abae5ab210 100644
--- a/services/brig/src/Brig/Effects/SFT.hs
+++ b/services/brig/src/Brig/Effects/SFT.hs
@@ -14,55 +14,80 @@
 --
 -- You should have received a copy of the GNU Affero General Public License along
 -- with this program. If not, see <https://www.gnu.org/licenses/>.
+{-# LANGUAGE GeneralizedNewtypeDeriving #-}
 
-module Brig.Effects.SFT where
+module Brig.Effects.SFT
+  ( SFTError (..),
+    SFTGetResponse (..),
+    SFT (..),
+    sftGetAllServers,
+    interpretSFT,
+    interpretSFTInMemory,
+  )
+where
 
-import Data.ByteString (unsnoc)
-import qualified Data.ByteString.Char8 as BS8
-import Data.ByteString.Conversion.From
-import Data.ByteString.Internal (ByteString (PS), w2c)
-import Data.ByteString.Unsafe (unsafeTake)
-import Data.IP
+import qualified Data.Aeson as Aeson
+import Data.ByteString.Conversion
+import qualified Data.Map as Map
 import Data.Misc
+import Data.Schema
 import Data.String.Conversions (cs)
-import Imports
+import Imports hiding (intercalate)
 import Network.HTTP.Client
 import Polysemy
 import Polysemy.Internal
+import Polysemy.TinyLog
+import qualified System.Logger as Log
+import URI.ByteString (uriPath)
 import Wire.API.Call.Config
 
 newtype SFTError = SFTError {unSFTError :: String}
+  deriving (Eq, Show)
+
+newtype SFTGetResponse = SFTGetResponse
+  {unSFTGetResponse :: Either SFTError [SFTServer]}
+  deriving newtype (Eq)
 
 data SFT m a where
-  SFTGetClientUrl :: IPv4 -> Port -> SFT m (Either SFTError SFTServer)
+  SFTGetAllServers :: HttpsUrl -> SFT m SFTGetResponse
+
+sftGetAllServers :: Member SFT r => HttpsUrl -> Sem r SFTGetResponse
+sftGetAllServers = send . SFTGetAllServers
+
+interpretSFT :: Members [Embed IO, TinyLog] r => Manager -> Sem (SFT ': r) a -> Sem r a
+interpretSFT httpManager = interpret $ \(SFTGetAllServers url) -> do
+  let urlWithPath = ensureHttpsUrl $ (httpsUrl url) {uriPath = "/sft_servers_all.json"}
+      req = parseRequest_ . cs . toByteString' $ urlWithPath
+  responseURLsRaw <- liftIO (responseBody <$> httpLbs req httpManager)
+  let eList = Aeson.eitherDecode @AllURLs responseURLsRaw
+      res = bimap SFTError (fmap sftServer . unAllURLs) eList
+  void $ case res of
+    Left e ->
+      err $
+        Log.field "sft_err" (show e) . Log.msg ("Error for URL: " <> toByteString' urlWithPath)
+    Right servers ->
+      info $
+        Log.field "IPv4s" (show servers) . Log.msg ("Fetched the following server URLs" :: ByteString)
+  pure . SFTGetResponse $ res
+
+newtype AllURLs = AllURLs {unAllURLs :: [HttpsUrl]}
+  deriving (Aeson.FromJSON) via Schema AllURLs
 
-sftGetClientUrl :: Member SFT r => IPv4 -> Port -> Sem r (Either SFTError SFTServer)
-sftGetClientUrl ipAddr port = send $ SFTGetClientUrl ipAddr port
+instance ToSchema AllURLs where
+  schema =
+    object "AllURLs" $
+      AllURLs
+        <$> unAllURLs .= field "sft_servers_all" (array schema)
 
-interpretSFT :: Member (Embed IO) r => Manager -> Sem (SFT ': r) a -> Sem r a
-interpretSFT httpManager = interpret $ \(SFTGetClientUrl ipAddr port) -> do
-  let req =
-        parseRequest_ $
-          mconcat
-            [ "GET http://",
-              show ipAddr,
-              ":",
-              show . portNumber $ port,
-              "/sft/url"
-            ]
-  sftUrlResponse <- liftIO (responseBody <$> httpLbs req httpManager)
-  pure . bimap SFTError sftServer . runParser' (parser @HttpsUrl) . cs . strip . cs $ sftUrlResponse
-  where
-    -- FUTUREWORK: remove this adopted code once upgraded to bytestring >= 0.10.12.0
-    strip :: BS8.ByteString -> BS8.ByteString
-    strip = BS8.dropWhile isSpace . dropWhileEnd' isSpace
-      where
-        dropWhileEnd' :: (Char -> Bool) -> BS8.ByteString -> BS8.ByteString
-        dropWhileEnd' f ps = unsafeTake (findFromEndUntil (not . f . w2c) ps) ps
-        findFromEndUntil :: (Word8 -> Bool) -> BS8.ByteString -> Int
-        findFromEndUntil f ps@(PS _ _ l) = case unsnoc ps of
-          Nothing -> 0
-          Just (b, c) ->
-            if f c
-              then l
-              else findFromEndUntil f b
+interpretSFTInMemory ::
+  Member TinyLog r =>
+  Map HttpsUrl SFTGetResponse ->
+  Sem (SFT ': r) a ->
+  Sem r a
+interpretSFTInMemory m = interpret $ \(SFTGetAllServers url) ->
+  case Map.lookup url m of
+    Nothing -> do
+      let msg = "No value in the lookup map"
+      err $ Log.field "url" (show url) . Log.msg (cs msg :: ByteString)
+      pure . SFTGetResponse . Left . SFTError $ msg
+    Just ss -> pure ss
diff --git a/services/brig/src/Brig/Options.hs b/services/brig/src/Brig/Options.hs
index 798b5c1f988..ad631e49325 100644
--- a/services/brig/src/Brig/Options.hs
+++ b/services/brig/src/Brig/Options.hs
@@ -33,7 +33,7 @@ import Data.Aeson.Types (typeMismatch)
 import qualified Data.Char as Char
 import Data.Domain (Domain (..))
 import Data.Id
-import Data.Misc (HttpsUrl, Port (..))
+import Data.Misc (HttpsUrl)
 import Data.Range
 import Data.Scientific (toBoundedInteger)
 import qualified Data.Text as Text
@@ -495,46 +495,10 @@ data Settings = Settings
     -- config will always return this entry. This is useful in Kubernetes
     -- where SFTs are deployed behind a load-balancer.  In the long-run the SRV
     -- fetching logic can go away completely
-    setSftStaticUrl :: !(Maybe HttpsUrl),
-    setSftLookup :: !(Maybe SFTLookup)
+    setSftStaticUrl :: !(Maybe HttpsUrl)
   }
   deriving (Show, Generic)
 
-data SFTLookup = SFTLookup
-  { sftlDomain :: !LookupDomain,
-    sftlPort :: !Port,
-    -- FUTUREWORK: Get rid of the test environment flag below. This is to be
-    -- done by not looking up A records and consequently making GET requests via
-    -- HTTPS based on IP addresses, instead of domain names.
-
-    -- | Set to True if running in a test environment. This will avoid
-    -- performing SSL checks in a request to an SFT server. The default value is
-    -- False.
-    sftlIsTestEnv :: Bool
-  }
-  deriving (Show, Generic)
-
-instance FromJSON SFTLookup where
-  parseJSON = Aeson.withObject "SFTLookup" $ \o -> do
-    d <- o Aeson..: "domain"
-    p <- o Aeson..: "port"
-    t <- o Aeson..:? "isTestingEnvironment" Aeson..!= False
-    pure $ SFTLookup d p t
-
-newtype LookupDomain = LookupDomain {unLookupDomain :: DNS.Domain}
-  deriving stock (Show, Generic)
-
-instance FromJSON LookupDomain where
-  parseJSON (Y.String s) =
-    LookupDomain <$> Y.withText "LookupDomain" asciiOnly (Y.String s)
-    where
-      asciiOnly :: Text -> Y.Parser ByteString
-      asciiOnly t =
-        if Text.all Char.isAscii t
-          then pure $ Text.encodeUtf8 t
-          else fail $ "Expected ascii string only, found: " <> Text.unpack t
-  parseJSON _ = fail "Expected a String"
-
 -- | The analog to `GT.FeatureFlags`.  This type tracks only the things that we need to
 -- express our current cloud business logic.
 --
diff --git a/services/brig/test/integration/API/Calling.hs b/services/brig/test/integration/API/Calling.hs
index 25e05adfb9b..758c1befc62 100644
--- a/services/brig/test/integration/API/Calling.hs
+++ b/services/brig/test/integration/API/Calling.hs
@@ -56,9 +56,7 @@ tests m b opts turn turnV2 = do
           ],
         testGroup
           "sft"
-          [ test m "SFT servers /calls/config/v2 - 200" $ testSFT b opts,
-            test m "SFT servers all /calls/config/v2 - 200" $ testSFTServersAll b opts,
-            test m "SFT servers static URI - 200" $ testSFTStatic b opts
+          [ test m "SFT servers /calls/config/v2 - 200" $ testSFT b opts
           ]
       ]
 
@@ -89,18 +87,6 @@ testCallsConfigMultiple b turnUpdater = do
   let _expected = List1.singleton (toTurnURILegacy "127.0.0.1" 3478)
   modifyAndAssert b uid getTurnConfigurationV1 turnUpdater "turn:127.0.0.1:3478" _expected
 
-testSFTStatic :: Brig -> Opts.Opts -> Http ()
-testSFTStatic b opts = do
-  uid <- userId <$> randomUser b
-  let Right server1 = mkHttpsUrl =<< first show (parseURI laxURIParserOptions "https://sft01.integration-tests.zinfra.io:443")
-  withSettingsOverrides (opts & Opts.optionSettings . Opts.sftStaticUrl ?~ server1) $ do
-    cfg1 <- retryWhileN 10 (isNothing . view rtcConfSftServers) (getTurnConfigurationV2 uid b)
-    liftIO $
-      assertEqual
-        "when SFT static URL is enabled, sft_servers should return just one static entry."
-        (Set.fromList [sftServer server1])
-        (Set.fromList $ maybe [] NonEmpty.toList $ cfg1 ^. rtcConfSftServers)
-
 testSFT :: Brig -> Opts.Opts -> Http ()
 testSFT b opts = do
   uid <- userId <$> randomUser b
@@ -110,43 +96,17 @@ testSFT b opts = do
       "when SFT discovery is not enabled, sft_servers shouldn't be returned"
       Nothing
       (cfg ^. rtcConfSftServers)
-    assertEqual
-      "when SFT discovery is not enabled, sft_servers_all shouldn't be returned"
-      Nothing
-      (cfg ^. rtcConfSftServersAll)
   withSettingsOverrides (opts & Opts.sftL ?~ Opts.SFTOptions "integration-tests.zinfra.io" Nothing (Just 0.001) Nothing) $ do
     cfg1 <- retryWhileN 10 (isNothing . view rtcConfSftServers) (getTurnConfigurationV2 uid b)
     -- These values are controlled by https://github.com/zinfra/cailleach/tree/77ca2d23cf2959aa183dd945d0a0b13537a8950d/environments/dns-integration-tests
     let Right server1 = mkHttpsUrl =<< first show (parseURI laxURIParserOptions "https://sft01.integration-tests.zinfra.io:443")
     let Right server2 = mkHttpsUrl =<< first show (parseURI laxURIParserOptions "https://sft02.integration-tests.zinfra.io:8443")
-    liftIO $ do
+    liftIO $
       assertEqual
         "when SFT discovery is enabled, sft_servers should be returned"
         (Set.fromList [sftServer server1, sftServer server2])
         (Set.fromList $ maybe [] NonEmpty.toList $ cfg1 ^. rtcConfSftServers)
 
-testSFTServersAll :: Brig -> Opts.Opts -> Http ()
-testSFTServersAll b opts = do
-  uid <- userId <$> randomUser b
-  let lookupSettings = Opts.SFTLookup (Opts.LookupDomain "sftd.integration-tests.zinfra.io") (Port 80) True
-  let newOptSettings = (Opts.optSettings opts) {Opts.setSftLookup = Just lookupSettings}
-  let opts' =
-        opts
-          { Opts.sft = Just $ Opts.SFTOptions "integration-tests.zinfra.io" Nothing (Just 0.001) Nothing,
-            Opts.optSettings = newOptSettings
-          }
-  withSettingsOverrides opts' $ do
-    cfg1 <- retryWhileN 10 (isNothing . view rtcConfSftServersAll) (getTurnConfigurationV2 uid b)
-    -- These values are controlled by https://github.com/zinfra/cailleach/blob/459591512a02333e62abebe28656874cab3b4380/environments/dns-integration-tests
-    liftIO $ case cfg1 ^. rtcConfSftServersAll of
-      Nothing -> assertFailure "sft_servers_all not configured"
-      Just allServers -> do
-        let Right clientUrl = mkHttpsUrl =<< first show (parseURI laxURIParserOptions "https://sft01.avs.zinfra.io")
-        assertEqual
-          "when SFT discovery is enabled and SFT lookup configured, sft_servers_all should be returned"
-          (Set.singleton . sftServer $ clientUrl)
-          (Set.fromList allServers)
-
 modifyAndAssert ::
   Brig ->
   UserId ->
diff --git a/services/brig/test/unit/Test/Brig/Calling.hs b/services/brig/test/unit/Test/Brig/Calling.hs
index 6a27dcc2afd..305ec4ec7ad 100644
--- a/services/brig/test/unit/Test/Brig/Calling.hs
+++ b/services/brig/test/unit/Test/Brig/Calling.hs
@@ -1,4 +1,5 @@
 {-# LANGUAGE RecordWildCards #-}
+{-# OPTIONS_GHC -Wno-incomplete-uni-patterns #-}
 
 -- This file is part of the Wire Server implementation.
 --
@@ -20,11 +21,17 @@
 module Test.Brig.Calling where
 
 import Brig.Calling
+import Brig.Calling.API (CallsConfigVersion (..), newConfig)
+import Brig.Calling.Internal (sftServerFromSrvTarget)
+import Brig.Effects.SFT
 import Brig.Options
+import Control.Lens ((^.))
 import Control.Retry
-import Data.IP
+import Data.Bifunctor
 import Data.List.NonEmpty (NonEmpty (..))
 import qualified Data.List.NonEmpty as NonEmpty
+import qualified Data.Map as Map
+import Data.Misc
 import Data.Range
 import qualified Data.Set as Set
 import Data.String.Conversions
@@ -35,30 +42,27 @@ import Polysemy.TinyLog
 import qualified System.Logger as Log
 import Test.Tasty
 import Test.Tasty.HUnit
+import Test.Tasty.QuickCheck (Arbitrary (..), generate)
+import URI.ByteString
 import qualified UnliftIO.Async as Async
-import qualified Wire.Network.DNS.A as A
+import Wire.API.Call.Config
 import Wire.Network.DNS.Effect
 import Wire.Network.DNS.SRV
 
 data FakeDNSEnv = FakeDNSEnv
   { fakeLookupSrv :: Domain -> SrvResponse,
-    fakeLookupA :: Domain -> A.AResponse,
-    fakeLookupSrvCalls :: IORef [Domain],
-    fakeLookupACalls :: IORef [Domain]
+    fakeLookupSrvCalls :: IORef [Domain]
   }
 
-newFakeDNSEnv :: (Domain -> SrvResponse) -> (Domain -> A.AResponse) -> IO FakeDNSEnv
-newFakeDNSEnv lookupSrvFn lookupAFn =
-  FakeDNSEnv lookupSrvFn lookupAFn <$> newIORef [] <*> newIORef []
+newFakeDNSEnv :: (Domain -> SrvResponse) -> IO FakeDNSEnv
+newFakeDNSEnv lookupSrvFn =
+  FakeDNSEnv lookupSrvFn <$> newIORef []
 
 runFakeDNSLookup :: Member (Embed IO) r => FakeDNSEnv -> Sem (DNSLookup ': r) a -> Sem r a
-runFakeDNSLookup FakeDNSEnv {..} = interpret $ \case
-  LookupSRV domain -> do
+runFakeDNSLookup FakeDNSEnv {..} = interpret $
+  \(LookupSRV domain) -> do
     modifyIORef' fakeLookupSrvCalls (++ [domain])
     pure $ fakeLookupSrv domain
-  LookupA domain -> do
-    modifyIORef' fakeLookupACalls (++ [domain])
-    pure $ fakeLookupA domain
 
 newtype LogRecorder = LogRecorder {recordedLogs :: IORef [(Log.Level, LByteString)]}
 
@@ -100,14 +104,17 @@ tests =
           testCase "when service is not available" testSFTDiscoverWhenNotAvailable,
           testCase "when dns lookup fails" testSFTDiscoverWhenDNSFails
         ],
-      testGroup "getRandomSFTServers" $
+      testGroup "Get Random SFT Servers" $
         [ testCase "more servers in SRV than limit" testSFTManyServers,
           testCase "fewer servers in SRV than limit" testSFTFewerServers
           -- the randomization part is not (yet?) tested here.
         ],
-      testGroup "discoverSFTServersAll" $
-        [ testCase "when service is available" testSFTDiscoverAWhenAvailable,
-          testCase "when dns lookup fails" testSFTDiscoverAWhenDNSFails
+      testGroup
+        "SFT static URL"
+        [ testCase "deprecated endpoint" testSFTStaticDeprecatedEndpoint,
+          testCase "v2 endpoint, no SFT static URL" testSFTStaticV2NoStaticUrl,
+          testCase "v2 endpoint, SFT static URL without /sft_servers_all.json" testSFTStaticV2StaticUrlError,
+          testCase "v2 endpoint, SFT static URL with    /sft_servers_all.json" testSFTStaticV2StaticUrlList
         ]
     ]
 
@@ -117,8 +124,8 @@ testDiscoveryLoopWhenSuccessful = do
       entry2 = SrvEntry 0 0 (SrvTarget "sft2.foo.example.com." 443)
       entry3 = SrvEntry 0 0 (SrvTarget "sft3.foo.example.com." 443)
       returnedEntries = entry1 :| [entry2, entry3]
-  fakeDNSEnv <- newFakeDNSEnv (\_ -> SrvAvailable returnedEntries) undefined
-  sftEnv <- mkSFTEnv (SFTOptions "foo.example.com" Nothing (Just 0.001) Nothing, Nothing)
+  fakeDNSEnv <- newFakeDNSEnv (\_ -> SrvAvailable returnedEntries)
+  sftEnv <- mkSFTEnv $ SFTOptions "foo.example.com" Nothing (Just 0.001) Nothing
 
   discoveryLoop <- Async.async $ runM . ignoreLogs . runFakeDNSLookup fakeDNSEnv $ sftDiscoveryLoop sftEnv
   void $ retryEvery10MicrosWhileN 2000 (== 0) (length <$> readIORef (fakeLookupSrvCalls fakeDNSEnv))
@@ -132,8 +139,8 @@ testDiscoveryLoopWhenSuccessful = do
 
 testDiscoveryLoopWhenUnsuccessful :: IO ()
 testDiscoveryLoopWhenUnsuccessful = do
-  fakeDNSEnv <- newFakeDNSEnv (const SrvNotAvailable) undefined
-  sftEnv <- mkSFTEnv (SFTOptions "foo.example.com" Nothing (Just 0.001) Nothing, Nothing)
+  fakeDNSEnv <- newFakeDNSEnv (const SrvNotAvailable)
+  sftEnv <- mkSFTEnv $ SFTOptions "foo.example.com" Nothing (Just 0.001) Nothing
 
   discoveryLoop <- Async.async $ runM . ignoreLogs . runFakeDNSLookup fakeDNSEnv $ sftDiscoveryLoop sftEnv
   -- We wait for at least two lookups to be sure that the lookup loop looped at
@@ -151,7 +158,7 @@ testDiscoveryLoopWhenUnsuccessfulAfterSuccess = do
 
   -- In the following lines we re-use the 'sftEnv' from a successful lookup to
   -- replicate what will happen when a dns lookup fails after success
-  failingFakeDNSEnv <- newFakeDNSEnv (const SrvNotAvailable) undefined
+  failingFakeDNSEnv <- newFakeDNSEnv (const SrvNotAvailable)
   discoveryLoop <- Async.async $ runM . ignoreLogs . runFakeDNSLookup failingFakeDNSEnv $ sftDiscoveryLoop sftEnv
   -- We wait for at least two lookups to be sure that the lookup loop looped at
   -- least once
@@ -171,7 +178,7 @@ testDiscoveryLoopWhenURLsChange = do
       entry2 = SrvEntry 0 0 (SrvTarget "sft5.foo.example.com." 443)
       newEntries = entry1 :| [entry2]
 
-  fakeDNSEnv <- newFakeDNSEnv (const $ SrvAvailable newEntries) undefined
+  fakeDNSEnv <- newFakeDNSEnv (const $ SrvAvailable newEntries)
   discoveryLoop <- Async.async $ runM . ignoreLogs . runFakeDNSLookup fakeDNSEnv $ sftDiscoveryLoop sftEnv
   void $ retryEvery10MicrosWhileN 2000 (== 0) (length <$> readIORef (fakeLookupSrvCalls fakeDNSEnv))
   -- We don't want to stop the loop before it has written to the sftServers IORef
@@ -187,7 +194,7 @@ testSFTDiscoverWhenAvailable = do
   let entry1 = SrvEntry 0 0 (SrvTarget "sft7.foo.example.com." 443)
       entry2 = SrvEntry 0 0 (SrvTarget "sft8.foo.example.com." 8843)
       returnedEntries = entry1 :| [entry2]
-  fakeDNSEnv <- newFakeDNSEnv (\_ -> SrvAvailable returnedEntries) undefined
+  fakeDNSEnv <- newFakeDNSEnv (\_ -> SrvAvailable returnedEntries)
 
   assertEqual "discovered servers should be returned" (Just returnedEntries)
     =<< ( runM . recordLogs logRecorder . runFakeDNSLookup fakeDNSEnv $
@@ -199,7 +206,7 @@ testSFTDiscoverWhenAvailable = do
 testSFTDiscoverWhenNotAvailable :: IO ()
 testSFTDiscoverWhenNotAvailable = do
   logRecorder <- newLogRecorder
-  fakeDNSEnv <- newFakeDNSEnv (const SrvNotAvailable) undefined
+  fakeDNSEnv <- newFakeDNSEnv (const SrvNotAvailable)
 
   assertEqual "discovered servers should be returned" Nothing
     =<< ( runM . recordLogs logRecorder . runFakeDNSLookup fakeDNSEnv $
@@ -211,7 +218,7 @@ testSFTDiscoverWhenNotAvailable = do
 testSFTDiscoverWhenDNSFails :: IO ()
 testSFTDiscoverWhenDNSFails = do
   logRecorder <- newLogRecorder
-  fakeDNSEnv <- newFakeDNSEnv (const $ SrvResponseError IllegalDomain) undefined
+  fakeDNSEnv <- newFakeDNSEnv (const $ SrvResponseError IllegalDomain)
 
   assertEqual "no servers should be returned" Nothing
     =<< ( runM . recordLogs logRecorder . runFakeDNSLookup fakeDNSEnv $
@@ -231,7 +238,7 @@ testSFTManyServers = do
       entry7 = SrvEntry 0 0 (SrvTarget "sft7.foo.example.com." 443)
       entries = entry1 :| [entry2, entry3, entry4, entry5, entry6, entry7]
       sftServers = mkSFTServers entries
-  someServers <- getRandomSFTServers (unsafeRange 3) sftServers
+  someServers <- getRandomElements (unsafeRange 3) . unSFTServers $ sftServers
   assertEqual "should return only 3 servers" 3 (length someServers)
 
 testSFTFewerServers :: IO ()
@@ -243,7 +250,7 @@ testSFTFewerServers = do
       entries = entry1 :| [entry2, entry3, entry4]
       sftServers = mkSFTServers entries
 
-  allServers <- getRandomSFTServers (unsafeRange 10) sftServers
+  allServers <- getRandomElements (unsafeRange 10) . unSFTServers $ sftServers
   assertEqual "should return all of them" (Set.fromList $ NonEmpty.toList allServers) (Set.fromList $ NonEmpty.toList entries)
 
 retryEvery10MicrosWhileN :: (MonadIO m) => Int -> (a -> Bool) -> m a -> m a
@@ -253,36 +260,88 @@ retryEvery10MicrosWhileN n f m =
     (const (return . f))
     (const m)
 
-testSFTDiscoverAWhenAvailable :: IO ()
-testSFTDiscoverAWhenAvailable = do
-  logRecorder <- newLogRecorder
-  let entry1 = read "192.0.2.1" :: IPv4
-      entry2 = read "192.0.2.2" :: IPv4
-      returnedEntries = [entry1, entry2]
-  fakeDNSEnv <- newFakeDNSEnv undefined (const $ A.AIPv4s returnedEntries)
-
-  assertEqual "discovered servers should be returned" (Just returnedEntries)
-    =<< ( runM . recordLogs logRecorder . runFakeDNSLookup fakeDNSEnv $
-            discoverSFTServersAll "foo.example.com"
-        )
+-- | Creates a calling environment and an https URL to be used in unit-testing
+-- the logic of call configuration endpoints
+sftStaticEnv :: IO (Env, HttpsUrl)
+sftStaticEnv = do
+  turnUri <- generate arbitrary
+  let tokenTtl = 10 -- seconds
+      configTtl = 10 -- seconds
+      secret = "secret word"
+  env <- newEnv undefined (pure turnUri) tokenTtl configTtl secret
+  let Right staticUrl =
+        mkHttpsUrl
+          =<< first
+            show
+            (parseURI laxURIParserOptions "https://sft01.integration-tests.zinfra.io:443")
+  pure (env, staticUrl)
+
+-- The deprecated endpoint `GET /calls/config` without an SFT static URL
+testSFTStaticDeprecatedEndpoint :: IO ()
+testSFTStaticDeprecatedEndpoint = do
+  env <- fst <$> sftStaticEnv
+  cfg <-
+    runM @IO
+      . discardLogs
+      . interpretSFTInMemory mempty
+      $ newConfig env Nothing Nothing Nothing CallsConfigDeprecated
   assertEqual
-    "should report discovered IP addresses"
-    [ ( Log.Info,
-        "Found the following IP addresses for SFT servers, addresses="
-          <> (cs . show $ returnedEntries)
-          <> "\n"
-      )
-    ]
-    =<< readIORef (recordedLogs logRecorder)
-
-testSFTDiscoverAWhenDNSFails :: IO ()
-testSFTDiscoverAWhenDNSFails = do
-  logRecorder <- newLogRecorder
-  fakeDNSEnv <- newFakeDNSEnv undefined (const $ A.AResponseError IllegalDomain)
-
-  assertEqual "no servers should be returned" Nothing
-    =<< ( runM . recordLogs logRecorder . runFakeDNSLookup fakeDNSEnv $
-            discoverSFTServersAll "foo.example.com"
-        )
-  assertEqual "should warn about it in the logs" [(Log.Error, "DNS Lookup failed for SFT Discovery, Error=IllegalDomain\n")]
-    =<< readIORef (recordedLogs logRecorder)
+    "when SFT static URL is disabled, sft_servers should be empty."
+    Set.empty
+    (Set.fromList $ maybe [] NonEmpty.toList $ cfg ^. rtcConfSftServers)
+
+-- The v2 endpoint `GET /calls/config/v2` without an SFT static URL
+testSFTStaticV2NoStaticUrl :: IO ()
+testSFTStaticV2NoStaticUrl = do
+  env <- fst <$> sftStaticEnv
+  let entry1 = SrvEntry 0 0 (SrvTarget "sft1.foo.example.com." 443)
+      entry2 = SrvEntry 0 0 (SrvTarget "sft2.foo.example.com." 443)
+      entry3 = SrvEntry 0 0 (SrvTarget "sft3.foo.example.com." 443)
+      servers = entry1 :| [entry2, entry3]
+  sftEnv <-
+    SFTEnv
+      <$> newIORef (Discovered . mkSFTServers $ servers)
+      <*> pure "foo.example.com"
+      <*> pure 5
+      <*> pure (unsafeRange 1)
+  cfg <-
+    runM @IO
+      . discardLogs
+      . interpretSFTInMemory mempty
+      $ newConfig env Nothing (Just sftEnv) (Just . unsafeRange $ 2) CallsConfigV2
+  assertEqual
+    "when SFT static URL is disabled, sft_servers_all should be from SFT environment"
+    (Just . fmap (sftServerFromSrvTarget . srvTarget) . toList $ servers)
+    (cfg ^. rtcConfSftServersAll)
+
+-- The v2 endpoint `GET /calls/config/v2` with an SFT static URL that gives an error
+testSFTStaticV2StaticUrlError :: IO ()
+testSFTStaticV2StaticUrlError = do
+  (env, staticUrl) <- sftStaticEnv
+  cfg <-
+    runM @IO
+      . discardLogs
+      . interpretSFTInMemory mempty -- an empty lookup map, meaning there was
+      -- an error
+      $ newConfig env (Just staticUrl) Nothing (Just . unsafeRange $ 2) CallsConfigV2
+  assertEqual
+    "when SFT static URL is enabled, but returns error, sft_servers_all should be empty"
+    (Just [])
+    (cfg ^. rtcConfSftServersAll)
+
+-- The v2 endpoint `GET /calls/config/v2` with an SFT static URL's /sft_servers_all.json
+testSFTStaticV2StaticUrlList :: IO ()
+testSFTStaticV2StaticUrlList = do
+  (env, staticUrl) <- sftStaticEnv
+  -- 10 servers compared to the limit of 3 below that should be disregarded
+  -- for sft_servers_all
+  servers <- generate $ replicateM 10 arbitrary
+  cfg <-
+    runM @IO
+      . discardLogs
+      . interpretSFTInMemory (Map.singleton staticUrl (SFTGetResponse . Right $ servers))
+      $ newConfig env (Just staticUrl) Nothing (Just . unsafeRange $ 3) CallsConfigV2
+  assertEqual
+    "when SFT static URL is enabled, sft_servers_all should be from /sft_servers_all.json"
+    (Just servers)
+    (cfg ^. rtcConfSftServersAll)

From 8ce3661cb188c2ffaac1395f97014b3c16855086 Mon Sep 17 00:00:00 2001
From: Sven Tennie <sven.tennie@wire.com>
Date: Mon, 10 Jan 2022 11:38:26 +0100
Subject: [PATCH 56/74] Servantify Cannon Public endpoint (#2024)

Servantify Cannon Public endpoint

* Clean up
* Remove servant-websockets by inlining it and fixing a subtle bug
  regarding failing requests
* Better swagger doc inspired by MultiVerb
* Add changelog entry
* Update comment regarding the origin of WebSocketPending
* Fix review issues

Co-authored-by: Paolo Capriotti <paolo@capriotti.io>
---
 cabal.project.freeze                          |  1 -
 .../5-internal/servantify-cannon-public-api   |  1 +
 libs/wire-api/package.yaml                    |  2 +
 .../src/Wire/API/Routes/Public/Cannon.hs      | 40 +++++----
 .../wire-api/src/Wire/API/Routes/WebSocket.hs | 89 +++++++++++++++++++
 libs/wire-api/wire-api.cabal                  |  6 +-
 services/brig/src/Brig/API/Public.hs          |  2 +
 services/cannon/cannon.cabal                  |  6 +-
 services/cannon/package.yaml                  |  3 +
 services/cannon/src/Cannon/API/Public.hs      | 65 ++++----------
 services/cannon/src/Cannon/Run.hs             | 21 +++--
 services/cannon/src/Cannon/Types.hs           |  7 ++
 services/cannon/test/Main.hs                  |  4 +-
 13 files changed, 169 insertions(+), 78 deletions(-)
 create mode 100644 changelog.d/5-internal/servantify-cannon-public-api
 rename services/cannon/src/Cannon/API.hs => libs/wire-api/src/Wire/API/Routes/Public/Cannon.hs (52%)
 create mode 100644 libs/wire-api/src/Wire/API/Routes/WebSocket.hs

diff --git a/cabal.project.freeze b/cabal.project.freeze
index fda8eeef868..faadf3c628b 100644
--- a/cabal.project.freeze
+++ b/cabal.project.freeze
@@ -1957,7 +1957,6 @@ constraints: any.AC-Angle ==1.0,
              any.servant-swagger-ui ==0.3.4.3.36.1,
              any.servant-swagger-ui-core ==0.3.3,
              any.servant-swagger-ui-redoc ==0.3.3.1.22.3,
-             any.servant-websockets ==2.0.0,
              any.servant-yaml ==0.1.0.1,
              any.serverless-haskell ==0.11.3,
              any.serversession ==1.0.1,
diff --git a/changelog.d/5-internal/servantify-cannon-public-api b/changelog.d/5-internal/servantify-cannon-public-api
new file mode 100644
index 00000000000..1a60973e2b6
--- /dev/null
+++ b/changelog.d/5-internal/servantify-cannon-public-api
@@ -0,0 +1 @@
+Migrate the public API of Cannon to Servant. (There is an internal API that is not yet migrated.)
diff --git a/libs/wire-api/package.yaml b/libs/wire-api/package.yaml
index d4e8cd1a362..187e761ff4b 100644
--- a/libs/wire-api/package.yaml
+++ b/libs/wire-api/package.yaml
@@ -88,6 +88,8 @@ library:
   - wire-message-proto-lens
   - x509
   - wai
+  - wai-websockets
+  - websockets
 
 tests:
   wire-api-tests:
diff --git a/services/cannon/src/Cannon/API.hs b/libs/wire-api/src/Wire/API/Routes/Public/Cannon.hs
similarity index 52%
rename from services/cannon/src/Cannon/API.hs
rename to libs/wire-api/src/Wire/API/Routes/Public/Cannon.hs
index 7160ed50abe..28f90c8f56c 100644
--- a/services/cannon/src/Cannon/API.hs
+++ b/libs/wire-api/src/Wire/API/Routes/Public/Cannon.hs
@@ -1,6 +1,6 @@
 -- This file is part of the Wire Server implementation.
 --
--- Copyright (C) 2020 Wire Swiss GmbH <opensource@wire.com>
+-- Copyright (C) 2021 Wire Swiss GmbH <opensource@wire.com>
 --
 -- This program is free software: you can redistribute it and/or modify it under
 -- the terms of the GNU Affero General Public License as published by the Free
@@ -15,19 +15,29 @@
 -- You should have received a copy of the GNU Affero General Public License along
 -- with this program. If not, see <https://www.gnu.org/licenses/>.
 
-module Cannon.API
-  ( sitemap,
-  )
-where
+module Wire.API.Routes.Public.Cannon where
 
-import qualified Cannon.API.Internal as Internal
-import qualified Cannon.API.Public as Public
-import Cannon.Types (Cannon)
-import qualified Data.Swagger.Build.Api as Doc
-import Network.Wai.Routing (Routes)
+import Data.Id
+import Data.Swagger
+import Servant
+import Servant.Swagger
+import Wire.API.Routes.Public (ZConn, ZUser)
+import Wire.API.Routes.WebSocket
 
-sitemap :: Routes Doc.ApiBuilder Cannon ()
-sitemap = do
-  Public.sitemap
-  Public.apiDocs
-  Internal.sitemap
+type ServantAPI =
+  Summary "Establish websocket connection"
+    :> "await"
+    :> ZUser
+    :> ZConn
+    :> QueryParam'
+         [ Optional,
+           Strict,
+           Description "Client ID"
+         ]
+         "client"
+         ClientId
+    -- FUTUREWORK: Consider higher-level web socket combinator
+    :> WebSocketPending
+
+swaggerDoc :: Swagger
+swaggerDoc = toSwagger (Proxy @ServantAPI)
diff --git a/libs/wire-api/src/Wire/API/Routes/WebSocket.hs b/libs/wire-api/src/Wire/API/Routes/WebSocket.hs
new file mode 100644
index 00000000000..6a2e5c340ed
--- /dev/null
+++ b/libs/wire-api/src/Wire/API/Routes/WebSocket.hs
@@ -0,0 +1,89 @@
+-- This file is part of the Wire Server implementation.
+--
+-- Copyright (C) 2021 Wire Swiss GmbH <opensource@wire.com>
+--
+-- This program is free software: you can redistribute it and/or modify it under
+-- the terms of the GNU Affero General Public License as published by the Free
+-- Software Foundation, either version 3 of the License, or (at your option) any
+-- later version.
+--
+-- This program is distributed in the hope that it will be useful, but WITHOUT
+-- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+-- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+-- details.
+--
+-- You should have received a copy of the GNU Affero General Public License along
+-- with this program. If not, see <https://www.gnu.org/licenses/>.
+
+module Wire.API.Routes.WebSocket where
+
+import Control.Lens
+import Control.Monad.Trans.Resource
+import Data.HashMap.Strict.InsOrd
+import Data.Metrics.Servant
+import Data.Proxy
+import Data.Swagger
+import Imports
+import Network.Wai.Handler.WebSockets
+import Network.WebSockets
+import Servant.Server hiding (respond)
+import Servant.Server.Internal.Delayed
+import Servant.Server.Internal.RouteResult
+import Servant.Server.Internal.Router
+import Servant.Swagger
+
+-- | A websocket that relates to a 'PendingConnection'
+-- Copied and adapted from: <https://hackage.haskell.org/package/servant-websockets-2.0.0/docs/Servant-API-WebSocket.html#t:WebSocketPending>
+data WebSocketPending
+
+instance HasServer WebSocketPending ctx where
+  type ServerT WebSocketPending m = PendingConnection -> m ()
+
+  hoistServerWithContext _ _ nat svr = nat . svr
+
+  route Proxy _ app = leafRouter $ \env request respond ->
+    runResourceT $
+      runDelayed app env request >>= liftIO . go request respond
+    where
+      go request respond (Route app') =
+        websocketsOr defaultConnectionOptions (runApp app') (backupApp respond) request (respond . Route)
+      go _ respond (Fail e) = respond $ Fail e
+      go _ respond (FailFatal e) = respond $ FailFatal e
+
+      runApp a c = void (runHandler $ a c)
+
+      backupApp respond _ _ =
+        respond $
+          FailFatal
+            ServerError
+              { errHTTPCode = 426,
+                errReasonPhrase = "Upgrade Required",
+                errBody = mempty,
+                errHeaders = mempty
+              }
+
+instance HasSwagger WebSocketPending where
+  toSwagger _ =
+    mempty
+      & paths
+        . at "/"
+        ?~ ( mempty
+               & get
+                 ?~ ( mempty
+                        & responses . responses .~ resps
+                        & externalDocs
+                          ?~ ( mempty
+                                 & description ?~ "RFC 6455"
+                                 & url .~ URL "https://datatracker.ietf.org/doc/html/rfc6455"
+                             )
+                    )
+           )
+    where
+      resps :: InsOrdHashMap HttpStatusCode (Referenced Data.Swagger.Response)
+      resps =
+        mempty
+          & at 101 ?~ Inline (mempty & description .~ "Connection upgraded.")
+          & at 426 ?~ Inline (mempty & description .~ "Upgrade required.")
+
+instance RoutesToPaths WebSocketPending where
+  getRoutes = []
diff --git a/libs/wire-api/wire-api.cabal b/libs/wire-api/wire-api.cabal
index bc4d4c1a684..2be85cae4ab 100644
--- a/libs/wire-api/wire-api.cabal
+++ b/libs/wire-api/wire-api.cabal
@@ -4,7 +4,7 @@ cabal-version: 1.12
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: f2aacb81c413e8753829ba09eb08d1d2524c973346739389dfeb4284d4a16ebd
+-- hash: 58d272ac852b49af92f6387c08a6a4f797f799df93374f68296cb67600b00653
 
 name:           wire-api
 version:        0.1.0
@@ -56,12 +56,14 @@ library
       Wire.API.Routes.MultiVerb
       Wire.API.Routes.Public
       Wire.API.Routes.Public.Brig
+      Wire.API.Routes.Public.Cannon
       Wire.API.Routes.Public.Cargohold
       Wire.API.Routes.Public.Galley
       Wire.API.Routes.Public.LegalHold
       Wire.API.Routes.Public.Spar
       Wire.API.Routes.Public.Util
       Wire.API.Routes.QualifiedCapture
+      Wire.API.Routes.WebSocket
       Wire.API.ServantProto
       Wire.API.Swagger
       Wire.API.Team
@@ -173,6 +175,8 @@ library
     , uuid >=1.3
     , vector >=0.12
     , wai
+    , wai-websockets
+    , websockets
     , wire-message-proto-lens
     , x509
   default-language: Haskell2010
diff --git a/services/brig/src/Brig/API/Public.hs b/services/brig/src/Brig/API/Public.hs
index a4685355fa4..0c8fb15456c 100644
--- a/services/brig/src/Brig/API/Public.hs
+++ b/services/brig/src/Brig/API/Public.hs
@@ -104,6 +104,7 @@ import qualified Wire.API.Properties as Public
 import qualified Wire.API.Routes.MultiTablePaging as Public
 import Wire.API.Routes.Public.Brig (Api (updateConnectionUnqualified))
 import qualified Wire.API.Routes.Public.Brig as BrigAPI
+import qualified Wire.API.Routes.Public.Cannon as CannonAPI
 import qualified Wire.API.Routes.Public.Cargohold as CargoholdAPI
 import qualified Wire.API.Routes.Public.Galley as GalleyAPI
 import qualified Wire.API.Routes.Public.LegalHold as LegalHoldAPI
@@ -137,6 +138,7 @@ swaggerDocsAPI =
         <> LegalHoldAPI.swaggerDoc
         <> SparAPI.swaggerDoc
         <> CargoholdAPI.swaggerDoc
+        <> CannonAPI.swaggerDoc
     )
       & S.info . S.title .~ "Wire-Server API"
       & S.info . S.description ?~ Brig.Docs.Swagger.contents <> mempty
diff --git a/services/cannon/cannon.cabal b/services/cannon/cannon.cabal
index e91a0617087..e582aabe298 100644
--- a/services/cannon/cannon.cabal
+++ b/services/cannon/cannon.cabal
@@ -4,7 +4,7 @@ cabal-version: 1.12
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 87d683d193f2ad916c72f4c84d0816911f7d894cfbffed36f361436005571339
+-- hash: 5c6e877bcba6cc776493801203320fecfcec06a1384cc5cb0150262e4ef0f3b8
 
 name:           cannon
 version:        0.31.0
@@ -25,7 +25,6 @@ flag static
 
 library
   exposed-modules:
-      Cannon.API
       Cannon.API.Internal
       Cannon.API.Public
       Cannon.App
@@ -63,6 +62,8 @@ library
     , mwc-random >=0.13
     , retry >=0.7
     , safe-exceptions
+    , servant
+    , servant-server
     , strict >=0.3.2
     , swagger >=0.2
     , text >=1.1
@@ -78,6 +79,7 @@ library
     , wai-websockets >=3.0
     , warp >=3.0
     , websockets >=0.11.2
+    , wire-api
   default-language: Haskell2010
 
 executable cannon
diff --git a/services/cannon/package.yaml b/services/cannon/package.yaml
index c71d26a72b1..c784a2bc4bd 100644
--- a/services/cannon/package.yaml
+++ b/services/cannon/package.yaml
@@ -34,6 +34,8 @@ library:
   - mwc-random >=0.13
   - retry >=0.7
   - safe-exceptions
+  - servant
+  - servant-server
   - strict >=0.3.2
   - swagger >=0.2
   - text >=1.1
@@ -49,6 +51,7 @@ library:
   - wai-websockets >=3.0
   - warp >=3.0
   - websockets >=0.11.2
+  - wire-api
 executables:
   cannon:
     main: src/Main.hs
diff --git a/services/cannon/src/Cannon/API/Public.hs b/services/cannon/src/Cannon/API/Public.hs
index 8480c5932f9..8d4859ffca7 100644
--- a/services/cannon/src/Cannon/API/Public.hs
+++ b/services/cannon/src/Cannon/API/Public.hs
@@ -16,62 +16,27 @@
 -- with this program. If not, see <https://www.gnu.org/licenses/>.
 
 module Cannon.API.Public
-  ( sitemap,
-    apiDocs,
+  ( API,
+    publicAPIServer,
   )
 where
 
-import Cannon.App
+import Cannon.App (wsapp)
 import Cannon.Types
 import Cannon.WS
-import Data.Id (ClientId, ConnId, UserId)
-import Data.Swagger.Build.Api hiding (Response)
-import Imports
-import Network.HTTP.Types
-import Network.Wai
-import Network.Wai.Handler.WebSockets
-import Network.Wai.Predicate
-import Network.Wai.Routing
-import Network.Wai.Utilities
-import Network.Wai.Utilities.Swagger
-import qualified Network.WebSockets as Ws
+import Control.Monad.IO.Class
+import Data.Id
+import GHC.Base
+import Network.WebSockets.Connection
+import Servant
+import Wire.API.Routes.Public.Cannon
 
-sitemap :: Routes ApiBuilder Cannon ()
-sitemap = do
-  get "/await" (continue awaitH) $
-    header "Z-User"
-      .&. header "Z-Connection"
-      .&. opt (query "client")
-      .&. request
-  document "GET" "await" $ do
-    summary "Establish websocket connection"
-    parameter Header "Upgrade" (string $ enum ["websocket"]) end
-    parameter Header "Connection" (string $ enum ["upgrade"]) end
-    parameter Header "Sec-WebSocket-Key" bytes' $
-      description "16-bytes base64 encoded nonce"
-    parameter Header "Sec-WebSocket-Version" (int32 $ enum [13]) end
-    parameter Query "client" string' $ do
-      optional
-      description "Client ID"
-    response 426 "Upgrade required" end
+type API = ServantAPI :<|> Raw
 
-apiDocs :: Routes ApiBuilder Cannon ()
-apiDocs = do
-  get "/await/api-docs" (continue docsH) $
-    accept "application" "json"
-      .&. query "base_url"
+publicAPIServer :: ServerT ServantAPI Cannon
+publicAPIServer = streamData
 
-docsH :: Media "application" "json" ::: Text -> Cannon Response
-docsH (_ ::: url) = do
-  let doc = mkSwaggerApi url [] sitemap
-  return $ json doc
-
-awaitH :: UserId ::: ConnId ::: Maybe ClientId ::: Request -> Cannon Response
-awaitH (u ::: a ::: c ::: r) = do
+streamData :: UserId -> ConnId -> Maybe ClientId -> PendingConnection -> Cannon ()
+streamData userId connId clientId con = do
   e <- wsenv
-  case websocketsApp wsoptions (wsapp (mkKey u a) c e) r of
-    Nothing -> return $ errorRs status426 "request-error" "websocket upgrade required"
-    Just rs -> return rs -- ensure all middlewares ignore RawResponse - see Note [Raw Response]
-  where
-    status426 = mkStatus 426 "Upgrade Required"
-    wsoptions = Ws.defaultConnectionOptions
+  liftIO $ wsapp (mkKey userId connId) clientId e con
diff --git a/services/cannon/src/Cannon/Run.hs b/services/cannon/src/Cannon/Run.hs
index 007c18748d7..17296d01b9a 100644
--- a/services/cannon/src/Cannon/Run.hs
+++ b/services/cannon/src/Cannon/Run.hs
@@ -21,11 +21,12 @@ module Cannon.Run
 where
 
 import Bilge (ManagerSettings (..), defaultManagerSettings, newManager)
-import Cannon.API (sitemap)
+import Cannon.API.Internal
+import Cannon.API.Public
 import Cannon.App (maxPingInterval)
 import qualified Cannon.Dict as D
 import Cannon.Options
-import Cannon.Types (Cannon, applog, clients, mkEnv, monitor, runCannon, runCannon')
+import Cannon.Types (Cannon, applog, clients, mkEnv, monitor, runCannon, runCannon', runCannonToServant)
 import Cannon.WS hiding (env)
 import qualified Control.Concurrent.Async as Async
 import Control.Exception.Safe (catchAny)
@@ -33,7 +34,8 @@ import Control.Lens ((^.))
 import Control.Monad.Catch (MonadCatch, finally)
 import Data.Metrics.Middleware (gaugeSet, path)
 import qualified Data.Metrics.Middleware as Middleware
-import Data.Metrics.Middleware.Prometheus (waiPrometheusMiddleware)
+import Data.Metrics.Servant
+import Data.Proxy
 import Data.Text (pack, strip)
 import Data.Text.Encoding (encodeUtf8)
 import Imports hiding (head)
@@ -41,10 +43,12 @@ import qualified Network.Wai as Wai
 import Network.Wai.Handler.Warp hiding (run)
 import qualified Network.Wai.Middleware.Gzip as Gzip
 import Network.Wai.Utilities.Server
+import Servant
 import qualified System.IO.Strict as Strict
 import qualified System.Logger.Class as LC
 import qualified System.Logger.Extended as L
 import System.Random.MWC (createSystemRandom)
+import Wire.API.Routes.Public.Cannon
 
 run :: Opts -> IO ()
 run o = do
@@ -63,14 +67,17 @@ run o = do
   refreshMetricsThread <- Async.async $ runCannon' e refreshMetrics
   s <- newSettings $ Server (o ^. cannon . host) (o ^. cannon . port) (applog e) m (Just idleTimeout)
   let rtree = compile sitemap
-      app r k = runCannon e (route rtree r k) r
+      internalApp r k = runCannon e (Network.Wai.Utilities.Server.route rtree r k) r
       middleware :: Wai.Middleware
       middleware =
-        waiPrometheusMiddleware sitemap
+        servantPlusWAIPrometheusMiddleware sitemap (Proxy @ServantAPI)
           . Gzip.gzip Gzip.def
           . catchErrors g [Right m]
-      start = middleware app
-  runSettings s start `finally` do
+      app :: Application
+      app = middleware (serve (Proxy @API) server)
+      server :: Servant.Server API
+      server = hoistServer (Proxy @ServantAPI) (runCannonToServant e) publicAPIServer :<|> Tagged internalApp
+  runSettings s app `finally` do
     Async.cancel refreshMetricsThread
     L.close (applog e)
   where
diff --git a/services/cannon/src/Cannon/Types.hs b/services/cannon/src/Cannon/Types.hs
index b70f40a358c..4aa6fba4b54 100644
--- a/services/cannon/src/Cannon/Types.hs
+++ b/services/cannon/src/Cannon/Types.hs
@@ -34,6 +34,7 @@ module Cannon.Types
     clients,
     monitor,
     wsenv,
+    runCannonToServant,
   )
 where
 
@@ -51,6 +52,7 @@ import Data.Metrics.Middleware
 import Data.Text.Encoding
 import Imports
 import Network.Wai
+import qualified Servant
 import qualified System.Logger as Logger
 import System.Logger.Class hiding (info)
 import System.Random.MWC (GenIO)
@@ -138,3 +140,8 @@ wsenv = Cannon $ do
 
 logger :: Cannon Logger
 logger = Cannon $ asks applog
+
+-- | Natural transformation from 'Cannon' to 'Handler' monad.
+-- Used to call 'Cannon' from servant.
+runCannonToServant :: Cannon.Types.Env -> Cannon x -> Servant.Handler x
+runCannonToServant env c = liftIO $ runCannon' env c
diff --git a/services/cannon/test/Main.hs b/services/cannon/test/Main.hs
index 75517337702..d6738f66c68 100644
--- a/services/cannon/test/Main.hs
+++ b/services/cannon/test/Main.hs
@@ -17,7 +17,7 @@
 
 module Main where
 
-import qualified Cannon.API
+import qualified Cannon.API.Internal
 import Data.Metrics.Test (pathsConsistencyCheck)
 import Data.Metrics.WaiRoute (treeToPaths)
 import Imports
@@ -35,6 +35,6 @@ main =
           assertEqual
             "inconcistent sitemap"
             mempty
-            (pathsConsistencyCheck . treeToPaths . compile $ Cannon.API.sitemap),
+            (pathsConsistencyCheck . treeToPaths . compile $ Cannon.API.Internal.sitemap),
         D.tests
       ]

From fd198b791256c452dfdf2aa976c856530cb0da64 Mon Sep 17 00:00:00 2001
From: Paolo Capriotti <paolo@capriotti.io>
Date: Mon, 10 Jan 2022 13:38:32 +0100
Subject: [PATCH 57/74] Cargohold: remote assets (#2004)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Initial implementation of remote asset download

* Add RPC to check if an asset exists

* Download local asset for streaming

* Implement federation test for get-asset

Co-authored-by: Sven Tennie <sven.tennie@wire.com>

* Added get-asset test

* Test get-asset with public and private assets

* WIP: federation: test large asset download

* Test stream-asset

* Improve large asset test

* Test streaming invalid assets

* Introduce TestM in Cargohold integration tests

This ReaderT gives access to the HTTP manager and the Cargohold
endpoint. The wrapped monad is HTTP (to make requests).

* Reintroduce tasty resource for configuration file

This avoids having to read the configuration file before every test.

* Add more API client utilities in tests

* Use servant client for federation tests

* Set up federator mocking in cargohold

* Fix formatting

* Assert the content of a remote asset download

* Add changelog.d entry

* Test 404 when fetching remote asset

* Check federated requests in remote asset test

* Add config to cargohold integration chart

* Simple end2end remote asset download test

* Remove unused `uploadRandom` function

* fixup! Simple end2end remote asset download test

* Enable federation in cargohold helm chart

* Make asset public in end-to-end test

* Set hostname for instance with mocked federator

* fixup! Set hostname for instance with mocked federator

* Fix local domain in fed request assertions

* Fix cargohold test in federator

* Use `isJust`

Co-authored-by: Marko Dimjašević <marko.dimjasevic@wire.com>

* Simplify implementation of `getAsset`

Co-authored-by: Marko Dimjašević <marko.dimjasevic@wire.com>

* Remove redundant `$`

Co-authored-by: Marko Dimjašević <marko.dimjasevic@wire.com>

Co-authored-by: Sven Tennie <sven.tennie@wire.com>
Co-authored-by: Marko Dimjašević <marko.dimjasevic@wire.com>
---
 changelog.d/1-api-changes/remote-assets       |   4 +
 charts/brig/templates/tests/configmap.yaml    |   4 +
 charts/brig/values.yaml                       |   2 +-
 charts/cargohold/templates/configmap.yaml     |   6 +
 .../tests/cargohold-integration.yaml          |   5 +
 charts/cargohold/values.yaml                  |   3 +-
 charts/galley/values.yaml                     |   2 +-
 hack/helm_vars/wire-server/values.yaml.gotmpl |   5 +-
 libs/metrics-wai/src/Data/Metrics/Servant.hs  |   3 +
 .../src/Wire/API/Federation/API/Cargohold.hs  |  36 ++-
 .../wire-api/src/Wire/API/Routes/AssetBody.hs |   4 +-
 services/brig/brig.cabal                      |   3 +-
 services/brig/package.yaml                    |   1 +
 .../brig/test/integration/API/User/Account.hs |   2 +-
 .../brig/test/integration/API/User/Util.hs    |  33 ++-
 .../test/integration/Federation/End2end.hs    |  26 +-
 .../brig/test/integration/Federation/Util.hs  |   3 +-
 services/brig/test/integration/Main.hs        |   5 +-
 services/brig/test/integration/Util.hs        |  18 +-
 services/cargohold/cargohold.cabal            |  17 +-
 services/cargohold/cargohold.integration.yaml |   4 +
 services/cargohold/package.yaml               |  11 +
 .../cargohold/src/CargoHold/API/Federation.hs |  28 ++-
 .../cargohold/src/CargoHold/API/Public.hs     |  19 +-
 services/cargohold/src/CargoHold/API/V3.hs    |  17 +-
 services/cargohold/src/CargoHold/AWS.hs       |  26 +-
 services/cargohold/src/CargoHold/App.hs       |  12 +-
 .../cargohold/src/CargoHold/Federation.hs     |  81 +++++++
 services/cargohold/src/CargoHold/Options.hs   |   4 +
 services/cargohold/src/CargoHold/Run.hs       |  26 +-
 services/cargohold/src/CargoHold/S3.hs        |  31 ++-
 services/cargohold/test/integration/API.hs    | 168 ++++++++++---
 .../test/integration/API/Federation.hs        | 226 ++++++++++++++++++
 .../cargohold/test/integration/API/Util.hs    | 129 ++++++++--
 services/cargohold/test/integration/API/V3.hs |  17 +-
 services/cargohold/test/integration/Main.hs   |  66 ++---
 .../cargohold/test/integration/Metrics.hs     |   5 +-
 .../cargohold/test/integration/TestSetup.hs   | 127 ++++++++--
 services/federator/federator.cabal            |   9 +-
 services/federator/package.yaml               |   2 +
 .../federator/src/Federator/MockServer.hs     |   8 +-
 .../integration/Test/Federator/InwardSpec.hs  |   9 +-
 .../test/unit/Test/Federator/Client.hs        |  28 ++-
 services/galley/galley.cabal                  |   1 +
 services/galley/package.yaml                  |   1 +
 services/galley/test/integration/API/Util.hs  |  14 +-
 46 files changed, 1024 insertions(+), 227 deletions(-)
 create mode 100644 changelog.d/1-api-changes/remote-assets
 create mode 100644 services/cargohold/src/CargoHold/Federation.hs
 create mode 100644 services/cargohold/test/integration/API/Federation.hs

diff --git a/changelog.d/1-api-changes/remote-assets b/changelog.d/1-api-changes/remote-assets
new file mode 100644
index 00000000000..a80a382c27a
--- /dev/null
+++ b/changelog.d/1-api-changes/remote-assets
@@ -0,0 +1,4 @@
+Enable downloading assets from a remote (federated) cargohold instance via the v4 API. 
+The content of remote assets is returned as stream with content type
+`application/octet-stream`.
+Please refer to the Swagger API documentation for more details.
diff --git a/charts/brig/templates/tests/configmap.yaml b/charts/brig/templates/tests/configmap.yaml
index 1842519cd7c..5ebf029a33a 100644
--- a/charts/brig/templates/tests/configmap.yaml
+++ b/charts/brig/templates/tests/configmap.yaml
@@ -65,6 +65,10 @@ data:
         host: galley.{{ .Release.Namespace }}-fed2.svc.cluster.local
         port: 8080
 
+      cargohold:
+        host: cargohold.{{ .Release.Namespace }}-fed2.svc.cluster.local
+        port: 8080
+
       # TODO remove this
       federator:
         host: federator.{{ .Release.Namespace }}-fed2.svc.cluster.local
diff --git a/charts/brig/values.yaml b/charts/brig/values.yaml
index 05616c32493..481131558e9 100644
--- a/charts/brig/values.yaml
+++ b/charts/brig/values.yaml
@@ -29,7 +29,7 @@ config:
   # -- If set to false,  'dynamoDBEndpoint' _must_ be set.
   randomPrekeys: true
   useSES: true
-  enableFederator: false # keep enableFederator default in sync with galley chart's config.enableFederator as well as wire-server chart's tag.federator
+  enableFederator: false # keep enableFederator default in sync with galley and cargohold chart's config.enableFederator as well as wire-server chart's tag.federator
   emailSMS:
     general:
       templateBranding:
diff --git a/charts/cargohold/templates/configmap.yaml b/charts/cargohold/templates/configmap.yaml
index 52f3ad7c0c6..22390d9a0b5 100644
--- a/charts/cargohold/templates/configmap.yaml
+++ b/charts/cargohold/templates/configmap.yaml
@@ -11,6 +11,12 @@ data:
       host: 0.0.0.0
       port: {{ .Values.service.internalPort }}
 
+    {{- if .Values.config.enableFederator }}
+    federator:
+      host: federator
+      port: 8080
+    {{- end }}
+
     aws:
       {{- with .Values.config.aws }}
       s3Bucket: {{ .s3Bucket }}
diff --git a/charts/cargohold/templates/tests/cargohold-integration.yaml b/charts/cargohold/templates/tests/cargohold-integration.yaml
index 30939c2f535..3a4d1ed94b7 100644
--- a/charts/cargohold/templates/tests/cargohold-integration.yaml
+++ b/charts/cargohold/templates/tests/cargohold-integration.yaml
@@ -9,6 +9,9 @@ spec:
     - name: "cargohold-integration"
       configMap:
         name: "cargohold-integration"
+    - name: "cargohold-config"
+      configMap:
+        name: "cargohold"
   containers:
     # NOTE: the bucket for these tests must be created.
     # If using the wire-server/fake-aws-s3 chart, `dummy-bucket` will already be created.
@@ -17,6 +20,8 @@ spec:
     volumeMounts:
     - name: "cargohold-integration"
       mountPath: "/etc/wire/integration"
+    - name: "cargohold-config"
+      mountPath: "/etc/wire/cargohold/conf"
     env:
     # these dummy values are necessary for Amazonka's "Discover"
     - name: AWS_ACCESS_KEY_ID
diff --git a/charts/cargohold/values.yaml b/charts/cargohold/values.yaml
index be73a6dd34e..91d97e1d996 100644
--- a/charts/cargohold/values.yaml
+++ b/charts/cargohold/values.yaml
@@ -14,7 +14,8 @@ resources:
     cpu: "500m"
 config:
   logLevel: Info
+  enableFederator: false # keep enableFederator default in sync with brig and galley chart's config.enableFederator as well as wire-server chart's tag.federator
   aws:
     region: "eu-west-1"
     s3Bucket: assets
-  proxy: {}
\ No newline at end of file
+  proxy: {}
diff --git a/charts/galley/values.yaml b/charts/galley/values.yaml
index f50aa5dc17c..59b458237fb 100644
--- a/charts/galley/values.yaml
+++ b/charts/galley/values.yaml
@@ -19,7 +19,7 @@ config:
   cassandra:
     host: aws-cassandra
     replicaCount: 3
-  enableFederator: false # keep enableFederator default in sync with brig chart's config.enableFederator as well as wire-server chart's tag.federator
+  enableFederator: false # keep enableFederator default in sync with brig and cargohold chart's config.enableFederator as well as wire-server chart's tag.federator
   settings:
     maxTeamSize: 500
     maxConvSize: 500
diff --git a/hack/helm_vars/wire-server/values.yaml.gotmpl b/hack/helm_vars/wire-server/values.yaml.gotmpl
index c872b4c04a6..4f56a33f9bd 100644
--- a/hack/helm_vars/wire-server/values.yaml.gotmpl
+++ b/hack/helm_vars/wire-server/values.yaml.gotmpl
@@ -51,7 +51,7 @@ brig:
       sessionTokenTimeout: 20
       accessTokenTimeout: 30
       providerTokenTimeout: 60
-    enableFederator: true # keep in sync with galley.config.enableFederator and tags.federator!
+    enableFederator: true # keep in sync with galley.config.enableFederator, cargohold.config.enableFederator and tags.federator!
     optSettings:
       setActivationTimeout: 5
       # keep this in sync with brigSettingsTeamInvitationTimeout in spar/templates/tests/configmap.yaml
@@ -125,6 +125,7 @@ cargohold:
     aws:
       s3Bucket: dummy-bucket
       s3Endpoint: http://fake-aws-s3:9000
+    enableFederator: true # keep in sync with brig.config.enableFederator, galley.config.enableFederator and tags.federator!
   secrets:
     awsKeyId: dummykey
     awsSecretKey: dummysecret
@@ -135,7 +136,7 @@ galley:
     cassandra:
       host: cassandra-ephemeral
       replicaCount: 1
-    enableFederator: true # keep in sync with brig.config.enableFederator and tags.federator!
+    enableFederator: true # keep in sync with brig.config.enableFederator, cargohold.config.enableFederator and tags.federator!
     settings:
       maxConvAndTeamSize: 16
       maxTeamSize: 32
diff --git a/libs/metrics-wai/src/Data/Metrics/Servant.hs b/libs/metrics-wai/src/Data/Metrics/Servant.hs
index 02ac26f11ac..eadfcf50164 100644
--- a/libs/metrics-wai/src/Data/Metrics/Servant.hs
+++ b/libs/metrics-wai/src/Data/Metrics/Servant.hs
@@ -137,6 +137,9 @@ instance RoutesToPaths (Verb method status cts a) where
 instance RoutesToPaths (NoContentVerb method) where
   getRoutes = []
 
+instance RoutesToPaths (Stream method status framing ct a) where
+  getRoutes = []
+
 -- route :<|> routes
 instance
   ( RoutesToPaths route,
diff --git a/libs/wire-api-federation/src/Wire/API/Federation/API/Cargohold.hs b/libs/wire-api-federation/src/Wire/API/Federation/API/Cargohold.hs
index 45573476280..26efda07526 100644
--- a/libs/wire-api-federation/src/Wire/API/Federation/API/Cargohold.hs
+++ b/libs/wire-api-federation/src/Wire/API/Federation/API/Cargohold.hs
@@ -17,15 +17,45 @@
 
 module Wire.API.Federation.API.Cargohold where
 
+import Data.Aeson (FromJSON (..), ToJSON (..))
+import Data.Id
+import Imports
 import Servant.API
 import Servant.API.Generic
-import Wire.API.Federation.API.Common
+import Wire.API.Arbitrary (Arbitrary, GenericUniform (..))
+import Wire.API.Asset
+import Wire.API.Routes.AssetBody
+import Wire.API.Util.Aeson
+
+data GetAsset = GetAsset
+  { -- | User requesting the asset. Implictly qualified with the source domain.
+    gaUser :: UserId,
+    -- | Asset key for the asset to download. Implictly qualified with the
+    -- target domain.
+    gaKey :: AssetKey,
+    -- | Optional asset token.
+    gaToken :: Maybe AssetToken
+  }
+  deriving stock (Eq, Show, Generic)
+  deriving (Arbitrary) via (GenericUniform GetAsset)
+  deriving (ToJSON, FromJSON) via (CustomEncoded GetAsset)
+
+data GetAssetResponse = GetAssetResponse
+  {gaAvailable :: Bool}
+  deriving stock (Eq, Show, Generic)
+  deriving (Arbitrary) via (GenericUniform GetAssetResponse)
+  deriving (ToJSON, FromJSON) via (CustomEncoded GetAssetResponse)
 
 data CargoholdApi routes = CargoholdApi
   { getAsset ::
       routes
         :- "get-asset"
-        :> ReqBody '[JSON] ()
-        :> Post '[JSON] EmptyResponse
+        :> ReqBody '[JSON] GetAsset
+        :> Post '[JSON] GetAssetResponse,
+    streamAsset ::
+      routes
+        :- "stream-asset"
+        :> ReqBody '[JSON] GetAsset
+        :> StreamPost NoFraming OctetStream AssetSource
   }
   deriving (Generic)
diff --git a/libs/wire-api/src/Wire/API/Routes/AssetBody.hs b/libs/wire-api/src/Wire/API/Routes/AssetBody.hs
index fb9f6661093..5f936ddd279 100644
--- a/libs/wire-api/src/Wire/API/Routes/AssetBody.hs
+++ b/libs/wire-api/src/Wire/API/Routes/AssetBody.hs
@@ -45,10 +45,10 @@ newtype AssetSource = AssetSource
   { getAssetSource ::
       ConduitT () ByteString (ResourceT IO) ()
   }
-  deriving newtype (FromSourceIO ByteString)
+  deriving newtype (FromSourceIO ByteString, ToSourceIO ByteString)
 
 instance ToSchema AssetSource where
-  declareNamedSchema _ = pure $ named "AssetSource" $ mempty
+  declareNamedSchema _ = pure $ named "AssetSource" mempty
 
 type AssetBody =
   StreamBody'
diff --git a/services/brig/brig.cabal b/services/brig/brig.cabal
index fbefb12ab31..b94d7fc4127 100644
--- a/services/brig/brig.cabal
+++ b/services/brig/brig.cabal
@@ -4,7 +4,7 @@ cabal-version: 2.0
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 350e615ec20264419ad3244b5ba5b93c8a0bbea7dc35db5f300a3fbf3ef4e4c0
+-- hash: 2a5e368730d4530d05df5395f6b3157536513b1049130b541d257aa79296cb75
 
 name:           brig
 version:        2.0
@@ -349,6 +349,7 @@ executable brig-integration
     , http-api-data
     , http-client
     , http-client-tls >=0.2
+    , http-media
     , http-types
     , imports
     , lens >=3.9
diff --git a/services/brig/package.yaml b/services/brig/package.yaml
index f37fbc001b8..ae6c5a8f8b0 100644
--- a/services/brig/package.yaml
+++ b/services/brig/package.yaml
@@ -226,6 +226,7 @@ executables:
     - http-api-data
     - http-client
     - http-client-tls >=0.2
+    - http-media
     - http-types
     - imports
     - lens >=3.9
diff --git a/services/brig/test/integration/API/User/Account.hs b/services/brig/test/integration/API/User/Account.hs
index 935ef9e7af5..118e31f8ecf 100644
--- a/services/brig/test/integration/API/User/Account.hs
+++ b/services/brig/test/integration/API/User/Account.hs
@@ -1319,7 +1319,7 @@ testDeleteInternal brig cannon aws = do
 testDeleteWithProfilePic :: Brig -> CargoHold -> Http ()
 testDeleteWithProfilePic brig cargohold = do
   uid <- userId <$> createAnonUser "anon" brig
-  ast <- uploadAsset cargohold uid "this is my profile pic"
+  ast <- responseJsonError =<< uploadAsset cargohold uid Asset.defAssetSettings "this is my profile pic"
   -- Ensure that the asset is there
   downloadAsset cargohold uid (ast ^. Asset.assetKey) !!! const 200 === statusCode
   let newAssets =
diff --git a/services/brig/test/integration/API/User/Util.hs b/services/brig/test/integration/API/User/Util.hs
index 665a4351e90..784db1f7dd3 100644
--- a/services/brig/test/integration/API/User/Util.hs
+++ b/services/brig/test/integration/API/User/Util.hs
@@ -27,7 +27,6 @@ import Brig.Types
 import Brig.Types.Team.LegalHold (LegalHoldClientRequest (..))
 import Brig.Types.User.Auth hiding (user)
 import qualified Brig.ZAuth
-import qualified CargoHold.Types.V3 as CHV3
 import qualified Codec.MIME.Type as MIME
 import Control.Lens (preview, (^?))
 import Control.Monad.Catch (MonadCatch)
@@ -408,24 +407,22 @@ uploadAsset ::
   (MonadCatch m, MonadIO m, MonadHttp m, HasCallStack) =>
   CargoHold ->
   UserId ->
+  AssetSettings ->
   ByteString ->
-  m CHV3.Asset
-uploadAsset c usr dat = do
-  let sts = CHV3.defAssetSettings
-      ct = MIME.Type (MIME.Application "text") []
-      mpb = CHV3.buildMultipartBody sts ct (LB.fromStrict dat)
-  rsp <-
-    post
-      ( c
-          . path "/assets/v3"
-          . zUser usr
-          . zConn "conn"
-          . content "multipart/mixed"
-          . lbytes (toLazyByteString mpb)
-      )
-      <!! const 201
-      === statusCode
-  responseJsonError rsp
+  m (Response (Maybe LByteString))
+uploadAsset c usr sts dat = do
+  let ct = MIME.Type (MIME.Application "text") []
+      mpb = buildMultipartBody sts ct (LB.fromStrict dat)
+  post
+    ( c
+        . path "/assets/v3"
+        . zUser usr
+        . zConn "conn"
+        . content "multipart/mixed"
+        . lbytes (toLazyByteString mpb)
+    )
+    <!! const 201
+    === statusCode
 
 downloadAsset ::
   (MonadIO m, MonadHttp m) =>
diff --git a/services/brig/test/integration/Federation/End2end.hs b/services/brig/test/integration/Federation/End2end.hs
index 9affa5d1d3d..f430d6bca09 100644
--- a/services/brig/test/integration/Federation/End2end.hs
+++ b/services/brig/test/integration/Federation/End2end.hs
@@ -23,9 +23,9 @@ import Bilge
 import Bilge.Assert ((!!!), (<!!), (===))
 import Brig.API.Client (pubClient)
 import qualified Brig.Options as BrigOpts
-import Brig.Types
+import Brig.Types hiding (assetKey)
 import Control.Arrow ((&&&))
-import Control.Lens (sequenceAOf, _1)
+import Control.Lens (sequenceAOf, view, (.~), _1)
 import qualified Data.Aeson as Aeson
 import Data.ByteString.Conversion (toByteString')
 import Data.Domain (Domain)
@@ -49,6 +49,7 @@ import qualified Test.Tasty.Cannon as WS
 import Test.Tasty.HUnit
 import Util
 import Util.Options (Endpoint)
+import Wire.API.Asset
 import Wire.API.Conversation
 import Wire.API.Conversation.Role (roleNameWireAdmin)
 import Wire.API.Event.Conversation
@@ -76,12 +77,14 @@ spec ::
   Manager ->
   Brig ->
   Galley ->
+  CargoHold ->
   Cannon ->
   Endpoint ->
   Brig ->
   Galley ->
+  CargoHold ->
   IO TestTree
-spec _brigOpts mg brig galley cannon _federator brigTwo galleyTwo =
+spec _brigOpts mg brig galley cargohold cannon _federator brigTwo galleyTwo cargoholdTwo =
   pure $
     testGroup
       "federation-end2end-user"
@@ -99,7 +102,8 @@ spec _brigOpts mg brig galley cannon _federator brigTwo galleyTwo =
         test mg "include remote users to new conversation" $ testRemoteUsersInNewConv brig galley brigTwo galleyTwo,
         test mg "send a message to a remote user" $ testSendMessage brig brigTwo galleyTwo cannon,
         test mg "send a message in a remote conversation" $ testSendMessageToRemoteConv brig brigTwo galley galleyTwo cannon,
-        test mg "delete user connected to remotes and in conversation with remotes" $ testDeleteUser brig brigTwo galley galleyTwo cannon
+        test mg "delete user connected to remotes and in conversation with remotes" $ testDeleteUser brig brigTwo galley galleyTwo cannon,
+        test mg "download remote asset" $ testRemoteAsset brig brigTwo cargohold cargoholdTwo
       ]
 
 -- | Path covered by this test:
@@ -619,3 +623,17 @@ testDeleteUser brig1 brig2 galley1 galley2 cannon1 = do
     WS.assertMatch_ (5 # Second) wsAlice $ matchDeleteUserNotification bobDel
     WS.assertMatch_ (5 # Second) wsAlice $ matchConvLeaveNotification conv1 bobDel [bobDel]
     WS.assertMatch_ (5 # Second) wsAlice $ matchConvLeaveNotification conv2 bobDel [bobDel]
+
+testRemoteAsset :: Brig -> Brig -> CargoHold -> CargoHold -> Http ()
+testRemoteAsset brig1 brig2 ch1 ch2 = do
+  alice <- userQualifiedId <$> randomUser brig1
+  bob <- userQualifiedId <$> randomUser brig2
+
+  let sts = defAssetSettings & setAssetPublic .~ True
+  ast <- responseJsonError =<< uploadAsset ch2 (qUnqualified bob) sts "hello world"
+  let qkey = view assetKey ast
+
+  downloadAsset ch1 (qUnqualified alice) qkey
+    !!! do
+      const 200 === statusCode
+      const (Just "hello world") === responseBody
diff --git a/services/brig/test/integration/Federation/Util.hs b/services/brig/test/integration/Federation/Util.hs
index e3cb6378b7d..227cf207e99 100644
--- a/services/brig/test/integration/Federation/Util.hs
+++ b/services/brig/test/integration/Federation/Util.hs
@@ -50,6 +50,7 @@ import GHC.IO.Exception (IOException (ioe_errno))
 import qualified Galley.Types.Teams.SearchVisibility as Team
 import Imports
 import qualified Network.HTTP.Client as HTTP
+import Network.HTTP.Media
 import Network.Socket
 import Network.Wai.Handler.Warp (Port)
 import Network.Wai.Test (Session)
@@ -73,7 +74,7 @@ withTempMockFederator :: Opt.Opts -> LByteString -> Session a -> IO (a, [Mock.Fe
 withTempMockFederator opts resp action =
   Mock.withTempMockFederator
     [("Content-Type", "application/json")]
-    (const (pure resp))
+    (const (pure ("application" // "json", resp)))
     $ \mockPort -> do
       let opts' =
             opts
diff --git a/services/brig/test/integration/Main.hs b/services/brig/test/integration/Main.hs
index b3784d8d114..21c7824deb2 100644
--- a/services/brig/test/integration/Main.hs
+++ b/services/brig/test/integration/Main.hs
@@ -74,6 +74,7 @@ import Wire.API.Federation.Domain
 data BackendConf = BackendConf
   { remoteBrig :: Endpoint,
     remoteGalley :: Endpoint,
+    remoteCargohold :: Endpoint,
     remoteFederatorInternal :: Endpoint,
     remoteFederatorExternal :: Endpoint
   }
@@ -84,6 +85,7 @@ instance FromJSON BackendConf where
     BackendConf
       <$> o .: "brig"
       <*> o .: "galley"
+      <*> o .: "cargohold"
       <*> o .: "federatorInternal"
       <*> o .: "federatorExternal"
 
@@ -118,6 +120,7 @@ runTests iConf brigOpts otherArgs = do
       f = federatorInternal iConf
       brigTwo = mkRequest $ remoteBrig (backendTwo iConf)
       galleyTwo = mkRequest $ remoteGalley (backendTwo iConf)
+      ch2 = mkRequest $ remoteCargohold (backendTwo iConf)
 
   let turnFile = Opts.servers . Opts.turn $ brigOpts
       turnFileV2 = (Opts.serversV2 . Opts.turn) brigOpts
@@ -143,7 +146,7 @@ runTests iConf brigOpts otherArgs = do
   createIndex <- Index.Create.spec brigOpts
   browseTeam <- TeamUserSearch.tests brigOpts mg g b
   userPendingActivation <- UserPendingActivation.tests brigOpts mg db b g s
-  federationEnd2End <- Federation.End2end.spec brigOpts mg b g c f brigTwo galleyTwo
+  federationEnd2End <- Federation.End2end.spec brigOpts mg b g ch c f brigTwo galleyTwo ch2
   federationEndpoints <- API.Federation.tests mg brigOpts b c fedBrigClient
   includeFederationTests <- (== Just "1") <$> Blank.getEnv "INTEGRATION_FEDERATION_TESTS"
   internalApi <- API.Internal.tests brigOpts mg db b (brig iConf) gd g
diff --git a/services/brig/test/integration/Util.hs b/services/brig/test/integration/Util.hs
index 79eb10e70de..93867dae538 100644
--- a/services/brig/test/integration/Util.hs
+++ b/services/brig/test/integration/Util.hs
@@ -71,6 +71,7 @@ import Galley.Types.Conversations.One2One (one2OneConvId)
 import qualified Galley.Types.Teams as Team
 import Gundeck.Types.Notification
 import Imports
+import Network.HTTP.Media.MediaType
 import Network.HTTP.Types (Method)
 import Network.Wai (Application)
 import qualified Network.Wai as Wai
@@ -1054,13 +1055,16 @@ withMockedFederatorAndGalley ::
 withMockedFederatorAndGalley opts _domain fedResp galleyHandler action = do
   result <- assertRight <=< runExceptT $
     withTempMockedService initState galleyHandler $ \galleyMockState ->
-      Mock.withTempMockFederator [("Content-Type", "application/json")] fedResp $ \fedMockPort -> do
-        let opts' =
-              opts
-                { Opt.galley = Endpoint "127.0.0.1" (fromIntegral (serverPort galleyMockState)),
-                  Opt.federatorInternal = Just (Endpoint "127.0.0.1" (fromIntegral fedMockPort))
-                }
-        withSettingsOverrides opts' action
+      Mock.withTempMockFederator
+        [("Content-Type", "application/json")]
+        ((\r -> pure ("application" // "json", r)) <=< fedResp)
+        $ \fedMockPort -> do
+          let opts' =
+                opts
+                  { Opt.galley = Endpoint "127.0.0.1" (fromIntegral (serverPort galleyMockState)),
+                    Opt.federatorInternal = Just (Endpoint "127.0.0.1" (fromIntegral fedMockPort))
+                  }
+          withSettingsOverrides opts' action
   pure (combineResults result)
   where
     combineResults :: ((a, [Mock.FederatedRequest]), [ReceivedRequest]) -> (a, [Mock.FederatedRequest], [ReceivedRequest])
diff --git a/services/cargohold/cargohold.cabal b/services/cargohold/cargohold.cabal
index 26330a6c3c2..e77f5da24b8 100644
--- a/services/cargohold/cargohold.cabal
+++ b/services/cargohold/cargohold.cabal
@@ -4,7 +4,7 @@ cabal-version: 1.12
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 3633e0db5e928a51056ef8474859ed8f6edf06bc84b9ade6db39f62c48bfce07
+-- hash: 8291075b6b5e2e43a811343e51abb02d402fbc38a5a3efd0928f3f1b4c769485
 
 name:           cargohold
 version:        1.5.0
@@ -34,6 +34,7 @@ library
       CargoHold.App
       CargoHold.AWS
       CargoHold.CloudFront
+      CargoHold.Federation
       CargoHold.Metrics
       CargoHold.Options
       CargoHold.Run
@@ -74,6 +75,7 @@ library
     , http-client-openssl >=0.2
     , http-types >=0.8
     , imports
+    , kan-extensions
     , lens >=4.1
     , metrics-wai >=0.4
     , mime >=0.4
@@ -122,6 +124,7 @@ executable cargohold
     , http-client >=0.4
     , http-types >=0.8
     , imports
+    , kan-extensions
     , mime >=0.4
     , safe >=0.3
     , text >=1.1
@@ -135,6 +138,7 @@ executable cargohold-integration
   main-is: Main.hs
   other-modules:
       API
+      API.Federation
       API.Util
       API.V3
       Metrics
@@ -154,19 +158,28 @@ executable cargohold-integration
     , bytestring-conversion >=0.2
     , cargohold
     , cargohold-types
+    , conduit
     , containers >=0.5
+    , cryptonite
     , data-default >=0.5
     , errors >=1.4
     , exceptions >=0.6
     , extended
+    , federator
     , http-client >=0.4
     , http-client-tls >=0.2
+    , http-media
     , http-types >=0.8
     , imports
+    , kan-extensions
     , lens >=3.8
     , mime >=0.4
+    , mmorph
+    , mtl
     , optparse-applicative
     , safe >=0.3
+    , servant-client
+    , servant-client-core
     , tagged >=0.8
     , tasty >=1.0
     , tasty-hunit >=0.9
@@ -174,7 +187,9 @@ executable cargohold-integration
     , time >=1.5
     , types-common >=0.7
     , uuid >=1.3
+    , wai
     , wai-utilities >=0.12
     , wire-api
+    , wire-api-federation
     , yaml >=0.8
   default-language: Haskell2010
diff --git a/services/cargohold/cargohold.integration.yaml b/services/cargohold/cargohold.integration.yaml
index 2773a838499..d43b06f0197 100644
--- a/services/cargohold/cargohold.integration.yaml
+++ b/services/cargohold/cargohold.integration.yaml
@@ -2,6 +2,10 @@ cargohold:
   host: 0.0.0.0
   port: 8084
 
+federator:
+  host: 127.0.0.1
+  port: 8097
+
 aws:
   s3Bucket: dummy-bucket # <-- insert-bucket-name-here
   s3Endpoint: http://localhost:4570 # https://s3-eu-west-1.amazonaws.com:443
diff --git a/services/cargohold/package.yaml b/services/cargohold/package.yaml
index 09cd81ee873..9bc22fa1204 100644
--- a/services/cargohold/package.yaml
+++ b/services/cargohold/package.yaml
@@ -23,6 +23,7 @@ dependencies:
 - HsOpenSSL >=0.11
 - http-client >=0.4
 - http-types >=0.8
+- kan-extensions
 - mime >=0.4
 - safe >=0.3
 - text >=1.1
@@ -71,17 +72,27 @@ executables:
     - base ==4.*
     - cargohold
     - cargohold-types
+    - conduit
+    - cryptonite
+    - federator
     - http-client-tls >=0.2
+    - http-media
     - lens >=3.8
+    - mmorph
+    - mtl
     - optparse-applicative
+    - servant-client-core
+    - servant-client
     - tagged >=0.8
     - tasty >=1.0
     - tasty-hunit >=0.9
     - time >=1.5
     - types-common >=0.7
     - uuid >=1.3
+    - wai
     - wai-utilities >=0.12
     - wire-api
+    - wire-api-federation
   cargohold:
     main: src/Main.hs
     ghc-options:
diff --git a/services/cargohold/src/CargoHold/API/Federation.hs b/services/cargohold/src/CargoHold/API/Federation.hs
index e0ff94dc598..7bdf9a90438 100644
--- a/services/cargohold/src/CargoHold/API/Federation.hs
+++ b/services/cargohold/src/CargoHold/API/Federation.hs
@@ -1,3 +1,5 @@
+{-# LANGUAGE RecordWildCards #-}
+
 -- This file is part of the Wire Server implementation.
 --
 -- Copyright (C) 2021 Wire Swiss GmbH <opensource@wire.com>
@@ -21,7 +23,10 @@ module CargoHold.API.Federation
   )
 where
 
+import CargoHold.API.Error
+import CargoHold.API.V3
 import CargoHold.App
+import qualified CargoHold.S3 as S3
 import Control.Error
 import Imports
 import Servant.API
@@ -30,15 +35,28 @@ import Servant.Server hiding (Handler)
 import Servant.Server.Generic
 import Wire.API.Federation.API
 import qualified Wire.API.Federation.API.Cargohold as F
-import Wire.API.Federation.API.Common
-import Wire.API.Federation.Error
+import Wire.API.Routes.AssetBody
 
 type FederationAPI = "federation" :> ToServantApi (FedApi 'Cargohold)
 
 federationSitemap :: ServerT FederationAPI Handler
 federationSitemap =
   genericServerT $
-    F.CargoholdApi {F.getAsset = getAsset}
+    F.CargoholdApi
+      { F.getAsset = getAsset,
+        F.streamAsset = streamAsset
+      }
+
+checkAsset :: F.GetAsset -> Handler Bool
+checkAsset ga =
+  fmap isJust . runMaybeT $
+    checkMetadata Nothing (F.gaKey ga) (F.gaToken ga)
+
+streamAsset :: F.GetAsset -> Handler AssetSource
+streamAsset ga = do
+  available <- checkAsset ga
+  unless available (throwE assetNotFound)
+  AssetSource <$> S3.downloadV3 (F.gaKey ga)
 
-getAsset :: () -> Handler EmptyResponse
-getAsset _ = throwE federationNotImplemented
+getAsset :: F.GetAsset -> Handler F.GetAssetResponse
+getAsset = fmap F.GetAssetResponse . checkAsset
diff --git a/services/cargohold/src/CargoHold/API/Public.hs b/services/cargohold/src/CargoHold/API/Public.hs
index 81e3d249109..0e2cd8295d0 100644
--- a/services/cargohold/src/CargoHold/API/Public.hs
+++ b/services/cargohold/src/CargoHold/API/Public.hs
@@ -21,6 +21,7 @@ import qualified CargoHold.API.Legacy as LegacyAPI
 import CargoHold.API.Util
 import qualified CargoHold.API.V3 as V3
 import CargoHold.App
+import CargoHold.Federation
 import qualified CargoHold.Types.V3 as V3
 import Control.Lens
 import Data.ByteString.Builder
@@ -30,7 +31,7 @@ import Data.Id
 import Data.Qualified
 import Imports hiding (head)
 import qualified Network.HTTP.Types as HTTP
-import Servant ((:<|>) (..))
+import Servant.API
 import Servant.Server hiding (Handler)
 import URI.ByteString
 import Wire.API.Asset
@@ -141,9 +142,19 @@ downloadAssetV4 ::
   Maybe AssetToken ->
   Maybe AssetToken ->
   Handler (Maybe LocalOrRemoteAsset)
-downloadAssetV4 usr qkey tok1 tok2 = do
-  key <- tUnqualified <$> ensureLocal qkey
-  LocalAsset <$$> downloadAssetV3 usr key tok1 tok2
+downloadAssetV4 usr qkey tok1 tok2 =
+  let tok = tok1 <|> tok2
+   in foldQualified
+        usr
+        ( \lkey ->
+            LocalAsset . AssetLocation
+              <$$> V3.download (mkPrincipal usr) (tUnqualified lkey) tok
+        )
+        ( \rkey ->
+            RemoteAsset
+              <$$> downloadRemoteAsset usr rkey tok
+        )
+        qkey
 
 deleteAssetV3 :: MakePrincipal tag id => id -> AssetKey -> Handler ()
 deleteAssetV3 usr key = V3.delete (mkPrincipal usr) key
diff --git a/services/cargohold/src/CargoHold/API/V3.hs b/services/cargohold/src/CargoHold/API/V3.hs
index 07917d86b08..1a1c3a0ccf7 100644
--- a/services/cargohold/src/CargoHold/API/V3.hs
+++ b/services/cargohold/src/CargoHold/API/V3.hs
@@ -18,6 +18,7 @@
 module CargoHold.API.V3
   ( upload,
     download,
+    checkMetadata,
     delete,
     renewToken,
     deleteToken,
@@ -106,14 +107,14 @@ randToken :: MonadIO m => m V3.AssetToken
 randToken = liftIO $ V3.AssetToken . Ascii.encodeBase64Url <$> getRandomBytes 16
 
 download :: V3.Principal -> V3.AssetKey -> Maybe V3.AssetToken -> Handler (Maybe URI)
-download own key tok = S3.getMetadataV3 key >>= maybe notFound found
-  where
-    notFound = return Nothing
-    found s3
-      | own /= S3.v3AssetOwner s3 && tok /= S3.v3AssetToken s3 = return Nothing
-      | otherwise = do
-        url <- genSignedURL (S3.mkKey key)
-        return $! Just $! url
+download own key tok = runMaybeT $ do
+  checkMetadata (Just own) key tok
+  lift $ genSignedURL (S3.mkKey key)
+
+checkMetadata :: Maybe V3.Principal -> V3.AssetKey -> Maybe V3.AssetToken -> MaybeT Handler ()
+checkMetadata mown key tok = do
+  s3 <- lift (S3.getMetadataV3 key) >>= maybe mzero pure
+  guard $ mown == Just (S3.v3AssetOwner s3) || tok == S3.v3AssetToken s3
 
 delete :: V3.Principal -> V3.AssetKey -> Handler ()
 delete own key = do
diff --git a/services/cargohold/src/CargoHold/AWS.hs b/services/cargohold/src/CargoHold/AWS.hs
index b3b00d531f8..da60da4db38 100644
--- a/services/cargohold/src/CargoHold/AWS.hs
+++ b/services/cargohold/src/CargoHold/AWS.hs
@@ -34,16 +34,17 @@ module CargoHold.AWS
     send,
     sendCatch,
     exec,
+    execStream,
     execCatch,
   )
 where
 
 import CargoHold.CloudFront
 import CargoHold.Options
+import Conduit
 import Control.Lens hiding ((.=))
 import Control.Monad.Catch
 import qualified Control.Monad.Trans.AWS as AWST
-import Control.Monad.Trans.Resource
 import Control.Retry
 import Data.ByteString.Builder (toLazyByteString)
 import Imports
@@ -157,7 +158,7 @@ instance Exception Error
 --------------------------------------------------------------------------------
 -- Utilities
 
-sendCatch :: AWSRequest r => r -> Amazon (Either AWS.Error (Rs r))
+sendCatch :: (MonadCatch m, AWS.MonadAWS m, AWSRequest r) => r -> m (Either AWS.Error (Rs r))
 sendCatch = AWST.trying AWS._Error . AWS.send
 
 send :: AWSRequest r => r -> Amazon (Rs r)
@@ -176,7 +177,7 @@ exec env request = do
   resp <- execute env (sendCatch req)
   case resp of
     Left err -> do
-      Log.info $
+      Logger.info (view logger env) $
         Log.field "remote" (Log.val "S3")
           ~~ Log.msg (show err)
           ~~ Log.msg (show req)
@@ -185,6 +186,25 @@ exec env request = do
       throwM (GeneralError err)
     Right r -> return r
 
+execStream ::
+  (AWSRequest r, Show r) =>
+  Env ->
+  (Text -> r) ->
+  ResourceT IO (Rs r)
+execStream env request = do
+  let req = request (_s3Bucket env)
+  resp <- AWS.runAWS (view amazonkaEnv env) (sendCatch req)
+  case resp of
+    Left err -> do
+      Logger.info (view logger env) $
+        Log.field "remote" (Log.val "S3")
+          ~~ Log.msg (show err)
+          ~~ Log.msg (show req)
+      -- We just re-throw the error, but logging it here also gives us the request
+      -- that caused it.
+      throwM (GeneralError err)
+    Right r -> pure r
+
 execCatch ::
   (AWSRequest r, Show r, MonadLogger m, MonadIO m) =>
   Env ->
diff --git a/services/cargohold/src/CargoHold/App.hs b/services/cargohold/src/CargoHold/App.hs
index faeeb21b9fe..63f8d48543e 100644
--- a/services/cargohold/src/CargoHold/App.hs
+++ b/services/cargohold/src/CargoHold/App.hs
@@ -29,8 +29,9 @@ module CargoHold.App
     metrics,
     appLogger,
     requestId,
-    settings,
     localUnit,
+    options,
+    settings,
 
     -- * App Monad
     AppT,
@@ -51,7 +52,7 @@ import qualified CargoHold.AWS as AWS
 import CargoHold.Options as Opt
 import Control.Error (ExceptT, exceptT)
 import Control.Exception (throw)
-import Control.Lens (makeLenses, view, (^.))
+import Control.Lens (Lens', makeLenses, view, (^.))
 import Control.Monad.Catch (MonadCatch, MonadMask, MonadThrow)
 import Control.Monad.Trans.Resource (ResourceT, runResourceT, transResourceT)
 import Data.Default (def)
@@ -77,12 +78,15 @@ data Env = Env
     _appLogger :: Logger,
     _httpManager :: Manager,
     _requestId :: RequestId,
-    _settings :: Opt.Settings,
+    _options :: Opt.Opts,
     _localUnit :: Local ()
   }
 
 makeLenses ''Env
 
+settings :: Lens' Env Opt.Settings
+settings = options . optSettings
+
 newEnv :: Opts -> IO Env
 newEnv o = do
   met <- Metrics.metrics
@@ -90,7 +94,7 @@ newEnv o = do
   mgr <- initHttpManager (o ^. optAws . awsS3Compatibility)
   ama <- initAws (o ^. optAws) lgr mgr
   let loc = toLocalUnsafe (o ^. optSettings . Opt.setFederationDomain) ()
-  return $ Env ama met lgr mgr def (o ^. optSettings) loc
+  return $ Env ama met lgr mgr def o loc
 
 initAws :: AWSOpts -> Logger -> Manager -> IO AWS.Env
 initAws o l m =
diff --git a/services/cargohold/src/CargoHold/Federation.hs b/services/cargohold/src/CargoHold/Federation.hs
new file mode 100644
index 00000000000..352e5fc0437
--- /dev/null
+++ b/services/cargohold/src/CargoHold/Federation.hs
@@ -0,0 +1,81 @@
+-- This file is part of the Wire Server implementation.
+--
+-- Copyright (C) 2021 Wire Swiss GmbH <opensource@wire.com>
+--
+-- This program is free software: you can redistribute it and/or modify it under
+-- the terms of the GNU Affero General Public License as published by the Free
+-- Software Foundation, either version 3 of the License, or (at your option) any
+-- later version.
+--
+-- This program is distributed in the hope that it will be useful, but WITHOUT
+-- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+-- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+-- details.
+--
+-- You should have received a copy of the GNU Affero General Public License along
+-- with this program. If not, see <https://www.gnu.org/licenses/>.
+
+module CargoHold.Federation where
+
+import CargoHold.App
+import CargoHold.Options
+import Control.Error
+import Control.Lens
+import Data.Id
+import Data.Qualified
+import Imports hiding (head)
+import Servant.API
+import Wire.API.Asset
+import Wire.API.Federation.API
+import Wire.API.Federation.API.Cargohold
+import Wire.API.Federation.Client
+import Wire.API.Federation.Error
+
+-- [Note]
+-- There are several ways a remote asset could be streamed to the client:
+--
+-- "all-the-way": the remote federator streams the asset back to us in the RPC
+--    itself, and we forward it to the client
+-- "two-step": the remote federator returns a redirect response, we follow it
+--    and stream the data to the client
+-- "one-step": the remote federator returns a redirect response, and we simply
+--    forward it to the client
+--
+-- For now, only the "all-the-way" solution is implemented. Note that the asset
+-- is streamed back through our outward federator, as well as the remote one.
+
+downloadRemoteAsset ::
+  Local UserId ->
+  Remote AssetKey ->
+  Maybe AssetToken ->
+  Handler (Maybe (SourceIO ByteString))
+downloadRemoteAsset usr rkey tok = do
+  let ga =
+        GetAsset
+          { gaKey = tUnqualified rkey,
+            gaUser = tUnqualified usr,
+            gaToken = tok
+          }
+  exists <-
+    fmap gaAvailable . executeFederated rkey $
+      getAsset clientRoutes ga
+  if exists
+    then do
+      fmap (Just . toSourceIO) . executeFederated rkey $
+        streamAsset clientRoutes ga
+    else pure Nothing
+
+executeFederated :: Remote x -> FederatorClient 'Cargohold a -> Handler a
+executeFederated remote c = do
+  loc <- view localUnit
+  endpoint <-
+    view (options . optFederator)
+      >>= maybe (throwE federationNotConfigured) pure
+  let env =
+        FederatorClientEnv
+          { ceOriginDomain = tDomain loc,
+            ceTargetDomain = tDomain remote,
+            ceFederator = endpoint
+          }
+  liftIO (runFederatorClient @'Cargohold env c)
+    >>= either (throwE . federationErrorToWai . FederationCallFailure) pure
diff --git a/services/cargohold/src/CargoHold/Options.hs b/services/cargohold/src/CargoHold/Options.hs
index 302bcc68977..f46423b9104 100644
--- a/services/cargohold/src/CargoHold/Options.hs
+++ b/services/cargohold/src/CargoHold/Options.hs
@@ -98,11 +98,15 @@ deriveFromJSON toOptionFieldName ''Settings
 
 makeLenses ''Settings
 
+-- | Options consist of information the server needs to operate, and 'Settings'
+-- modify the behavior.
 data Opts = Opts
   { -- | Hostname and port to bind to
     _optCargohold :: !Endpoint,
     _optAws :: !AWSOpts,
     _optSettings :: !Settings,
+    -- | Federator endpoint
+    _optFederator :: Maybe Endpoint,
     -- Logging
 
     -- | Log level (Debug, Info, etc)
diff --git a/services/cargohold/src/CargoHold/Run.hs b/services/cargohold/src/CargoHold/Run.hs
index 08a98d085a0..bd66227050d 100644
--- a/services/cargohold/src/CargoHold/Run.hs
+++ b/services/cargohold/src/CargoHold/Run.hs
@@ -17,6 +17,7 @@
 
 module CargoHold.Run
   ( run,
+    mkApp,
   )
 where
 
@@ -24,8 +25,9 @@ import CargoHold.API.Federation
 import CargoHold.API.Public
 import CargoHold.App
 import CargoHold.Options
+import Control.Exception (bracket)
 import Control.Lens (set, (^.))
-import Control.Monad.Catch (finally)
+import Control.Monad.Codensity
 import Data.Default
 import Data.Domain
 import Data.Id
@@ -47,13 +49,23 @@ import qualified Wire.API.Routes.Public.Cargohold as Public
 type CombinedAPI = FederationAPI :<|> Public.ServantAPI
 
 run :: Opts -> IO ()
-run o = do
-  e <- newEnv o
-  s <- Server.newSettings (server e)
-  runSettingsWithShutdown s (middleware e $ servantApp e) 5
-    `finally` closeEnv e
+run o = lowerCodensity $ do
+  (app, e) <- mkApp o
+  liftIO $ do
+    s <-
+      Server.newSettings $
+        defaultServer
+          (unpack $ o ^. optCargohold . epHost)
+          (o ^. optCargohold . epPort)
+          (e ^. appLogger)
+          (e ^. metrics)
+    runSettingsWithShutdown s app 5
+
+mkApp :: Opts -> Codensity IO (Application, Env)
+mkApp o = Codensity $ \k ->
+  bracket (newEnv o) closeEnv $ \e ->
+    k (middleware e (servantApp e), e)
   where
-    server e = defaultServer (unpack $ o ^. optCargohold . epHost) (o ^. optCargohold . epPort) (e ^. appLogger) (e ^. metrics)
     middleware :: Env -> Wai.Middleware
     middleware e =
       servantPrometheusMiddleware (Proxy @CombinedAPI)
diff --git a/services/cargohold/src/CargoHold/S3.hs b/services/cargohold/src/CargoHold/S3.hs
index 7ad9c43a038..22fecb6dc67 100644
--- a/services/cargohold/src/CargoHold/S3.hs
+++ b/services/cargohold/src/CargoHold/S3.hs
@@ -23,6 +23,7 @@ module CargoHold.S3
   ( S3AssetKey,
     S3AssetMeta (..),
     uploadV3,
+    downloadV3,
     getMetadataV3,
     updateMetadataV3,
     deleteV3,
@@ -50,7 +51,7 @@ import Data.ByteString.Builder (toLazyByteString)
 import Data.ByteString.Conversion
 import qualified Data.ByteString.Lazy as LBS
 import qualified Data.CaseInsensitive as CI
-import qualified Data.Conduit.Binary as Conduit
+import Data.Conduit.Binary
 import qualified Data.HashMap.Lazy as HML
 import Data.Id
 import qualified Data.Text as Text
@@ -95,7 +96,7 @@ uploadV3 ::
   V3.AssetKey ->
   V3.AssetHeaders ->
   Maybe V3.AssetToken ->
-  Conduit.ConduitM () ByteString (ResourceT IO) () ->
+  ConduitM () ByteString (ResourceT IO) () ->
   ExceptT Error App ()
 uploadV3 prc (s3Key . mkKey -> key) originalHeaders@(V3.AssetHeaders _ cl) tok src = do
   Log.info $
@@ -115,9 +116,9 @@ uploadV3 prc (s3Key . mkKey -> key) originalHeaders@(V3.AssetHeaders _ cl) tok s
       src
         -- Rechunk bytestream to ensure we satisfy AWS's minimum chunk size
         -- on uploads
-        .| Conduit.chunksOfCE (fromIntegral defaultChunkSize)
+        .| chunksOfCE (fromIntegral defaultChunkSize)
         -- Ignore any 'junk' after the content; take only 'cl' bytes.
-        .| Conduit.isolate (fromIntegral cl)
+        .| isolate (fromIntegral cl)
 
     reqBdy :: ChunkedBody
     reqBdy = ChunkedBody defaultChunkSize (fromIntegral cl) stream
@@ -128,6 +129,28 @@ uploadV3 prc (s3Key . mkKey -> key) originalHeaders@(V3.AssetHeaders _ cl) tok s
         & poContentType ?~ MIME.showType ct
         & poMetadata .~ metaHeaders tok prc
 
+-- | Turn a 'ResourceT IO' action into a pure @Conduit@.
+--
+-- This is possible because @Conduit@ itself is a monad transformer over
+-- 'ResourceT IO'. Removing the outer 'ResourceT IO' layer makes it possible to
+-- pass this @Conduit@ to resource-oblivious code.
+flattenResourceT ::
+  ResourceT IO (ConduitT () ByteString (ResourceT IO) ()) ->
+  ConduitT () ByteString (ResourceT IO) ()
+flattenResourceT = join . lift
+
+downloadV3 ::
+  V3.AssetKey ->
+  ExceptT Error App (ConduitM () ByteString (ResourceT IO) ())
+downloadV3 (s3Key . mkKey -> key) = do
+  env <- view aws
+  pure . flattenResourceT $ _streamBody . view gorsBody <$> AWS.execStream env req
+  where
+    req :: Text -> GetObject
+    req b =
+      getObject (BucketName b) (ObjectKey key)
+        & goResponseContentType ?~ MIME.showType octets
+
 getMetadataV3 :: V3.AssetKey -> ExceptT Error App (Maybe S3AssetMeta)
 getMetadataV3 (s3Key . mkKey -> key) = do
   Log.debug $
diff --git a/services/cargohold/test/integration/API.hs b/services/cargohold/test/integration/API.hs
index 51f60a757ba..a4787321034 100644
--- a/services/cargohold/test/integration/API.hs
+++ b/services/cargohold/test/integration/API.hs
@@ -22,23 +22,34 @@ module API (tests) where
 import API.Util
 import Bilge hiding (body)
 import Bilge.Assert
+import CargoHold.API.Error
+import CargoHold.Types
 import qualified CargoHold.Types.V3 as V3
 import qualified Codec.MIME.Type as MIME
+import Control.Exception (throw)
 import Control.Lens hiding (sets)
+import qualified Data.Aeson as Aeson
 import qualified Data.ByteString.Char8 as C8
 import Data.ByteString.Conversion
+import Data.Domain
 import Data.Id
 import Data.Qualified
+import qualified Data.Text.Encoding.Error as Text
+import qualified Data.Text.Lazy.Encoding as LText
 import Data.Time.Clock
 import Data.Time.Format
 import Data.UUID.V4
+import Federator.MockServer
 import Imports hiding (head)
 import Network.HTTP.Client (parseUrlThrow)
-import Network.HTTP.Types.Status (status200)
+import Network.HTTP.Media ((//))
+import qualified Network.HTTP.Types as HTTP
 import Network.Wai.Utilities (Error (label))
 import Test.Tasty
 import Test.Tasty.HUnit
 import TestSetup
+import Wire.API.Federation.API.Cargohold
+import Wire.API.Federation.Component
 
 tests :: IO TestSetup -> TestTree
 tests s =
@@ -50,14 +61,20 @@ tests s =
           test s "tokens" testSimpleTokens,
           test s "s3-upstream-closed" testSimpleS3ClosedConnectionReuse,
           test s "client-compatibility" testUploadCompatibility
+        ],
+      testGroup
+        "remote"
+        [ test s "remote download wrong domain" testRemoteDownloadWrongDomain,
+          test s "remote download no asset" testRemoteDownloadNoAsset,
+          test s "remote download" testRemoteDownload
         ]
     ]
 
 --------------------------------------------------------------------------------
 -- Simple (single-step) uploads
 
-testSimpleRoundtrip :: TestSignature ()
-testSimpleRoundtrip c = do
+testSimpleRoundtrip :: TestM ()
+testSimpleRoundtrip = do
   let def = V3.defAssetSettings
   let rets = [minBound ..]
   let sets = def : map (\r -> def & V3.setAssetRetention ?~ r) rets
@@ -69,7 +86,7 @@ testSimpleRoundtrip c = do
       -- Initial upload
       let bdy = (applicationText, "Hello World")
       r1 <-
-        uploadSimple (c . path "/assets/v3") uid sets bdy
+        uploadSimple (path "/assets/v3") uid sets bdy
           <!! const 201 === statusCode
       let loc = decodeHeaderOrFail "Location" r1 :: ByteString
       let Just ast = responseJsonMaybe @V3.Asset r1
@@ -82,109 +99,105 @@ testSimpleRoundtrip c = do
         liftIO $ assertBool "invalid expiration" (Just utc < view V3.assetExpires ast)
       -- Lookup with token and download via redirect.
       r2 <-
-        get (c . path loc . zUser uid . header "Asset-Token" (toByteString' tok) . noRedirect) <!! do
+        downloadAsset uid loc (Just tok) <!! do
           const 302 === statusCode
           const Nothing === responseBody
       r3 <- flip get' id =<< parseUrlThrow (C8.unpack (getHeader' "Location" r2))
       liftIO $ do
-        assertEqual "status" status200 (responseStatus r3)
+        assertEqual "status" HTTP.status200 (responseStatus r3)
         assertEqual "content-type should always be application/octet-stream" (Just applicationOctetStream) (getContentType r3)
         assertEqual "token mismatch" tok (decodeHeaderOrFail "x-amz-meta-token" r3)
         assertEqual "user mismatch" uid (decodeHeaderOrFail "x-amz-meta-user" r3)
         assertEqual "data mismatch" (Just "Hello World") (responseBody r3)
       -- Delete (forbidden for other users)
-      deleteAsset c uid2 (view V3.assetKey ast) !!! const 403 === statusCode
+      deleteAsset uid2 (view V3.assetKey ast) !!! const 403 === statusCode
       -- Delete (allowed for creator)
-      deleteAsset c uid (view V3.assetKey ast) !!! const 200 === statusCode
-      r4 <-
-        get (c . path loc . zUser uid . header "Asset-Token" (toByteString' tok) . noRedirect)
-          <!! const 404 === statusCode
+      deleteAsset uid (view V3.assetKey ast) !!! const 200 === statusCode
+      r4 <- downloadAsset uid loc (Just tok) <!! const 404 === statusCode
       let Just date' = C8.unpack <$> lookup "Date" (responseHeaders r4)
       let utc' = parseTimeOrError False defaultTimeLocale rfc822DateFormat date' :: UTCTime
       liftIO $ assertBool "bad date" (utc' >= utc)
 
-testSimpleTokens :: TestSignature ()
-testSimpleTokens c = do
+testSimpleTokens :: TestM ()
+testSimpleTokens = do
   uid <- liftIO $ Id <$> nextRandom
   uid2 <- liftIO $ Id <$> nextRandom
   -- Initial upload
   let sets = V3.defAssetSettings & set V3.setAssetRetention (Just V3.AssetVolatile)
   let bdy = (applicationText, "Hello World")
   r1 <-
-    uploadSimple (c . path "/assets/v3") uid sets bdy
+    uploadSimple (path "/assets/v3") uid sets bdy
       <!! const 201 === statusCode
   let loc = decodeHeaderOrFail "Location" r1 :: ByteString
   let Just ast = responseJsonMaybe @V3.Asset r1
   let key = view V3.assetKey ast
   let Just tok = view V3.assetToken ast
   -- No access without token from other user (opaque 404)
-  get (c . path loc . zUser uid2 . noRedirect)
+  downloadAsset uid2 loc ()
     !!! const 404 === statusCode
   -- No access with empty token query parameter from other user (opaque 404)
-  get (c . path loc . zUser uid2 . queryItem' "asset_token" Nothing . noRedirect)
+  downloadAsset uid2 loc (queryItem' "asset_token" Nothing)
     !!! const 404 === statusCode
   -- No access with wrong token (opaque 404)
-  get (c . path loc . zUser uid2 . header "Asset-Token" "acb123" . noRedirect)
+  downloadAsset uid2 loc (Just (AssetToken "abc123"))
     !!! const 404 === statusCode
   -- No access with wrong token as query parameter (opaque 404)
-  get (c . path loc . zUser uid2 . queryItem "asset_token" "acb123" . noRedirect)
+  downloadAsset uid2 loc (queryItem "asset_token" "acb123")
     !!! const 404 === statusCode
   -- Token renewal fails if not done by owner
-  post (c . paths ["assets", "v3", toByteString' (qUnqualified key), "token"] . zUser uid2) !!! do
+  postToken uid2 (qUnqualified key) !!! do
     const 403 === statusCode
     const (Just "unauthorised") === fmap label . responseJsonMaybe
   -- Token renewal succeeds if done by owner
-  r2 <-
-    post (c . paths ["assets", "v3", toByteString' (qUnqualified key), "token"] . zUser uid)
-      <!! const 200 === statusCode
+  r2 <- postToken uid (qUnqualified key) <!! const 200 === statusCode
   let Just tok' = V3.newAssetToken <$> responseJsonMaybe r2
   liftIO $ assertBool "token unchanged" (tok /= tok')
   -- Download by owner with new token.
   r3 <-
-    get (c . path loc . zUser uid . header "Asset-Token" (toByteString' tok') . noRedirect) <!! do
+    downloadAsset uid loc (Just tok') <!! do
       const 302 === statusCode
       const Nothing === responseBody
   r4 <- flip get' id =<< parseUrlThrow (C8.unpack (getHeader' "Location" r3))
   liftIO $ do
-    assertEqual "status" status200 (responseStatus r4)
+    assertEqual "status" HTTP.status200 (responseStatus r4)
     assertEqual "content-type should always be application/octet-stream" (Just applicationOctetStream) (getContentType r4)
     assertEqual "token mismatch" tok' (decodeHeaderOrFail "x-amz-meta-token" r4)
     assertEqual "user mismatch" uid (decodeHeaderOrFail "x-amz-meta-user" r4)
     assertEqual "data mismatch" (Just "Hello World") (responseBody r4)
   -- Verify access without token if the request comes from the creator.
-  get (c . path loc . zUser uid . noRedirect)
+  downloadAsset uid loc ()
     !!! const 302 === statusCode
   -- Verify access with new token from a different user.
-  get (c . path loc . header "Asset-Token" (toByteString' tok') . zUser uid2 . noRedirect)
+  downloadAsset uid2 loc (Just tok')
     !!! const 302 === statusCode
   -- Verify access with new token as query parameter from a different user
-  get (c . path loc . queryItem "asset_token" (toByteString' tok') . zUser uid2 . noRedirect)
+  downloadAsset uid2 loc (queryItem "asset_token" (toByteString' tok'))
     !!! const 302 === statusCode
   -- Delete Token fails if not done by owner
-  delete (c . paths ["assets", "v3", toByteString' (qUnqualified key), "token"] . zUser uid2) !!! do
+  deleteToken uid2 (qUnqualified key) !!! do
     const 403 === statusCode
     const (Just "unauthorised") === fmap label . responseJsonMaybe
   -- Delete Token succeeds by owner
-  delete (c . paths ["assets", "v3", toByteString' (qUnqualified key), "token"] . zUser uid) !!! do
+  deleteToken uid (qUnqualified key) !!! do
     const 200 === statusCode
     const Nothing === responseBody
   -- Access without token from different user (asset is now "public")
-  get (c . path loc . noRedirect . zUser uid2) !!! do
+  downloadAsset uid2 loc () !!! do
     const 302 === statusCode
     const Nothing === responseBody
 
 -- S3 closes idle connections after ~5 seconds, before the http-client 'Manager'
 -- does. If such a closed connection is reused for an upload, no problems should
 -- occur (i.e. the closed connection should be detected before sending any data).
-testSimpleS3ClosedConnectionReuse :: TestSignature ()
-testSimpleS3ClosedConnectionReuse c = go >> wait >> go
+testSimpleS3ClosedConnectionReuse :: TestM ()
+testSimpleS3ClosedConnectionReuse = go >> wait >> go
   where
     wait = liftIO $ putStrLn "Waiting for S3 idle timeout ..." >> threadDelay 7000000
     go = do
       uid <- liftIO $ Id <$> nextRandom
       let sets = V3.defAssetSettings & set V3.setAssetRetention (Just V3.AssetVolatile)
       let part2 = (MIME.Type (MIME.Text "plain") [], C8.replicate 100000 'c')
-      uploadSimple (c . path "/assets/v3") uid sets part2
+      uploadSimple (path "/assets/v3") uid sets part2
         !!! const 201 === statusCode
 
 --------------------------------------------------------------------------------
@@ -196,22 +209,22 @@ testSimpleS3ClosedConnectionReuse c = go >> wait >> go
 --
 -- The body is taken directly from a request made by the web app
 -- (just replaced the content with a shorter one and updated the MD5 header).
-testUploadCompatibility :: TestSignature ()
-testUploadCompatibility c = do
+testUploadCompatibility :: TestM ()
+testUploadCompatibility = do
   uid <- liftIO $ Id <$> nextRandom
   -- Initial upload
   r1 <-
-    uploadRaw (c . path "/assets/v3") uid exampleMultipart
+    uploadRaw (path "/assets/v3") uid exampleMultipart
       <!! const 201 === statusCode
   let loc = decodeHeaderOrFail "Location" r1 :: ByteString
   -- Lookup and download via redirect.
   r2 <-
-    get (c . path loc . zUser uid . noRedirect) <!! do
+    downloadAsset uid loc () <!! do
       const 302 === statusCode
       const Nothing === responseBody
   r3 <- flip get' id =<< parseUrlThrow (C8.unpack (getHeader' "Location" r2))
   liftIO $ do
-    assertEqual "status" status200 (responseStatus r3)
+    assertEqual "status" HTTP.status200 (responseStatus r3)
     assertEqual "content-type mismatch" (Just applicationOctetStream) (getContentType r3)
     assertEqual "user mismatch" uid (decodeHeaderOrFail "x-amz-meta-user" r3)
     assertEqual "data mismatch" (Just "test") (responseBody r3)
@@ -231,3 +244,82 @@ testUploadCompatibility c = do
       \test\r\n\
       \--FrontierIyj6RcVrqMcxNtMEWPsNpuPm325QsvWQ--\r\n\
       \\r\n"
+
+--------------------------------------------------------------------------------
+-- Federation behaviour
+
+testRemoteDownloadWrongDomain :: TestM ()
+testRemoteDownloadWrongDomain = do
+  assetId <- liftIO $ Id <$> nextRandom
+  uid <- liftIO $ Id <$> nextRandom
+
+  let key = AssetKeyV3 assetId AssetPersistent
+      qkey = Qualified key (Domain "invalid.example.com")
+  downloadAsset uid qkey () !!! do
+    const 422 === statusCode
+
+testRemoteDownloadNoAsset :: TestM ()
+testRemoteDownloadNoAsset = do
+  assetId <- liftIO $ Id <$> nextRandom
+  uid <- liftIO $ Id <$> nextRandom
+  let key = AssetKeyV3 assetId AssetPersistent
+      qkey = Qualified key (Domain "faraway.example.com")
+      respond req
+        | frRPC req == "get-asset" =
+          pure ("application" // "json", Aeson.encode (GetAssetResponse False))
+        | otherwise =
+          throw
+            . MockErrorResponse HTTP.status404
+            . LText.decodeUtf8With Text.lenientDecode
+            . Aeson.encode
+            $ assetNotFound
+  (_, reqs) <- withMockFederator respond $ do
+    downloadAsset uid qkey () !!! do
+      const 404 === statusCode
+  localDomain <- viewFederationDomain
+  liftIO $
+    reqs
+      @?= [ FederatedRequest
+              { frOriginDomain = localDomain,
+                frTargetDomain = Domain "faraway.example.com",
+                frComponent = Cargohold,
+                frRPC = "get-asset",
+                frBody = Aeson.encode (GetAsset uid key Nothing)
+              }
+          ]
+
+testRemoteDownload :: TestM ()
+testRemoteDownload = do
+  assetId <- liftIO $ Id <$> nextRandom
+  uid <- liftIO $ Id <$> nextRandom
+
+  let key = AssetKeyV3 assetId AssetPersistent
+      qkey = Qualified key (Domain "faraway.example.com")
+      respond req
+        | frRPC req == "get-asset" =
+          pure ("application" // "json", Aeson.encode (GetAssetResponse True))
+        | otherwise = pure ("application" // "octet-stream", "asset content")
+  (_, reqs) <- withMockFederator respond $ do
+    downloadAsset uid qkey () !!! do
+      const 200 === statusCode
+      const (Just "asset content") === responseBody
+
+  localDomain <- viewFederationDomain
+  let ga = Aeson.encode (GetAsset uid key Nothing)
+  liftIO $
+    reqs
+      @?= [ FederatedRequest
+              { frOriginDomain = localDomain,
+                frTargetDomain = Domain "faraway.example.com",
+                frComponent = Cargohold,
+                frRPC = "get-asset",
+                frBody = ga
+              },
+            FederatedRequest
+              { frOriginDomain = localDomain,
+                frTargetDomain = Domain "faraway.example.com",
+                frComponent = Cargohold,
+                frRPC = "stream-asset",
+                frBody = ga
+              }
+          ]
diff --git a/services/cargohold/test/integration/API/Federation.hs b/services/cargohold/test/integration/API/Federation.hs
new file mode 100644
index 00000000000..6b94788a23d
--- /dev/null
+++ b/services/cargohold/test/integration/API/Federation.hs
@@ -0,0 +1,226 @@
+module API.Federation (tests) where
+
+import API.Util
+import Bilge
+import Bilge.Assert
+import CargoHold.API.V3 (randToken)
+import Conduit
+import Control.Lens
+import Crypto.Random
+import Data.Id
+import Data.Qualified
+import Data.UUID.V4
+import Imports
+import qualified Network.HTTP.Types as HTTP
+import qualified Network.Wai.Utilities.Error as Wai
+import Servant.Client.Generic
+import Test.Tasty
+import Test.Tasty.HUnit
+import TestSetup
+import Wire.API.Asset
+import Wire.API.Federation.API.Cargohold
+import Wire.API.Routes.AssetBody
+
+tests :: IO TestSetup -> TestTree
+tests s =
+  testGroup
+    "API Federation"
+    [ testGroup
+        "get-asset"
+        [ test s "private asset is available" (testGetAssetAvailable False),
+          test s "public asset is available" (testGetAssetAvailable True),
+          test s "not available" testGetAssetNotAvailable,
+          test s "wrong token" testGetAssetWrongToken
+        ],
+      testGroup
+        "stream-asset"
+        [ test s "streaming large asset" testLargeAsset,
+          test s "stream an asset" testStreamAsset,
+          test s "stream asset not available" testStreamAssetNotAvailable,
+          test s "stream asset wrong token" testStreamAssetWrongToken
+        ]
+    ]
+
+testGetAssetAvailable :: Bool -> TestM ()
+testGetAssetAvailable isPublicAsset = do
+  -- Initial upload
+  let bdy = (applicationOctetStream, "Hello World")
+      settings =
+        defAssetSettings
+          & set setAssetRetention (Just AssetVolatile)
+          & set setAssetPublic isPublicAsset
+  uid <- liftIO $ Id <$> nextRandom
+  ast :: Asset <-
+    responseJsonError
+      =<< uploadSimple (path "/assets/v3") uid settings bdy
+      <!! const 201 === statusCode
+
+  -- Call get-asset federation API
+  let tok = view assetToken ast
+  let key = view assetKey ast
+  let ga =
+        GetAsset
+          { gaUser = uid,
+            gaToken = tok,
+            gaKey = qUnqualified key
+          }
+  ok <-
+    withFederationClient $
+      gaAvailable <$> runFederationClient (getAsset genericClient ga)
+
+  -- check that asset is available
+  liftIO $ ok @?= True
+
+testGetAssetNotAvailable :: TestM ()
+testGetAssetNotAvailable = do
+  uid <- liftIO $ Id <$> nextRandom
+  token <- randToken
+
+  assetId <- liftIO $ Id <$> nextRandom
+  let key = AssetKeyV3 assetId AssetPersistent
+  let ga =
+        GetAsset
+          { gaUser = uid,
+            gaToken = Just token,
+            gaKey = key
+          }
+  ok <-
+    withFederationClient $
+      gaAvailable <$> runFederationClient (getAsset genericClient ga)
+
+  -- check that asset is not available
+  liftIO $ ok @?= False
+
+testGetAssetWrongToken :: TestM ()
+testGetAssetWrongToken = do
+  -- Initial upload
+  let bdy = (applicationOctetStream, "Hello World")
+      settings = defAssetSettings & set setAssetRetention (Just AssetVolatile)
+  uid <- liftIO $ Id <$> nextRandom
+  ast :: Asset <-
+    responseJsonError
+      =<< uploadSimple (path "/assets/v3") uid settings bdy
+      <!! const 201 === statusCode
+
+  -- Call get-asset federation API with wrong (random) token
+  tok <- randToken
+  let key = view assetKey ast
+  let ga =
+        GetAsset
+          { gaUser = uid,
+            gaToken = Just tok,
+            gaKey = qUnqualified key
+          }
+  ok <-
+    withFederationClient $
+      gaAvailable <$> runFederationClient (getAsset genericClient ga)
+
+  -- check that asset is not available
+  liftIO $ ok @?= False
+
+testLargeAsset :: TestM ()
+testLargeAsset = do
+  -- Initial upload
+  let settings =
+        defAssetSettings
+          & set setAssetRetention (Just AssetVolatile)
+  uid <- liftIO $ Id <$> nextRandom
+  -- generate random bytes
+  let size = 1024 * 1024
+  bs <- liftIO $ getRandomBytes size
+
+  ast :: Asset <-
+    responseJsonError
+      =<< uploadSimple (path "/assets/v3") uid settings (applicationOctetStream, bs)
+      <!! const 201 === statusCode
+
+  -- Call get-asset federation API
+  let tok = view assetToken ast
+  let key = view assetKey ast
+  let ga =
+        GetAsset
+          { gaUser = uid,
+            gaToken = tok,
+            gaKey = qUnqualified key
+          }
+  chunks <- withFederationClient $ do
+    source <- getAssetSource <$> runFederationClient (streamAsset genericClient ga)
+    liftIO . runResourceT $ connect source sinkList
+  liftIO $ do
+    let minNumChunks = 8
+    assertBool
+      ("Expected at least " <> show minNumChunks <> " chunks, got " <> show (length chunks))
+      (length chunks > minNumChunks)
+    mconcat chunks @?= bs
+
+testStreamAsset :: TestM ()
+testStreamAsset = do
+  -- Initial upload
+  let bdy = (applicationOctetStream, "Hello World")
+      settings =
+        defAssetSettings
+          & set setAssetRetention (Just AssetVolatile)
+  uid <- liftIO $ Id <$> nextRandom
+  ast :: Asset <-
+    responseJsonError
+      =<< uploadSimple (path "/assets/v3") uid settings bdy
+      <!! const 201 === statusCode
+
+  -- Call get-asset federation API
+  let tok = view assetToken ast
+  let key = view assetKey ast
+  let ga =
+        GetAsset
+          { gaUser = uid,
+            gaToken = tok,
+            gaKey = qUnqualified key
+          }
+  respBody <- withFederationClient $ do
+    source <- getAssetSource <$> runFederationClient (streamAsset genericClient ga)
+    liftIO . runResourceT $ connect source sinkLazy
+  liftIO $ respBody @?= "Hello World"
+
+testStreamAssetNotAvailable :: TestM ()
+testStreamAssetNotAvailable = do
+  uid <- liftIO $ Id <$> nextRandom
+  token <- randToken
+
+  assetId <- liftIO $ Id <$> nextRandom
+  let key = AssetKeyV3 assetId AssetPersistent
+  let ga =
+        GetAsset
+          { gaUser = uid,
+            gaToken = Just token,
+            gaKey = key
+          }
+  err <- withFederationError $ do
+    runFederationClient (streamAsset genericClient ga)
+  liftIO $ do
+    Wai.code err @?= HTTP.notFound404
+    Wai.label err @?= "not-found"
+
+testStreamAssetWrongToken :: TestM ()
+testStreamAssetWrongToken = do
+  -- Initial upload
+  let bdy = (applicationOctetStream, "Hello World")
+      settings = defAssetSettings & set setAssetRetention (Just AssetVolatile)
+  uid <- liftIO $ Id <$> nextRandom
+  ast :: Asset <-
+    responseJsonError
+      =<< uploadSimple (path "/assets/v3") uid settings bdy
+      <!! const 201 === statusCode
+
+  -- Call get-asset federation API with wrong (random) token
+  tok <- randToken
+  let key = view assetKey ast
+  let ga =
+        GetAsset
+          { gaUser = uid,
+            gaToken = Just tok,
+            gaKey = qUnqualified key
+          }
+  err <- withFederationError $ do
+    runFederationClient (streamAsset genericClient ga)
+  liftIO $ do
+    Wai.code err @?= HTTP.notFound404
+    Wai.label err @?= "not-found"
diff --git a/services/cargohold/test/integration/API/Util.hs b/services/cargohold/test/integration/API/Util.hs
index 2cf1b68b23c..e45140b3cb9 100644
--- a/services/cargohold/test/integration/API/Util.hs
+++ b/services/cargohold/test/integration/API/Util.hs
@@ -18,29 +18,39 @@
 module API.Util where
 
 import Bilge hiding (body)
-import qualified CargoHold.Types.V3 as V3
+import CargoHold.Options
+import CargoHold.Run
 import qualified Codec.MIME.Parse as MIME
 import qualified Codec.MIME.Type as MIME
+import Control.Lens
+import Control.Monad.Catch
+import Control.Monad.Codensity
 import Data.ByteString.Builder
 import Data.ByteString.Conversion
 import qualified Data.ByteString.Lazy as Lazy
+import Data.Domain
 import Data.Id
 import Data.Qualified
 import Data.Text.Encoding (decodeLatin1)
 import qualified Data.UUID as UUID
+import Federator.MockServer
 import Imports hiding (head)
+import qualified Network.HTTP.Media as HTTP
 import Network.HTTP.Types.Header
 import Network.HTTP.Types.Method
+import qualified Network.Wai as Wai
 import TestSetup
+import Util.Options
+import Wire.API.Asset
 
 uploadSimple ::
-  CargoHold ->
+  (Request -> Request) ->
   UserId ->
-  V3.AssetSettings ->
+  AssetSettings ->
   (MIME.Type, ByteString) ->
-  Http (Response (Maybe Lazy.ByteString))
-uploadSimple c usr sets (ct, bs) =
-  let mp = V3.buildMultipartBody sets ct (Lazy.fromStrict bs)
+  TestM (Response (Maybe Lazy.ByteString))
+uploadSimple c usr sts (ct, bs) =
+  let mp = buildMultipartBody sts ct (Lazy.fromStrict bs)
    in uploadRaw c usr (toLazyByteString mp)
 
 decodeHeaderOrFail :: (HasCallStack, FromByteString a) => HeaderName -> Response b -> a
@@ -50,13 +60,14 @@ decodeHeaderOrFail h =
     . getHeader' h
 
 uploadRaw ::
-  CargoHold ->
+  (Request -> Request) ->
   UserId ->
   Lazy.ByteString ->
-  Http (Response (Maybe Lazy.ByteString))
-uploadRaw c usr bs =
+  TestM (Response (Maybe Lazy.ByteString))
+uploadRaw c usr bs = do
+  cargohold <- viewCargohold
   post $
-    c
+    c . cargohold
       . method POST
       . zUser usr
       . zConn "conn"
@@ -78,11 +89,14 @@ zUser = header "Z-User" . UUID.toASCIIBytes . toUUID
 zConn :: ByteString -> Request -> Request
 zConn = header "Z-Connection"
 
-deleteAssetV3 :: CargoHold -> UserId -> Qualified V3.AssetKey -> Http (Response (Maybe Lazy.ByteString))
-deleteAssetV3 c u k = delete $ c . zUser u . paths ["assets", "v3", toByteString' (qUnqualified k)]
+deleteAssetV3 :: UserId -> Qualified AssetKey -> TestM (Response (Maybe Lazy.ByteString))
+deleteAssetV3 u k = do
+  c <- viewCargohold
+  delete $ c . zUser u . paths ["assets", "v3", toByteString' (qUnqualified k)]
 
-deleteAsset :: CargoHold -> UserId -> Qualified V3.AssetKey -> Http (Response (Maybe Lazy.ByteString))
-deleteAsset c u k =
+deleteAsset :: UserId -> Qualified AssetKey -> TestM (Response (Maybe Lazy.ByteString))
+deleteAsset u k = do
+  c <- viewCargohold
   delete $
     c . zUser u
       . paths
@@ -91,3 +105,90 @@ deleteAsset c u k =
           toByteString' (qDomain k),
           toByteString' (qUnqualified k)
         ]
+
+class IsAssetLocation key where
+  locationPath :: key -> Request -> Request
+
+instance IsAssetLocation AssetKey where
+  locationPath k = paths ["assets", "v3", toByteString' k]
+
+instance IsAssetLocation (Qualified AssetKey) where
+  locationPath k = paths ["assets", "v4", toByteString' (qDomain k), toByteString' (qUnqualified k)]
+
+instance IsAssetLocation ByteString where
+  locationPath = path
+
+class IsAssetToken tok where
+  tokenParam :: tok -> Request -> Request
+
+instance IsAssetToken () where
+  tokenParam _ = id
+
+instance IsAssetToken (Maybe AssetToken) where
+  tokenParam = maybe id (header "Asset-Token" . toByteString')
+
+instance IsAssetToken (Request -> Request) where
+  tokenParam = id
+
+downloadAsset ::
+  (IsAssetLocation loc, IsAssetToken tok) =>
+  UserId ->
+  loc ->
+  tok ->
+  TestM (Response (Maybe LByteString))
+downloadAsset uid loc tok = do
+  c <- viewCargohold
+  get $
+    c . zUser uid
+      . locationPath loc
+      . tokenParam tok
+      . noRedirect
+
+postToken :: UserId -> AssetKey -> TestM (Response (Maybe LByteString))
+postToken uid key = do
+  c <- viewCargohold
+  post $
+    c . zUser uid
+      . paths ["assets", "v3", toByteString' key, "token"]
+
+deleteToken :: UserId -> AssetKey -> TestM (Response (Maybe LByteString))
+deleteToken uid key = do
+  c <- viewCargohold
+  delete $
+    c . zUser uid
+      . paths ["assets", "v3", toByteString' key, "token"]
+
+viewFederationDomain :: TestM Domain
+viewFederationDomain = view (tsOpts . optSettings . setFederationDomain)
+
+--------------------------------------------------------------------------------
+-- Mocking utilities
+
+withMockServer :: Wai.Application -> Codensity IO Word16
+withMockServer app = Codensity $ \k ->
+  bracket
+    (liftIO $ startMockServer Nothing app)
+    (liftIO . fst)
+    (k . fromIntegral . snd)
+
+withSettingsOverrides :: (Opts -> Opts) -> TestM a -> TestM a
+withSettingsOverrides f action = do
+  ts <- ask
+  let opts = f (view tsOpts ts)
+  liftIO . lowerCodensity $ do
+    (app, _) <- mkApp opts
+    p <- withMockServer app
+    liftIO $ runTestM (ts & tsEndpoint %~ setLocalEndpoint p) action
+
+setLocalEndpoint :: Word16 -> Endpoint -> Endpoint
+setLocalEndpoint p = (epPort .~ p) . (epHost .~ "127.0.0.1")
+
+withMockFederator ::
+  (FederatedRequest -> IO (HTTP.MediaType, LByteString)) ->
+  TestM a ->
+  TestM (a, [FederatedRequest])
+withMockFederator respond action = do
+  withTempMockFederator [] respond $ \p ->
+    withSettingsOverrides
+      (optFederator . _Just %~ setLocalEndpoint (fromIntegral p))
+      action
diff --git a/services/cargohold/test/integration/API/V3.hs b/services/cargohold/test/integration/API/V3.hs
index 1b4faaabd54..d04b9d18ef8 100644
--- a/services/cargohold/test/integration/API/V3.hs
+++ b/services/cargohold/test/integration/API/V3.hs
@@ -24,7 +24,6 @@ import Bilge hiding (body)
 import Bilge.Assert
 import Control.Lens hiding (sets)
 import qualified Data.ByteString.Char8 as C8
-import Data.ByteString.Conversion
 import Data.Id
 import Data.Qualified
 import Data.Time.Clock
@@ -50,8 +49,8 @@ tests s =
 --------------------------------------------------------------------------------
 -- Simple (single-step) uploads
 
-testSimpleRoundtrip :: TestSignature ()
-testSimpleRoundtrip c = do
+testSimpleRoundtrip :: TestM ()
+testSimpleRoundtrip = do
   let def = defAssetSettings
   let rets = [minBound ..]
   let sets = def : map (\r -> def & setAssetRetention ?~ r) rets
@@ -63,11 +62,11 @@ testSimpleRoundtrip c = do
       -- Initial upload
       let bdy = (applicationText, "Hello World")
       r1 <-
-        uploadSimple (c . path "/assets/v3") uid sets bdy
+        uploadSimple (path "/assets/v3") uid sets bdy
           <!! const 201 === statusCode
       -- use v3 path instead of the one returned in the header
       let Just ast = responseJsonMaybe @Asset r1
-      let loc = "/assets/v3/" <> toByteString' (qUnqualified (ast ^. assetKey))
+      let key = qUnqualified (ast ^. assetKey)
       let Just tok = view assetToken ast
       -- Check mandatory Date header
       let Just date = C8.unpack <$> lookup "Date" (responseHeaders r1)
@@ -77,7 +76,7 @@ testSimpleRoundtrip c = do
         liftIO $ assertBool "invalid expiration" (Just utc < view assetExpires ast)
       -- Lookup with token and download via redirect.
       r2 <-
-        get (c . path loc . zUser uid . header "Asset-Token" (toByteString' tok) . noRedirect) <!! do
+        downloadAsset uid key (Just tok) <!! do
           const 302 === statusCode
           const Nothing === responseBody
       r3 <- flip get' id =<< parseUrlThrow (C8.unpack (getHeader' "Location" r2))
@@ -88,11 +87,11 @@ testSimpleRoundtrip c = do
         assertEqual "user mismatch" uid (decodeHeaderOrFail "x-amz-meta-user" r3)
         assertEqual "data mismatch" (Just "Hello World") (responseBody r3)
       -- Delete (forbidden for other users)
-      deleteAssetV3 c uid2 (view assetKey ast) !!! const 403 === statusCode
+      deleteAssetV3 uid2 (view assetKey ast) !!! const 403 === statusCode
       -- Delete (allowed for creator)
-      deleteAssetV3 c uid (view assetKey ast) !!! const 200 === statusCode
+      deleteAssetV3 uid (view assetKey ast) !!! const 200 === statusCode
       r4 <-
-        get (c . path loc . zUser uid . header "Asset-Token" (toByteString' tok) . noRedirect)
+        downloadAsset uid key (Just tok)
           <!! const 404 === statusCode
       let Just date' = C8.unpack <$> lookup "Date" (responseHeaders r4)
       let utc' = parseTimeOrError False defaultTimeLocale rfc822DateFormat date' :: UTCTime
diff --git a/services/cargohold/test/integration/Main.hs b/services/cargohold/test/integration/Main.hs
index 9301e222c58..5c288ecf922 100644
--- a/services/cargohold/test/integration/Main.hs
+++ b/services/cargohold/test/integration/Main.hs
@@ -21,32 +21,18 @@ module Main
 where
 
 import qualified API
+import API.Federation (tests)
 import qualified API.V3
-import Bilge hiding (body, header)
 import Data.Proxy
 import Data.Tagged
-import Data.Text.Encoding (encodeUtf8)
-import Data.Yaml hiding (Parser)
 import Imports hiding (local)
 import qualified Metrics
-import Network.HTTP.Client (responseTimeoutMicro)
-import Network.HTTP.Client.TLS
 import Options.Applicative
 import Test.Tasty
 import Test.Tasty.Options
 import TestSetup
-import Util.Options
-import Util.Options.Common
 import Util.Test
 
-data IntegrationConfig = IntegrationConfig
-  -- internal endpoint
-  { cargohold :: Endpoint
-  }
-  deriving (Show, Generic)
-
-instance FromJSON IntegrationConfig
-
 newtype ServiceConfigFile = ServiceConfigFile String
   deriving (Eq, Ord, Typeable)
 
@@ -63,11 +49,24 @@ instance IsOption ServiceConfigFile where
             <> help (untag (optionHelp :: Tagged ServiceConfigFile String))
         )
 
-runTests :: (String -> String -> TestTree) -> IO ()
-runTests run = defaultMainWithIngredients ings $
-  askOption $
-    \(ServiceConfigFile c) ->
-      askOption $ \(IntegrationConfigFile i) -> run c i
+main :: IO ()
+main = do
+  defaultMainWithIngredients ings $
+    askOption $ \(IntegrationConfigFile configPath) ->
+      askOption $ \(ServiceConfigFile optsPath) ->
+        -- we treat the configuration file as a tasty "resource", so that we can
+        -- read it once before all tests
+        withResource
+          (createTestSetup optsPath configPath)
+          (const (pure ()))
+          $ \ts ->
+            testGroup
+              "Cargohold"
+              [ API.tests ts,
+                API.V3.tests ts,
+                Metrics.tests ts,
+                API.Federation.tests ts
+              ]
   where
     ings =
       includingOptions
@@ -75,30 +74,3 @@ runTests run = defaultMainWithIngredients ings $
           Option (Proxy :: Proxy IntegrationConfigFile)
         ] :
       defaultIngredients
-
-main :: IO ()
-main = runTests go
-  where
-    go c i = withResource (getOpts c i) releaseOpts $ \opts ->
-      testGroup
-        "Cargohold"
-        [ API.tests opts,
-          API.V3.tests opts,
-          Metrics.tests opts
-        ]
-    getOpts _ i = do
-      -- TODO: It would actually be useful to read some
-      -- values from cargohold (max bytes, for instance)
-      -- so that tests do not need to keep those values
-      -- in sync and the user _knows_ what they are
-      m <-
-        newManager
-          tlsManagerSettings
-            { managerResponseTimeout = responseTimeoutMicro 300000000
-            }
-      let local p = Endpoint {_epHost = "127.0.0.1", _epPort = p}
-      iConf <- handleParseError =<< decodeFileEither i
-      cargo <- mkRequest <$> optOrEnv cargohold iConf (local . read) "CARGOHOLD_WEB_PORT"
-      return $ TestSetup m cargo
-    mkRequest (Endpoint h p) = host (encodeUtf8 h) . port p
-    releaseOpts _ = return ()
diff --git a/services/cargohold/test/integration/Metrics.hs b/services/cargohold/test/integration/Metrics.hs
index 590fb28c302..d16e4dbc727 100644
--- a/services/cargohold/test/integration/Metrics.hs
+++ b/services/cargohold/test/integration/Metrics.hs
@@ -29,8 +29,9 @@ import TestSetup
 tests :: IO TestSetup -> TestTree
 tests s = testGroup "Metrics" [test s "prometheus" testPrometheusMetrics]
 
-testPrometheusMetrics :: TestSignature ()
-testPrometheusMetrics cargohold =
+testPrometheusMetrics :: TestM ()
+testPrometheusMetrics = do
+  cargohold <- viewCargohold
   get (cargohold . path "/i/metrics") !!! do
     const 200 === statusCode
     -- Should contain the request duration metric in its output
diff --git a/services/cargohold/test/integration/TestSetup.hs b/services/cargohold/test/integration/TestSetup.hs
index 872332dbc24..c83933dce90 100644
--- a/services/cargohold/test/integration/TestSetup.hs
+++ b/services/cargohold/test/integration/TestSetup.hs
@@ -18,34 +18,131 @@
 module TestSetup
   ( test,
     tsManager,
-    tsCargohold,
-    TestSignature,
+    tsEndpoint,
+    tsOpts,
     TestSetup (..),
-    CargoHold,
+    Cargohold,
+    TestM,
+    runTestM,
+    viewCargohold,
+    createTestSetup,
+    runFederationClient,
+    withFederationClient,
+    withFederationError,
   )
 where
 
-import Bilge (Request)
-import Bilge.IO (Http, Manager, runHttpT)
-import Control.Lens (makeLenses, (^.))
+import Bilge hiding (body, responseBody)
+import CargoHold.Options
+import Control.Exception (catch)
+import Control.Lens
+import Control.Monad.Codensity
+import Control.Monad.Except
+import Control.Monad.Morph
+import qualified Data.Aeson as Aeson
+import qualified Data.Text as T
+import Data.Text.Encoding
+import Data.Yaml
 import Imports
+import Network.HTTP.Client hiding (responseBody)
+import Network.HTTP.Client.TLS
+import qualified Network.Wai.Utilities.Error as Wai
+import Servant.Client.Streaming
 import Test.Tasty
 import Test.Tasty.HUnit
+import Util.Options
+import Util.Options.Common
+import Util.Test
 
-type CargoHold = Request -> Request
+type Cargohold = Request -> Request
 
-type TestSignature a = CargoHold -> Http a
+type TestM = ReaderT TestSetup Http
+
+mkRequest :: Endpoint -> Request -> Request
+mkRequest (Endpoint h p) = Bilge.host (encodeUtf8 h) . Bilge.port p
 
 data TestSetup = TestSetup
   { _tsManager :: Manager,
-    _tsCargohold :: CargoHold
+    _tsEndpoint :: Endpoint,
+    _tsOpts :: Opts
   }
 
 makeLenses ''TestSetup
 
-test :: IO TestSetup -> TestName -> TestSignature a -> TestTree
-test s n h = testCase n runTest
-  where
-    runTest = do
-      setup <- s
-      (void $ runHttpT (setup ^. tsManager) (h (setup ^. tsCargohold)))
+viewCargohold :: TestM Cargohold
+viewCargohold = mkRequest <$> view tsEndpoint
+
+runTestM :: TestSetup -> TestM a -> IO a
+runTestM ts action = runHttpT (view tsManager ts) (runReaderT action ts)
+
+test :: IO TestSetup -> TestName -> TestM () -> TestTree
+test s name action = testCase name $ do
+  ts <- s
+  runTestM ts action
+
+data IntegrationConfig = IntegrationConfig
+  -- internal endpoint
+  { cargohold :: Endpoint
+  }
+  deriving (Show, Generic)
+
+instance FromJSON IntegrationConfig
+
+createTestSetup :: FilePath -> FilePath -> IO TestSetup
+createTestSetup optsPath configPath = do
+  -- FUTUREWORK: It would actually be useful to read some
+  -- values from cargohold (max bytes, for instance)
+  -- so that tests do not need to keep those values
+  -- in sync and the user _knows_ what they are
+  m <-
+    newManager
+      tlsManagerSettings
+        { managerResponseTimeout = responseTimeoutMicro 300000000
+        }
+  let localEndpoint p = Endpoint {_epHost = "127.0.0.1", _epPort = p}
+  iConf <- handleParseError =<< decodeFileEither configPath
+  opts <- decodeFileThrow optsPath
+  endpoint <- optOrEnv cargohold iConf (localEndpoint . read) "CARGOHOLD_WEB_PORT"
+  pure $
+    TestSetup
+      { _tsManager = m,
+        _tsEndpoint = endpoint,
+        _tsOpts = opts
+      }
+
+runFederationClient :: ClientM a -> ReaderT TestSetup (ExceptT ClientError (Codensity IO)) a
+runFederationClient action = do
+  man <- view tsManager
+  Endpoint cHost cPort <- view tsEndpoint
+  let base = BaseUrl Http (T.unpack cHost) (fromIntegral cPort) "/federation"
+  let env = mkClientEnv man base
+  r <- lift . lift $
+    Codensity $ \k ->
+      -- Servant's streaming client throws exceptions in IO for some reason
+      catch (withClientM action env k) (k . Left)
+
+  either throwError pure r
+
+hoistFederation :: ReaderT TestSetup (ExceptT ClientError (Codensity IO)) a -> ExceptT ClientError TestM a
+hoistFederation action = do
+  env <- ask
+  hoist (liftIO . lowerCodensity) $ runReaderT action env
+
+withFederationClient :: ReaderT TestSetup (ExceptT ClientError (Codensity IO)) a -> TestM a
+withFederationClient action =
+  runExceptT (hoistFederation action) >>= \case
+    Left err ->
+      liftIO . assertFailure $
+        "Unexpected federation client error: "
+          <> displayException err
+    Right x -> pure x
+
+withFederationError :: ReaderT TestSetup (ExceptT ClientError (Codensity IO)) a -> TestM Wai.Error
+withFederationError action =
+  runExceptT (hoistFederation action)
+    >>= liftIO . \case
+      Left (FailureResponse _ resp) -> case Aeson.eitherDecode (responseBody resp) of
+        Left err -> assertFailure $ "Error while parsing error response: " <> err
+        Right e -> (Wai.code e @?= responseStatusCode resp) $> e
+      Left err -> assertFailure $ "Unexpected federation client error: " <> displayException err
+      Right _ -> assertFailure "Unexpected success"
diff --git a/services/federator/federator.cabal b/services/federator/federator.cabal
index 7bfdce95e1c..b70dab8cda8 100644
--- a/services/federator/federator.cabal
+++ b/services/federator/federator.cabal
@@ -4,7 +4,7 @@ cabal-version: 1.12
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 371580e0c3adbdb4994c74a23ada11c91023bc654f2f0fe304ead7e88a3b8ba6
+-- hash: 292e08dea16bd9d7d61af769a915f4186507ba5d61e292d6f5380f3ea149aa8d
 
 name:           federator
 version:        1.0.0
@@ -80,6 +80,7 @@ library
     , hinotify
     , http-client
     , http-client-openssl
+    , http-media
     , http-types
     , http2
     , imports
@@ -147,6 +148,7 @@ executable federator
     , hinotify
     , http-client
     , http-client-openssl
+    , http-media
     , http-types
     , http2
     , imports
@@ -198,7 +200,8 @@ executable federator-integration
   default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
-      aeson
+      QuickCheck
+    , aeson
     , async
     , base
     , bilge
@@ -223,6 +226,7 @@ executable federator-integration
     , http-client
     , http-client-openssl
     , http-client-tls
+    , http-media
     , http-types
     , http2
     , imports
@@ -307,6 +311,7 @@ test-suite federator-tests
     , hinotify
     , http-client
     , http-client-openssl
+    , http-media
     , http-types
     , http2
     , imports
diff --git a/services/federator/package.yaml b/services/federator/package.yaml
index 0c9abdd8509..b17c45b078f 100644
--- a/services/federator/package.yaml
+++ b/services/federator/package.yaml
@@ -29,6 +29,7 @@ dependencies:
 - hinotify
 - http-client
 - http-client-openssl
+- http-media
 - http-types
 - http2
 - kan-extensions
@@ -93,6 +94,7 @@ executables:
     - http-client-tls
     - mtl
     - optparse-applicative
+    - QuickCheck
     - random
     - retry
     - tasty
diff --git a/services/federator/src/Federator/MockServer.hs b/services/federator/src/Federator/MockServer.hs
index 1284e2e2817..a501b0fb33c 100644
--- a/services/federator/src/Federator/MockServer.hs
+++ b/services/federator/src/Federator/MockServer.hs
@@ -39,6 +39,7 @@ import Federator.InternalServer
 import Federator.Response
 import Federator.Validation
 import Imports hiding (fromException)
+import qualified Network.HTTP.Media as HTTP
 import Network.HTTP.Types as HTTP
 import qualified Network.Wai as Wai
 import qualified Network.Wai.Handler.Warp as Warp
@@ -125,7 +126,7 @@ data FederatedRequest = FederatedRequest
 withTempMockFederator ::
   (MonadIO m, MonadMask m) =>
   [HTTP.Header] ->
-  (FederatedRequest -> IO LByteString) ->
+  (FederatedRequest -> IO (HTTP.MediaType, LByteString)) ->
   (Warp.Port -> m a) ->
   m (a, [FederatedRequest])
 withTempMockFederator headers resp action = do
@@ -160,11 +161,12 @@ withTempMockFederator headers resp action = do
                         }
                     )
               embed @IO $ modifyIORef remoteCalls (<> [fedRequest])
-              body <-
+              (ct, body) <-
                 fromException @MockException
                   . handle (throw . handleException)
                   $ resp fedRequest
-              pure $ Wai.responseLBS HTTP.status200 headers body
+              let headers' = ("Content-Type", HTTP.renderHeader ct) : headers
+              pure $ Wai.responseLBS HTTP.status200 headers' body
         respond response
   result <-
     bracket
diff --git a/services/federator/test/integration/Test/Federator/InwardSpec.hs b/services/federator/test/integration/Test/Federator/InwardSpec.hs
index 3ef28b069d8..c9213ed9011 100644
--- a/services/federator/test/integration/Test/Federator/InwardSpec.hs
+++ b/services/federator/test/integration/Test/Federator/InwardSpec.hs
@@ -34,7 +34,9 @@ import qualified Network.HTTP.Types as HTTP
 import qualified Network.Wai.Utilities.Error as E
 import Test.Federator.Util
 import Test.Hspec
+import Test.QuickCheck (arbitrary, generate)
 import Util.Options (Endpoint (Endpoint))
+import Wire.API.Federation.API.Cargohold
 import Wire.API.Federation.Domain
 import Wire.API.User
 
@@ -85,8 +87,11 @@ spec env =
 
     it "should be able to call cargohold" $
       runTestFederator env $ do
-        inwardCall "/federation/cargohold/get-asset" (encode ())
-          !!! const 500 === statusCode
+        uid <- liftIO $ generate arbitrary
+        key <- liftIO $ generate arbitrary
+        let ga = GetAsset uid key Nothing
+        inwardCall "/federation/cargohold/get-asset" (encode ga)
+          !!! const 200 === statusCode
 
     it "should return 404 'no-endpoint' response from Brig" $
       runTestFederator env $ do
diff --git a/services/federator/test/unit/Test/Federator/Client.hs b/services/federator/test/unit/Test/Federator/Client.hs
index 13d92f5cd33..7a193de903d 100644
--- a/services/federator/test/unit/Test/Federator/Client.hs
+++ b/services/federator/test/unit/Test/Federator/Client.hs
@@ -30,6 +30,7 @@ import Data.Proxy
 import qualified Data.Text.Encoding as Text
 import Federator.MockServer
 import Imports
+import Network.HTTP.Media
 import Network.HTTP.Types as HTTP
 import qualified Network.HTTP2.Client as HTTP2
 import qualified Network.Wai as Wai
@@ -84,7 +85,7 @@ newtype ResponseFailure = ResponseFailure Wai.Error
 withMockFederatorClient ::
   KnownComponent c =>
   [HTTP.Header] ->
-  (FederatedRequest -> IO LByteString) ->
+  (FederatedRequest -> IO (MediaType, LByteString)) ->
   FederatorClient c a ->
   IO (Either ResponseFailure a, [FederatedRequest])
 withMockFederatorClient headers resp action = withTempMockFederator headers resp $ \port -> do
@@ -106,8 +107,10 @@ testClientSuccess = do
   expectedResponse :: UserProfile <- generate arbitrary
 
   (actualResponse, sentRequests) <-
-    withMockFederatorClient defaultHeaders (const (pure (Aeson.encode (Just expectedResponse)))) $
-      getUserByHandle clientRoutes handle
+    withMockFederatorClient
+      defaultHeaders
+      (const (pure ("application/json", Aeson.encode (Just expectedResponse))))
+      $ getUserByHandle clientRoutes handle
 
   sentRequests
     @?= [ FederatedRequest
@@ -201,14 +204,17 @@ testClientConnectionError = do
 
 testResponseHeaders :: IO ()
 testResponseHeaders = do
-  (r, _) <- withTempMockFederator [("X-Foo", "bar")] (const mempty) $ \port -> do
-    let req =
-          HTTP2.requestBuilder
-            HTTP.methodPost
-            "/rpc/target.example.com/brig/test"
-            [("Wire-Origin-Domain", "origin.example.com")]
-            "body"
-    performHTTP2Request Nothing req "127.0.0.1" port
+  (r, _) <- withTempMockFederator
+    [("X-Foo", "bar")]
+    (const $ pure ("application" // "json", mempty))
+    $ \port -> do
+      let req =
+            HTTP2.requestBuilder
+              HTTP.methodPost
+              "/rpc/target.example.com/brig/test"
+              [("Wire-Origin-Domain", "origin.example.com")]
+              "body"
+      performHTTP2Request Nothing req "127.0.0.1" port
   case r of
     Left err ->
       assertFailure $
diff --git a/services/galley/galley.cabal b/services/galley/galley.cabal
index f743ae99946..c89bb3504af 100644
--- a/services/galley/galley.cabal
+++ b/services/galley/galley.cabal
@@ -305,6 +305,7 @@ executable galley-integration
     , http-client-openssl
     , http-client-tls
     , http-types
+    , http-media
     , imports
     , lens
     , lens-aeson
diff --git a/services/galley/package.yaml b/services/galley/package.yaml
index e0b49c8d9ab..0b490e184b2 100644
--- a/services/galley/package.yaml
+++ b/services/galley/package.yaml
@@ -182,6 +182,7 @@ executables:
     - http-client
     - http-client-openssl
     - http-client-tls
+    - http-media
     - http-types
     - lens
     - lens-aeson
diff --git a/services/galley/test/integration/API/Util.hs b/services/galley/test/integration/API/Util.hs
index f6f7f401d28..fe1f0ddbfaa 100644
--- a/services/galley/test/integration/API/Util.hs
+++ b/services/galley/test/integration/API/Util.hs
@@ -92,6 +92,7 @@ import Gundeck.Types.Notification
     queuedTime,
   )
 import Imports
+import Network.HTTP.Media.MediaType
 import qualified Network.HTTP.Types as HTTP
 import Network.Wai (Application, defaultRequest)
 import qualified Network.Wai as Wai
@@ -2241,11 +2242,14 @@ withTempMockFederator' ::
   m (b, [FederatedRequest])
 withTempMockFederator' resp action = do
   opts <- viewGalleyOpts
-  Mock.withTempMockFederator [("Content-Type", "application/json")] resp $ \mockPort -> do
-    let opts' =
-          opts & Opts.optFederator
-            ?~ Endpoint "127.0.0.1" (fromIntegral mockPort)
-    withSettingsOverrides opts' action
+  Mock.withTempMockFederator
+    [("Content-Type", "application/json")]
+    ((\r -> pure ("application" // "json", r)) <=< resp)
+    $ \mockPort -> do
+      let opts' =
+            opts & Opts.optFederator
+              ?~ Endpoint "127.0.0.1" (fromIntegral mockPort)
+      withSettingsOverrides opts' action
 
 -- Start a mock federator. Use proveded Servant handler for the mocking mocking function.
 withTempServantMockFederator ::

From 312afa59d1d5fc7d6c8a57f5f44b771686d58eaf Mon Sep 17 00:00:00 2001
From: Stefan Matting <smatting@users.noreply.github.com>
Date: Mon, 10 Jan 2022 15:59:43 +0100
Subject: [PATCH 58/74] Add helm chart for restund (#2003)

---
 changelog.d/5-internal/restund-chart          |   1 +
 charts/restund/Chart.yaml                     |  14 ++
 charts/restund/README.md                      |  14 ++
 charts/restund/templates/_helpers.tpl         |  45 ++++++
 .../configmap-restund-conf-template.yaml      |  51 +++++++
 charts/restund/templates/secret.yaml          |  11 ++
 charts/restund/templates/service-account.yaml |  33 +++++
 charts/restund/templates/service.yaml         |  20 +++
 charts/restund/templates/statefulset.yaml     | 129 ++++++++++++++++++
 charts/restund/values.yaml                    |  29 ++++
 10 files changed, 347 insertions(+)
 create mode 100644 changelog.d/5-internal/restund-chart
 create mode 100644 charts/restund/Chart.yaml
 create mode 100644 charts/restund/README.md
 create mode 100644 charts/restund/templates/_helpers.tpl
 create mode 100644 charts/restund/templates/configmap-restund-conf-template.yaml
 create mode 100644 charts/restund/templates/secret.yaml
 create mode 100644 charts/restund/templates/service-account.yaml
 create mode 100644 charts/restund/templates/service.yaml
 create mode 100644 charts/restund/templates/statefulset.yaml
 create mode 100644 charts/restund/values.yaml

diff --git a/changelog.d/5-internal/restund-chart b/changelog.d/5-internal/restund-chart
new file mode 100644
index 00000000000..b0addd486b1
--- /dev/null
+++ b/changelog.d/5-internal/restund-chart
@@ -0,0 +1 @@
+Add a helm chart that deploys [restund](https://docs.wire.com/understand/restund.html)
diff --git a/charts/restund/Chart.yaml b/charts/restund/Chart.yaml
new file mode 100644
index 00000000000..423fbbe799a
--- /dev/null
+++ b/charts/restund/Chart.yaml
@@ -0,0 +1,14 @@
+apiVersion: v2
+name: restund
+description: Restund - a modular STUN/TURN server
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.0.1
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+appVersion: 0.4.17
diff --git a/charts/restund/README.md b/charts/restund/README.md
new file mode 100644
index 00000000000..8af0d2d3446
--- /dev/null
+++ b/charts/restund/README.md
@@ -0,0 +1,14 @@
+This chart deploys [Restund](https://docs.wire.com/understand/restund.html), a
+STUN and TURN server.
+
+You need to supply the zrestSecret at key `secrets.zrestSecret`. Make sure this
+matches `secrets.turn.secret` of the brig chart.
+
+Restund pods are deployed with `hostNetwork: true`, because restund needs to
+listen on a wide range of udp ports. See `values.yaml` for additional tcp ports
+that need to be exposed on the hosting node.
+
+The Restund server might also expose the internal network to which the hosting
+node is connected to. It is therefore recommended to run restund on a separate
+network (cluster) than the rest of wire's services. See
+[details](https://docs.wire.com/understand/restund.html#network).
diff --git a/charts/restund/templates/_helpers.tpl b/charts/restund/templates/_helpers.tpl
new file mode 100644
index 00000000000..2aff503be05
--- /dev/null
+++ b/charts/restund/templates/_helpers.tpl
@@ -0,0 +1,45 @@
+{{- define "restund.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "restund.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "restund.labels" -}}
+helm.sh/chart: {{ include "restund.chart" . }}
+{{ include "restund.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Values.image.tag | default .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "restund.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{- define "restund.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "restund.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
diff --git a/charts/restund/templates/configmap-restund-conf-template.yaml b/charts/restund/templates/configmap-restund-conf-template.yaml
new file mode 100644
index 00000000000..b25263f79f6
--- /dev/null
+++ b/charts/restund/templates/configmap-restund-conf-template.yaml
@@ -0,0 +1,51 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "restund.fullname" . }}
+  labels:
+    {{- include "restund.selectorLabels" . | nindent 4 }}
+
+data:
+  restund.conf.template: |
+    ## core
+    daemon                  no
+    debug                   no
+    realm                   dummy.io
+    syncinterval            600
+    udp_listen              ${RESTUND_HOST}:{{ .Values.restundUDPListenPort }}
+    udp_sockbuf_size        524288
+    tcp_listen              ${RESTUND_HOST}:{{ .Values.restundTCPListenPort }}
+    # tls_listen
+
+    ## modules
+    module_path             /usr/local/lib/restund/modules
+    module                  stat.so
+    module                  drain.so
+    module                  binding.so
+    module                  auth.so
+    module                  turn.so
+    module                  zrest.so
+    module                  status.so
+
+    ## auth
+    auth_nonce_expiry       3600
+
+    ## turn
+    turn_max_allocations    64000
+    turn_max_lifetime       3600
+    turn_relay_addr         ${RESTUND_HOST}
+    # # turn_public_addr is an IP which must be reachable for UDP traffic from other restund servers (and from this server itself). If unset, defaults to 'turn_relay_addr'
+    # turn_public_addr
+
+    # syslog
+    syslog_facility         24
+
+    ## status
+    status_http_addr        ${POD_IP}
+    status_http_port        {{ .Values.restundHTTPStatusPort }}
+    # status_udp_addr
+    # status_udp_port
+
+    # zrest
+    zrest_listen ${POD_IP}
+    zrest_secret ${ZREST_SECRET}
diff --git a/charts/restund/templates/secret.yaml b/charts/restund/templates/secret.yaml
new file mode 100644
index 00000000000..f5652f9dacc
--- /dev/null
+++ b/charts/restund/templates/secret.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: restund
+  labels:
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+type: Opaque
+data:
+  zrest_secret.txt: {{ .Values.secrets.zrestSecret | b64enc | quote }}
diff --git a/charts/restund/templates/service-account.yaml b/charts/restund/templates/service-account.yaml
new file mode 100644
index 00000000000..1708744dd63
--- /dev/null
+++ b/charts/restund/templates/service-account.yaml
@@ -0,0 +1,33 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "restund.fullname" . }}
+  labels:
+    {{- include "restund.labels" . | nindent 4 }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "restund.fullname" . }}
+  labels:
+    {{- include "restund.labels" . | nindent 4 }}
+rules:
+  - apiGroups: [""]
+    resources: [nodes]
+    verbs: [get]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "restund.fullname" . }}
+  labels:
+    {{- include "restund.labels" . | nindent 4 }}
+roleRef:
+  kind: ClusterRole
+  apiGroup: rbac.authorization.k8s.io
+  name: {{ include "restund.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "restund.fullname" . }}
+    namespace: {{ .Release.Namespace }}
diff --git a/charts/restund/templates/service.yaml b/charts/restund/templates/service.yaml
new file mode 100644
index 00000000000..d5f0a7b9409
--- /dev/null
+++ b/charts/restund/templates/service.yaml
@@ -0,0 +1,20 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "restund.fullname" . }}
+  labels:
+    {{- include "restund.labels" . | nindent 4 }}
+spec:
+  # Needs to be headless
+  # See: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/
+  clusterIP: None
+  ports:
+    - name: restund-tcp
+      port: 3478
+      targetPort: restund-tcp
+    - name: sft-config
+      port: 8000
+      targetPort: sft-config
+  selector:
+    {{- include "restund.selectorLabels" . | nindent 4 }}
diff --git a/charts/restund/templates/statefulset.yaml b/charts/restund/templates/statefulset.yaml
new file mode 100644
index 00000000000..1b5715cde32
--- /dev/null
+++ b/charts/restund/templates/statefulset.yaml
@@ -0,0 +1,129 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "restund.fullname" . }}
+  labels:
+    {{- include "restund.labels" . | nindent 4 }}
+
+spec:
+  replicas: {{ .Values.replicaCount }}
+
+  # Allows restund to start up and shut down in parallel when scaling up and down.
+  # However this does not affect upgrades.
+  podManagementPolicy: Parallel
+
+  serviceName: {{ include "restund.fullname" . }}
+  selector:
+    matchLabels:
+      {{- include "restund.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+    {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+    {{- end }}
+
+      labels:
+        {{- include "restund.selectorLabels" . | nindent 8 }}
+    spec:
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      hostNetwork: true
+      serviceAccountName: {{ include "restund.fullname" . }}
+      volumes:
+        - name: external-ip
+          emptyDir: {}
+        - name: restund-config-template
+          configMap:
+            name: {{ include "restund.fullname" . }}
+        - name: secrets
+          secret:
+            secretName: restund
+      initContainers:
+        - name: get-external-ip
+          image: bitnami/kubectl:1.19.7
+          volumeMounts:
+            - name: external-ip
+              mountPath: /external-ip
+          command:
+            - /bin/sh
+            - -c
+            - |
+              set -e
+
+              # In the cloud, this setting is available to indicate the true IP address
+              addr=$(kubectl get node $HOSTNAME -ojsonpath='{.status.addresses[?(@.type=="ExternalIP")].address}')
+
+              # On on-prem we allow people to set  "wire.com/external-ip" to override this
+              if [ -z "$addr" ]; then
+                addr=$(kubectl get node $HOSTNAME -ojsonpath='{.metadata.annotations.wire\.com/external-ip}')
+              fi
+              echo -n "$addr" | tee /dev/stderr > /external-ip/ip
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          env:
+            - name: POD_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+          volumeMounts:
+            - name: external-ip
+              mountPath: /external-ip
+            - name: restund-config-template
+              mountPath: /restund-template/restund.conf.template
+              subPath: restund.conf.template
+            - name: secrets
+              mountPath: /secrets/
+              readOnly: true
+          command:
+            - /bin/sh
+            - -c
+            - |
+              set -e
+              EXTERNAL_IP=$(cat /external-ip/ip)
+              export RESTUND_HOST="$EXTERNAL_IP"
+              export ZREST_SECRET="$(cat /secrets/zrest_secret.txt)"
+              envsubst '$RESTUND_HOST $POD_IP $ZREST_SECRET' < /restund-template/restund.conf.template > /home/restund/restund.conf
+              exec /usr/local/sbin/restund -n -f /home/restund/restund.conf
+
+          ports:
+            - name: restund-tcp
+              containerPort: 3478
+              protocol: TCP
+            - name: sft-config
+              containerPort: 8000
+              protocol: TCP
+            - name: status-http
+              containerPort: {{ .Values.restundHTTPStatusPort }}
+              protocol: TCP
+
+          livenessProbe:
+            httpGet:
+              path: /
+              port: status-http
+
+          readinessProbe:
+            httpGet:
+              path: /
+              port: status-http
+
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
diff --git a/charts/restund/values.yaml b/charts/restund/values.yaml
new file mode 100644
index 00000000000..2a8b04cf0fc
--- /dev/null
+++ b/charts/restund/values.yaml
@@ -0,0 +1,29 @@
+# The amount of Restund instances to run.  NOTE: Only one Restund can run per node due
+# to `hostNetwork`. If this number is higher than the amount of nodes that can
+# be used for scheduling (Also see `nodeSelector`) pods will remain in a
+# pending state untill you add more capacity.
+replicaCount: 1
+
+image:
+  repository: quay.io/wire/restund
+  pullPolicy: IfNotPresent
+  # overwrite the tag here, otherwise `appVersion` of the chart will be used
+  tag: ""
+
+# If you have multiple deployments of Restund running in one cluster, it is
+# important that they run on disjoint sets of nodes, you can use nodeSelector to enforce this
+nodeSelector: {}
+
+podSecurityContext:
+  fsGroup: 31337
+
+securityContext:
+  # Pick a high number that is unlikely to conflict with the host
+  # https://kubesec.io/basics/containers-securitycontext-runasuser/
+  runAsUser: 31337
+
+restundUDPListenPort: 3478
+restundTCPListenPort: 3478
+restundUDPStatusPort: 33000
+restundHTTPStatusPort: 8080
+restundMetricsListenPort: 8443

From c75de620243b46ca33fc231e62b211dd7ec1d768 Mon Sep 17 00:00:00 2001
From: Paolo Capriotti <paolo@capriotti.io>
Date: Tue, 11 Jan 2022 08:32:34 +0100
Subject: [PATCH 59/74] Replace servant-generic with Named combinator (#2022)

The generic mechanism in Servant for defining API types is cumbersome
and slow to compile. This commit replaces the API record for the public
Galley API with a tree explicitly built using the `:<|>` operator.

To make up for the lack of record labels, it also introduces a `Named`
combinator for servant API types, which can be used to tag an endpoint
with a name (usually a symbol). The name must match the one with which
the handler is wrapped.
---
 changelog.d/5-internal/avoid-servant-generics |    1 +
 libs/wire-api/src/Wire/API/Routes/Named.hs    |   40 +
 .../src/Wire/API/Routes/Public/Galley.hs      | 1313 ++++++++---------
 libs/wire-api/wire-api.cabal                  |    3 +-
 services/galley/galley.cabal                  |    3 +-
 services/galley/src/Galley/API.hs             |    3 +-
 services/galley/src/Galley/API/Public.hs      |  128 --
 .../galley/src/Galley/API/Public/Servant.hs   |  234 +++
 8 files changed, 936 insertions(+), 789 deletions(-)
 create mode 100644 changelog.d/5-internal/avoid-servant-generics
 create mode 100644 libs/wire-api/src/Wire/API/Routes/Named.hs
 create mode 100644 services/galley/src/Galley/API/Public/Servant.hs

diff --git a/changelog.d/5-internal/avoid-servant-generics b/changelog.d/5-internal/avoid-servant-generics
new file mode 100644
index 00000000000..0ab6f411a3c
--- /dev/null
+++ b/changelog.d/5-internal/avoid-servant-generics
@@ -0,0 +1 @@
+Replace servant-generic in Galley with a custom `Named` combinator
diff --git a/libs/wire-api/src/Wire/API/Routes/Named.hs b/libs/wire-api/src/Wire/API/Routes/Named.hs
new file mode 100644
index 00000000000..ea2fa27b195
--- /dev/null
+++ b/libs/wire-api/src/Wire/API/Routes/Named.hs
@@ -0,0 +1,40 @@
+-- This file is part of the Wire Server implementation.
+--
+-- Copyright (C) 2022 Wire Swiss GmbH <opensource@wire.com>
+--
+-- This program is free software: you can redistribute it and/or modify it under
+-- the terms of the GNU Affero General Public License as published by the Free
+-- Software Foundation, either version 3 of the License, or (at your option) any
+-- later version.
+--
+-- This program is distributed in the hope that it will be useful, but WITHOUT
+-- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+-- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+-- details.
+--
+-- You should have received a copy of the GNU Affero General Public License along
+-- with this program. If not, see <https://www.gnu.org/licenses/>.
+
+module Wire.API.Routes.Named where
+
+import Data.Metrics.Servant
+import Data.Proxy
+import Imports
+import Servant.Server
+import Servant.Swagger
+
+newtype Named named x = Named {unnamed :: x}
+  deriving (Functor)
+
+instance HasSwagger api => HasSwagger (Named name api) where
+  toSwagger _ = toSwagger (Proxy @api)
+
+instance HasServer api ctx => HasServer (Named name api) ctx where
+  type ServerT (Named name api) m = Named name (ServerT api m)
+
+  route _ ctx action = route (Proxy @api) ctx (fmap unnamed action)
+  hoistServerWithContext _ ctx f =
+    fmap (hoistServerWithContext (Proxy @api) ctx f)
+
+instance RoutesToPaths api => RoutesToPaths (Named name api) where
+  getRoutes = getRoutes @api
diff --git a/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs b/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs
index 5aa972b25df..1e08d2099df 100644
--- a/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs
+++ b/libs/wire-api/src/Wire/API/Routes/Public/Galley.hs
@@ -31,7 +31,6 @@ import qualified Data.Swagger as Swagger
 import GHC.TypeLits (AppendSymbol)
 import Imports hiding (head)
 import Servant
-import Servant.API.Generic (ToServantApi, (:-))
 import Servant.Swagger.Internal
 import Servant.Swagger.Internal.Orphans ()
 import Wire.API.Conversation
@@ -40,6 +39,7 @@ import Wire.API.ErrorDescription
 import Wire.API.Event.Conversation
 import Wire.API.Message
 import Wire.API.Routes.MultiVerb
+import Wire.API.Routes.Named
 import Wire.API.Routes.Public
 import Wire.API.Routes.Public.Util
 import Wire.API.Routes.QualifiedCapture
@@ -85,501 +85,584 @@ type RemoveFromConversationVerb =
      ]
     (Maybe Event)
 
-data Api routes = Api
-  { -- Conversations
+type ServantAPI =
+  ConversationAPI
+    :<|> TeamConversationAPI
+    :<|> MessagingAPI
+    :<|> TeamAPI
+    :<|> FeatureAPI
 
-    getUnqualifiedConversation ::
-      routes
-        :- Summary "Get a conversation by ID"
+type ConversationAPI =
+  Named
+    "get-unqualified-conversation"
+    ( Summary "Get a conversation by ID"
         :> ZLocalUser
         :> "conversations"
         :> Capture "cnv" ConvId
-        :> Get '[Servant.JSON] Conversation,
-    getConversation ::
-      routes
-        :- Summary "Get a conversation by ID"
-        :> ZLocalUser
-        :> "conversations"
-        :> QualifiedCapture "cnv" ConvId
-        :> Get '[Servant.JSON] Conversation,
-    getConversationRoles ::
-      routes
-        :- Summary "Get existing roles available for the given conversation"
-        :> ZLocalUser
-        :> "conversations"
-        :> Capture "cnv" ConvId
-        :> "roles"
-        :> Get '[Servant.JSON] ConversationRolesList,
-    listConversationIdsUnqualified ::
-      routes
-        :- Summary "[deprecated] Get all local conversation IDs."
-        -- FUTUREWORK: add bounds to swagger schema for Range
-        :> ZLocalUser
-        :> "conversations"
-        :> "ids"
-        :> QueryParam'
-             [ Optional,
-               Strict,
-               Description "Conversation ID to start from (exclusive)"
-             ]
-             "start"
-             ConvId
-        :> QueryParam'
-             [ Optional,
-               Strict,
-               Description "Maximum number of IDs to return"
-             ]
-             "size"
-             (Range 1 1000 Int32)
-        :> Get '[Servant.JSON] (ConversationList ConvId),
-    listConversationIds ::
-      routes
-        :- Summary "Get all conversation IDs."
-          :> Description
-               "The IDs returned by this endpoint are paginated. To\
-               \ get the first page, make a call with the `paging_state` field set to\
-               \ `null` (or omitted). Whenever the `has_more` field of the response is\
-               \ set to `true`, more results are available, and they can be obtained\
-               \ by calling the endpoint again, but this time passing the value of\
-               \ `paging_state` returned by the previous call. One can continue in\
-               \ this fashion until all results are returned, which is indicated by\
-               \ `has_more` being `false`. Note that `paging_state` should be\
-               \ considered an opaque token. It should not be inspected, or stored, or\
-               \ reused across multiple unrelated invokations of the endpoint."
-          :> ZLocalUser
-          :> "conversations"
-          :> "list-ids"
-          :> ReqBody '[Servant.JSON] GetPaginatedConversationIds
-          :> Post '[Servant.JSON] ConvIdsPage,
-    getConversations ::
-      routes
-        :- Summary "Get all *local* conversations."
-        :> Description
-             "Will not return remote conversations.\n\n\
-             \Use `POST /conversations/list-ids` followed by \
-             \`POST /conversations/list/v2` instead."
-        :> ZLocalUser
-        :> "conversations"
-        :> QueryParam'
-             [ Optional,
-               Strict,
-               Description "Mutually exclusive with 'start' (at most 32 IDs per request)"
-             ]
-             "ids"
-             (Range 1 32 (CommaSeparatedList ConvId))
-        :> QueryParam'
-             [ Optional,
-               Strict,
-               Description "Conversation ID to start from (exclusive)"
-             ]
-             "start"
-             ConvId
-        :> QueryParam'
-             [ Optional,
-               Strict,
-               Description "Maximum number of conversations to return"
-             ]
-             "size"
-             (Range 1 500 Int32)
-        :> Get '[Servant.JSON] (ConversationList Conversation),
-    listConversations ::
-      routes
-        :- Summary "Get conversation metadata for a list of conversation ids"
-        :> ZLocalUser
-        :> "conversations"
-        :> "list"
-        :> "v2"
-        :> ReqBody '[Servant.JSON] ListConversations
-        :> Post '[Servant.JSON] ConversationsResponse,
+        :> Get '[Servant.JSON] Conversation
+    )
+    :<|> Named
+           "get-conversation"
+           ( Summary "Get a conversation by ID"
+               :> ZLocalUser
+               :> "conversations"
+               :> QualifiedCapture "cnv" ConvId
+               :> Get '[Servant.JSON] Conversation
+           )
+    :<|> Named
+           "get-conversation-roles"
+           ( Summary "Get existing roles available for the given conversation"
+               :> ZLocalUser
+               :> "conversations"
+               :> Capture "cnv" ConvId
+               :> "roles"
+               :> Get '[Servant.JSON] ConversationRolesList
+           )
+    :<|> Named
+           "list-conversation-ids-unqualified"
+           ( Summary "[deprecated] Get all local conversation IDs."
+               -- FUTUREWORK: add bounds to swagger schema for Range
+               :> ZLocalUser
+               :> "conversations"
+               :> "ids"
+               :> QueryParam'
+                    [ Optional,
+                      Strict,
+                      Description "Conversation ID to start from (exclusive)"
+                    ]
+                    "start"
+                    ConvId
+               :> QueryParam'
+                    [ Optional,
+                      Strict,
+                      Description "Maximum number of IDs to return"
+                    ]
+                    "size"
+                    (Range 1 1000 Int32)
+               :> Get '[Servant.JSON] (ConversationList ConvId)
+           )
+    :<|> Named
+           "list-conversation-ids"
+           ( Summary "Get all conversation IDs."
+               :> Description
+                    "The IDs returned by this endpoint are paginated. To\
+                    \ get the first page, make a call with the `paging_state` field set to\
+                    \ `null` (or omitted). Whenever the `has_more` field of the response is\
+                    \ set to `true`, more results are available, and they can be obtained\
+                    \ by calling the endpoint again, but this time passing the value of\
+                    \ `paging_state` returned by the previous call. One can continue in\
+                    \ this fashion until all results are returned, which is indicated by\
+                    \ `has_more` being `false`. Note that `paging_state` should be\
+                    \ considered an opaque token. It should not be inspected, or stored, or\
+                    \ reused across multiple unrelated invokations of the endpoint."
+               :> ZLocalUser
+               :> "conversations"
+               :> "list-ids"
+               :> ReqBody '[Servant.JSON] GetPaginatedConversationIds
+               :> Post '[Servant.JSON] ConvIdsPage
+           )
+    :<|> Named
+           "get-conversations"
+           ( Summary "Get all *local* conversations."
+               :> Description
+                    "Will not return remote conversations.\n\n\
+                    \Use `POST /conversations/list-ids` followed by \
+                    \`POST /conversations/list/v2` instead."
+               :> ZLocalUser
+               :> "conversations"
+               :> QueryParam'
+                    [ Optional,
+                      Strict,
+                      Description "Mutually exclusive with 'start' (at most 32 IDs per request)"
+                    ]
+                    "ids"
+                    (Range 1 32 (CommaSeparatedList ConvId))
+               :> QueryParam'
+                    [ Optional,
+                      Strict,
+                      Description "Conversation ID to start from (exclusive)"
+                    ]
+                    "start"
+                    ConvId
+               :> QueryParam'
+                    [ Optional,
+                      Strict,
+                      Description "Maximum number of conversations to return"
+                    ]
+                    "size"
+                    (Range 1 500 Int32)
+               :> Get '[Servant.JSON] (ConversationList Conversation)
+           )
+    :<|> Named
+           "list-conversations"
+           ( Summary "Get conversation metadata for a list of conversation ids"
+               :> ZLocalUser
+               :> "conversations"
+               :> "list"
+               :> "v2"
+               :> ReqBody '[Servant.JSON] ListConversations
+               :> Post '[Servant.JSON] ConversationsResponse
+           )
     -- This endpoint can lead to the following events being sent:
     -- - ConvCreate event to members
-    getConversationByReusableCode ::
-      routes
-        :- Summary "Get limited conversation information by key/code pair"
-        :> CanThrow NotATeamMember
-        :> CanThrow CodeNotFound
-        :> CanThrow ConvNotFound
-        :> CanThrow ConvAccessDenied
-        :> CanThrow GuestLinksDisabled
-        :> ZLocalUser
-        :> "conversations"
-        :> "join"
-        :> QueryParam' [Required, Strict] "key" Code.Key
-        :> QueryParam' [Required, Strict] "code" Code.Value
-        :> Get '[Servant.JSON] ConversationCoverView,
-    createGroupConversation ::
-      routes
-        :- Summary "Create a new conversation"
-        :> CanThrow NotConnected
-        :> CanThrow OperationDenied
-        :> CanThrow NotATeamMember
-        :> Description "This returns 201 when a new conversation is created, and 200 when the conversation already existed"
-        :> ZLocalUser
-        :> ZConn
-        :> "conversations"
-        :> ReqBody '[Servant.JSON] NewConvUnmanaged
-        :> ConversationVerb,
-    createSelfConversation ::
-      routes
-        :- Summary "Create a self-conversation"
-        :> ZLocalUser
-        :> "conversations"
-        :> "self"
-        :> ConversationVerb,
+    :<|> Named
+           "get-conversation-by-reusable-code"
+           ( Summary "Get limited conversation information by key/code pair"
+               :> CanThrow NotATeamMember
+               :> CanThrow CodeNotFound
+               :> CanThrow ConvNotFound
+               :> CanThrow ConvAccessDenied
+               :> CanThrow GuestLinksDisabled
+               :> ZLocalUser
+               :> "conversations"
+               :> "join"
+               :> QueryParam' [Required, Strict] "key" Code.Key
+               :> QueryParam' [Required, Strict] "code" Code.Value
+               :> Get '[Servant.JSON] ConversationCoverView
+           )
+    :<|> Named
+           "create-group-conversation"
+           ( Summary "Create a new conversation"
+               :> CanThrow NotConnected
+               :> CanThrow OperationDenied
+               :> CanThrow NotATeamMember
+               :> Description "This returns 201 when a new conversation is created, and 200 when the conversation already existed"
+               :> ZLocalUser
+               :> ZConn
+               :> "conversations"
+               :> ReqBody '[Servant.JSON] NewConvUnmanaged
+               :> ConversationVerb
+           )
+    :<|> Named
+           "create-self-conversation"
+           ( Summary "Create a self-conversation"
+               :> ZLocalUser
+               :> "conversations"
+               :> "self"
+               :> ConversationVerb
+           )
     -- This endpoint can lead to the following events being sent:
     -- - ConvCreate event to members
     -- TODO: add note: "On 201, the conversation ID is the `Location` header"
-    createOne2OneConversation ::
-      routes
-        :- Summary "Create a 1:1 conversation"
-        :> ZLocalUser
-        :> ZConn
-        :> "conversations"
-        :> "one2one"
-        :> ReqBody '[Servant.JSON] NewConvUnmanaged
-        :> ConversationVerb,
+    :<|> Named
+           "create-one-to-one-conversation"
+           ( Summary "Create a 1:1 conversation"
+               :> ZLocalUser
+               :> ZConn
+               :> "conversations"
+               :> "one2one"
+               :> ReqBody '[Servant.JSON] NewConvUnmanaged
+               :> ConversationVerb
+           )
     -- This endpoint can lead to the following events being sent:
     -- - MemberJoin event to members
-    addMembersToConversationUnqualified ::
-      routes
-        :- Summary "Add members to an existing conversation (deprecated)"
-        :> CanThrow ConvNotFound
-        :> CanThrow NotConnected
-        :> CanThrow ConvAccessDenied
-        :> CanThrow (InvalidOp "Invalid operation")
-        :> ZLocalUser
-        :> ZConn
-        :> "conversations"
-        :> Capture "cnv" ConvId
-        :> "members"
-        :> ReqBody '[JSON] Invite
-        :> MultiVerb 'POST '[JSON] ConvUpdateResponses (UpdateResult Event),
-    addMembersToConversation ::
-      routes
-        :- Summary "Add qualified members to an existing conversation."
-        :> ZLocalUser
-        :> ZConn
-        :> "conversations"
-        :> Capture "cnv" ConvId
-        :> "members"
-        :> "v2"
-        :> ReqBody '[Servant.JSON] InviteQualified
-        :> MultiVerb 'POST '[Servant.JSON] ConvUpdateResponses (UpdateResult Event),
+    :<|> Named
+           "add-members-to-conversation-unqualified"
+           ( Summary "Add members to an existing conversation (deprecated)"
+               :> CanThrow ConvNotFound
+               :> CanThrow NotConnected
+               :> CanThrow ConvAccessDenied
+               :> CanThrow (InvalidOp "Invalid operation")
+               :> ZLocalUser
+               :> ZConn
+               :> "conversations"
+               :> Capture "cnv" ConvId
+               :> "members"
+               :> ReqBody '[JSON] Invite
+               :> MultiVerb 'POST '[JSON] ConvUpdateResponses (UpdateResult Event)
+           )
+    :<|> Named
+           "add-members-to-conversation"
+           ( Summary "Add qualified members to an existing conversation."
+               :> ZLocalUser
+               :> ZConn
+               :> "conversations"
+               :> Capture "cnv" ConvId
+               :> "members"
+               :> "v2"
+               :> ReqBody '[Servant.JSON] InviteQualified
+               :> MultiVerb 'POST '[Servant.JSON] ConvUpdateResponses (UpdateResult Event)
+           )
     -- This endpoint can lead to the following events being sent:
     -- - MemberLeave event to members
-    removeMemberUnqualified ::
-      routes
-        :- Summary "Remove a member from a conversation (deprecated)"
-        :> ZLocalUser
-        :> ZConn
-        :> CanThrow ConvNotFound
-        :> CanThrow (InvalidOp "Invalid operation")
-        :> "conversations"
-        :> Capture' '[Description "Conversation ID"] "cnv" ConvId
-        :> "members"
-        :> Capture' '[Description "Target User ID"] "usr" UserId
-        :> RemoveFromConversationVerb,
+    :<|> Named
+           "remove-member-unqualified"
+           ( Summary "Remove a member from a conversation (deprecated)"
+               :> ZLocalUser
+               :> ZConn
+               :> CanThrow ConvNotFound
+               :> CanThrow (InvalidOp "Invalid operation")
+               :> "conversations"
+               :> Capture' '[Description "Conversation ID"] "cnv" ConvId
+               :> "members"
+               :> Capture' '[Description "Target User ID"] "usr" UserId
+               :> RemoveFromConversationVerb
+           )
     -- This endpoint can lead to the following events being sent:
     -- - MemberLeave event to members
-    removeMember ::
-      routes
-        :- Summary "Remove a member from a conversation"
-        :> ZLocalUser
-        :> ZConn
-        :> CanThrow ConvNotFound
-        :> CanThrow (InvalidOp "Invalid operation")
-        :> "conversations"
-        :> QualifiedCapture' '[Description "Conversation ID"] "cnv" ConvId
-        :> "members"
-        :> QualifiedCapture' '[Description "Target User ID"] "usr" UserId
-        :> RemoveFromConversationVerb,
+    :<|> Named
+           "remove-member"
+           ( Summary "Remove a member from a conversation"
+               :> ZLocalUser
+               :> ZConn
+               :> CanThrow ConvNotFound
+               :> CanThrow (InvalidOp "Invalid operation")
+               :> "conversations"
+               :> QualifiedCapture' '[Description "Conversation ID"] "cnv" ConvId
+               :> "members"
+               :> QualifiedCapture' '[Description "Target User ID"] "usr" UserId
+               :> RemoveFromConversationVerb
+           )
     -- This endpoint can lead to the following events being sent:
     -- - MemberStateUpdate event to members
-    updateOtherMemberUnqualified ::
-      routes
-        :- Summary "Update membership of the specified user (deprecated)"
-        :> Description "Use `PUT /conversations/:cnv_domain/:cnv/members/:usr_domain/:usr` instead"
-        :> ZLocalUser
-        :> ZConn
-        :> CanThrow ConvNotFound
-        :> CanThrow ConvMemberNotFound
-        :> CanThrow (InvalidOp "Invalid operation")
-        :> "conversations"
-        :> Capture' '[Description "Conversation ID"] "cnv" ConvId
-        :> "members"
-        :> Capture' '[Description "Target User ID"] "usr" UserId
-        :> ReqBody '[JSON] OtherMemberUpdate
-        :> MultiVerb
-             'PUT
-             '[JSON]
-             '[RespondEmpty 200 "Membership updated"]
-             (),
-    updateOtherMember ::
-      routes
-        :- Summary "Update membership of the specified user"
-        :> Description "**Note**: at least one field has to be provided."
-        :> ZLocalUser
-        :> ZConn
-        :> CanThrow ConvNotFound
-        :> CanThrow ConvMemberNotFound
-        :> CanThrow (InvalidOp "Invalid operation")
-        :> "conversations"
-        :> QualifiedCapture' '[Description "Conversation ID"] "cnv" ConvId
-        :> "members"
-        :> QualifiedCapture' '[Description "Target User ID"] "usr" UserId
-        :> ReqBody '[JSON] OtherMemberUpdate
-        :> MultiVerb
-             'PUT
-             '[JSON]
-             '[RespondEmpty 200 "Membership updated"]
-             (),
+    :<|> Named
+           "update-other-member-unqualified"
+           ( Summary "Update membership of the specified user (deprecated)"
+               :> Description "Use `PUT /conversations/:cnv_domain/:cnv/members/:usr_domain/:usr` instead"
+               :> ZLocalUser
+               :> ZConn
+               :> CanThrow ConvNotFound
+               :> CanThrow ConvMemberNotFound
+               :> CanThrow (InvalidOp "Invalid operation")
+               :> "conversations"
+               :> Capture' '[Description "Conversation ID"] "cnv" ConvId
+               :> "members"
+               :> Capture' '[Description "Target User ID"] "usr" UserId
+               :> ReqBody '[JSON] OtherMemberUpdate
+               :> MultiVerb
+                    'PUT
+                    '[JSON]
+                    '[RespondEmpty 200 "Membership updated"]
+                    ()
+           )
+    :<|> Named
+           "update-other-member"
+           ( Summary "Update membership of the specified user"
+               :> Description "**Note**: at least one field has to be provided."
+               :> ZLocalUser
+               :> ZConn
+               :> CanThrow ConvNotFound
+               :> CanThrow ConvMemberNotFound
+               :> CanThrow (InvalidOp "Invalid operation")
+               :> "conversations"
+               :> QualifiedCapture' '[Description "Conversation ID"] "cnv" ConvId
+               :> "members"
+               :> QualifiedCapture' '[Description "Target User ID"] "usr" UserId
+               :> ReqBody '[JSON] OtherMemberUpdate
+               :> MultiVerb
+                    'PUT
+                    '[JSON]
+                    '[RespondEmpty 200 "Membership updated"]
+                    ()
+           )
     -- This endpoint can lead to the following events being sent:
     -- - ConvRename event to members
-    updateConversationNameDeprecated ::
-      routes
-        :- Summary "Update conversation name (deprecated)"
-        :> Description "Use `/conversations/:domain/:conv/name` instead."
-        :> ZLocalUser
-        :> ZConn
-        :> "conversations"
-        :> Capture' '[Description "Conversation ID"] "cnv" ConvId
-        :> ReqBody '[JSON] ConversationRename
-        :> MultiVerb
-             'PUT
-             '[JSON]
-             [ ConvNotFound,
-               Respond 200 "Conversation updated" Event
-             ]
-             (Maybe Event),
-    updateConversationNameUnqualified ::
-      routes
-        :- Summary "Update conversation name (deprecated)"
-        :> Description "Use `/conversations/:domain/:conv/name` instead."
-        :> ZLocalUser
-        :> ZConn
-        :> "conversations"
-        :> Capture' '[Description "Conversation ID"] "cnv" ConvId
-        :> "name"
-        :> ReqBody '[JSON] ConversationRename
-        :> MultiVerb
-             'PUT
-             '[JSON]
-             [ ConvNotFound,
-               Respond 200 "Conversation updated" Event
-             ]
-             (Maybe Event),
-    updateConversationName ::
-      routes
-        :- Summary "Update conversation name"
-        :> ZLocalUser
-        :> ZConn
-        :> "conversations"
-        :> QualifiedCapture' '[Description "Conversation ID"] "cnv" ConvId
-        :> "name"
-        :> ReqBody '[JSON] ConversationRename
-        :> MultiVerb
-             'PUT
-             '[JSON]
-             [ ConvNotFound,
-               Respond 200 "Conversation updated" Event
-             ]
-             (Maybe Event),
+    :<|> Named
+           "update-conversation-name-deprecated"
+           ( Summary "Update conversation name (deprecated)"
+               :> Description "Use `/conversations/:domain/:conv/name` instead."
+               :> ZLocalUser
+               :> ZConn
+               :> "conversations"
+               :> Capture' '[Description "Conversation ID"] "cnv" ConvId
+               :> ReqBody '[JSON] ConversationRename
+               :> MultiVerb
+                    'PUT
+                    '[JSON]
+                    [ ConvNotFound,
+                      Respond 200 "Conversation updated" Event
+                    ]
+                    (Maybe Event)
+           )
+    :<|> Named
+           "update-conversation-name-unqualified"
+           ( Summary "Update conversation name (deprecated)"
+               :> Description "Use `/conversations/:domain/:conv/name` instead."
+               :> ZLocalUser
+               :> ZConn
+               :> "conversations"
+               :> Capture' '[Description "Conversation ID"] "cnv" ConvId
+               :> "name"
+               :> ReqBody '[JSON] ConversationRename
+               :> MultiVerb
+                    'PUT
+                    '[JSON]
+                    [ ConvNotFound,
+                      Respond 200 "Conversation updated" Event
+                    ]
+                    (Maybe Event)
+           )
+    :<|> Named
+           "update-conversation-name"
+           ( Summary "Update conversation name"
+               :> ZLocalUser
+               :> ZConn
+               :> "conversations"
+               :> QualifiedCapture' '[Description "Conversation ID"] "cnv" ConvId
+               :> "name"
+               :> ReqBody '[JSON] ConversationRename
+               :> MultiVerb
+                    'PUT
+                    '[JSON]
+                    [ ConvNotFound,
+                      Respond 200 "Conversation updated" Event
+                    ]
+                    (Maybe Event)
+           )
     -- This endpoint can lead to the following events being sent:
     -- - ConvMessageTimerUpdate event to members
-    updateConversationMessageTimerUnqualified ::
-      routes
-        :- Summary "Update the message timer for a conversation (deprecated)"
-        :> Description "Use `/conversations/:domain/:cnv/message-timer` instead."
-        :> ZLocalUser
-        :> ZConn
-        :> CanThrow ConvAccessDenied
-        :> CanThrow ConvNotFound
-        :> CanThrow (InvalidOp "Invalid operation")
-        :> "conversations"
-        :> Capture' '[Description "Conversation ID"] "cnv" ConvId
-        :> "message-timer"
-        :> ReqBody '[JSON] ConversationMessageTimerUpdate
-        :> MultiVerb
-             'PUT
-             '[JSON]
-             (UpdateResponses "Message timer unchanged" "Message timer updated" Event)
-             (UpdateResult Event),
-    updateConversationMessageTimer ::
-      routes
-        :- Summary "Update the message timer for a conversation"
-        :> ZLocalUser
-        :> ZConn
-        :> CanThrow ConvAccessDenied
-        :> CanThrow ConvNotFound
-        :> CanThrow (InvalidOp "Invalid operation")
-        :> "conversations"
-        :> QualifiedCapture' '[Description "Conversation ID"] "cnv" ConvId
-        :> "message-timer"
-        :> ReqBody '[JSON] ConversationMessageTimerUpdate
-        :> MultiVerb
-             'PUT
-             '[JSON]
-             (UpdateResponses "Message timer unchanged" "Message timer updated" Event)
-             (UpdateResult Event),
+    :<|> Named
+           "update-conversation-message-timer-unqualified"
+           ( Summary "Update the message timer for a conversation (deprecated)"
+               :> Description "Use `/conversations/:domain/:cnv/message-timer` instead."
+               :> ZLocalUser
+               :> ZConn
+               :> CanThrow ConvAccessDenied
+               :> CanThrow ConvNotFound
+               :> CanThrow (InvalidOp "Invalid operation")
+               :> "conversations"
+               :> Capture' '[Description "Conversation ID"] "cnv" ConvId
+               :> "message-timer"
+               :> ReqBody '[JSON] ConversationMessageTimerUpdate
+               :> MultiVerb
+                    'PUT
+                    '[JSON]
+                    (UpdateResponses "Message timer unchanged" "Message timer updated" Event)
+                    (UpdateResult Event)
+           )
+    :<|> Named
+           "update-conversation-message-timer"
+           ( Summary "Update the message timer for a conversation"
+               :> ZLocalUser
+               :> ZConn
+               :> CanThrow ConvAccessDenied
+               :> CanThrow ConvNotFound
+               :> CanThrow (InvalidOp "Invalid operation")
+               :> "conversations"
+               :> QualifiedCapture' '[Description "Conversation ID"] "cnv" ConvId
+               :> "message-timer"
+               :> ReqBody '[JSON] ConversationMessageTimerUpdate
+               :> MultiVerb
+                    'PUT
+                    '[JSON]
+                    (UpdateResponses "Message timer unchanged" "Message timer updated" Event)
+                    (UpdateResult Event)
+           )
     -- This endpoint can lead to the following events being sent:
     -- - ConvReceiptModeUpdate event to members
-    updateConversationReceiptModeUnqualified ::
-      routes
-        :- Summary "Update receipt mode for a conversation (deprecated)"
-        :> Description "Use `PUT /conversations/:domain/:cnv/receipt-mode` instead."
-        :> ZLocalUser
-        :> ZConn
-        :> CanThrow ConvAccessDenied
-        :> CanThrow ConvNotFound
-        :> "conversations"
-        :> Capture' '[Description "Conversation ID"] "cnv" ConvId
-        :> "receipt-mode"
-        :> ReqBody '[JSON] ConversationReceiptModeUpdate
-        :> MultiVerb
-             'PUT
-             '[JSON]
-             (UpdateResponses "Receipt mode unchanged" "Receipt mode updated" Event)
-             (UpdateResult Event),
-    updateConversationReceiptMode ::
-      routes
-        :- Summary "Update receipt mode for a conversation"
-        :> ZLocalUser
-        :> ZConn
-        :> CanThrow ConvAccessDenied
-        :> CanThrow ConvNotFound
-        :> "conversations"
-        :> QualifiedCapture' '[Description "Conversation ID"] "cnv" ConvId
-        :> "receipt-mode"
-        :> ReqBody '[JSON] ConversationReceiptModeUpdate
-        :> MultiVerb
-             'PUT
-             '[JSON]
-             (UpdateResponses "Receipt mode unchanged" "Receipt mode updated" Event)
-             (UpdateResult Event),
+    :<|> Named
+           "update-conversation-receipt-mode-unqualified"
+           ( Summary "Update receipt mode for a conversation (deprecated)"
+               :> Description "Use `PUT /conversations/:domain/:cnv/receipt-mode` instead."
+               :> ZLocalUser
+               :> ZConn
+               :> CanThrow ConvAccessDenied
+               :> CanThrow ConvNotFound
+               :> "conversations"
+               :> Capture' '[Description "Conversation ID"] "cnv" ConvId
+               :> "receipt-mode"
+               :> ReqBody '[JSON] ConversationReceiptModeUpdate
+               :> MultiVerb
+                    'PUT
+                    '[JSON]
+                    (UpdateResponses "Receipt mode unchanged" "Receipt mode updated" Event)
+                    (UpdateResult Event)
+           )
+    :<|> Named
+           "update-conversation-receipt-mode"
+           ( Summary "Update receipt mode for a conversation"
+               :> ZLocalUser
+               :> ZConn
+               :> CanThrow ConvAccessDenied
+               :> CanThrow ConvNotFound
+               :> "conversations"
+               :> QualifiedCapture' '[Description "Conversation ID"] "cnv" ConvId
+               :> "receipt-mode"
+               :> ReqBody '[JSON] ConversationReceiptModeUpdate
+               :> MultiVerb
+                    'PUT
+                    '[JSON]
+                    (UpdateResponses "Receipt mode unchanged" "Receipt mode updated" Event)
+                    (UpdateResult Event)
+           )
     -- This endpoint can lead to the following events being sent:
     -- - MemberLeave event to members, if members get removed
     -- - ConvAccessUpdate event to members
-    updateConversationAccessUnqualified ::
-      routes
-        :- Summary "Update access modes for a conversation (deprecated)"
-        :> Description "Use PUT `/conversations/:domain/:cnv/access` instead."
-        :> ZLocalUser
-        :> ZConn
-        :> CanThrow ConvAccessDenied
-        :> CanThrow ConvNotFound
-        :> CanThrow (InvalidOp "Invalid operation")
-        :> "conversations"
-        :> Capture' '[Description "Conversation ID"] "cnv" ConvId
-        :> "access"
-        :> ReqBody '[JSON] ConversationAccessData
-        :> MultiVerb
-             'PUT
-             '[JSON]
-             (UpdateResponses "Access unchanged" "Access updated" Event)
-             (UpdateResult Event),
-    updateConversationAccess ::
-      routes
-        :- Summary "Update access modes for a conversation"
-        :> ZLocalUser
-        :> ZConn
-        :> CanThrow ConvAccessDenied
-        :> CanThrow ConvNotFound
-        :> CanThrow (InvalidOp "Invalid operation")
-        :> "conversations"
-        :> QualifiedCapture' '[Description "Conversation ID"] "cnv" ConvId
-        :> "access"
-        :> ReqBody '[JSON] ConversationAccessData
-        :> MultiVerb
-             'PUT
-             '[JSON]
-             (UpdateResponses "Access unchanged" "Access updated" Event)
-             (UpdateResult Event),
-    getConversationSelfUnqualified ::
-      routes
-        :- Summary "Get self membership properties (deprecated)"
-        :> ZLocalUser
-        :> "conversations"
-        :> Capture' '[Description "Conversation ID"] "cnv" ConvId
-        :> "self"
-        :> Get '[JSON] (Maybe Member),
-    updateConversationSelfUnqualified ::
-      routes
-        :- Summary "Update self membership properties (deprecated)"
-        :> Description "Use `/conversations/:domain/:conv/self` instead."
-        :> CanThrow ConvNotFound
-        :> ZLocalUser
-        :> ZConn
-        :> "conversations"
-        :> Capture' '[Description "Conversation ID"] "cnv" ConvId
-        :> "self"
-        :> ReqBody '[JSON] MemberUpdate
-        :> MultiVerb
-             'PUT
-             '[JSON]
-             '[RespondEmpty 200 "Update successful"]
-             (),
-    updateConversationSelf ::
-      routes
-        :- Summary "Update self membership properties"
-        :> Description "**Note**: at least one field has to be provided."
-        :> CanThrow ConvNotFound
-        :> ZLocalUser
-        :> ZConn
-        :> "conversations"
-        :> QualifiedCapture' '[Description "Conversation ID"] "cnv" ConvId
-        :> "self"
-        :> ReqBody '[JSON] MemberUpdate
-        :> MultiVerb
-             'PUT
-             '[JSON]
-             '[RespondEmpty 200 "Update successful"]
-             (),
-    -- Team Conversations
+    :<|> Named
+           "update-conversation-access-unqualified"
+           ( Summary "Update access modes for a conversation (deprecated)"
+               :> Description "Use PUT `/conversations/:domain/:cnv/access` instead."
+               :> ZLocalUser
+               :> ZConn
+               :> CanThrow ConvAccessDenied
+               :> CanThrow ConvNotFound
+               :> CanThrow (InvalidOp "Invalid operation")
+               :> "conversations"
+               :> Capture' '[Description "Conversation ID"] "cnv" ConvId
+               :> "access"
+               :> ReqBody '[JSON] ConversationAccessData
+               :> MultiVerb
+                    'PUT
+                    '[JSON]
+                    (UpdateResponses "Access unchanged" "Access updated" Event)
+                    (UpdateResult Event)
+           )
+    :<|> Named
+           "update-conversation-access"
+           ( Summary "Update access modes for a conversation"
+               :> ZLocalUser
+               :> ZConn
+               :> CanThrow ConvAccessDenied
+               :> CanThrow ConvNotFound
+               :> CanThrow (InvalidOp "Invalid operation")
+               :> "conversations"
+               :> QualifiedCapture' '[Description "Conversation ID"] "cnv" ConvId
+               :> "access"
+               :> ReqBody '[JSON] ConversationAccessData
+               :> MultiVerb
+                    'PUT
+                    '[JSON]
+                    (UpdateResponses "Access unchanged" "Access updated" Event)
+                    (UpdateResult Event)
+           )
+    :<|> Named
+           "get-conversation-self-unqualified"
+           ( Summary "Get self membership properties (deprecated)"
+               :> ZLocalUser
+               :> "conversations"
+               :> Capture' '[Description "Conversation ID"] "cnv" ConvId
+               :> "self"
+               :> Get '[JSON] (Maybe Member)
+           )
+    :<|> Named
+           "update-conversation-self-unqualified"
+           ( Summary "Update self membership properties (deprecated)"
+               :> Description "Use `/conversations/:domain/:conv/self` instead."
+               :> CanThrow ConvNotFound
+               :> ZLocalUser
+               :> ZConn
+               :> "conversations"
+               :> Capture' '[Description "Conversation ID"] "cnv" ConvId
+               :> "self"
+               :> ReqBody '[JSON] MemberUpdate
+               :> MultiVerb
+                    'PUT
+                    '[JSON]
+                    '[RespondEmpty 200 "Update successful"]
+                    ()
+           )
+    :<|> Named
+           "update-conversation-self"
+           ( Summary "Update self membership properties"
+               :> Description "**Note**: at least one field has to be provided."
+               :> CanThrow ConvNotFound
+               :> ZLocalUser
+               :> ZConn
+               :> "conversations"
+               :> QualifiedCapture' '[Description "Conversation ID"] "cnv" ConvId
+               :> "self"
+               :> ReqBody '[JSON] MemberUpdate
+               :> MultiVerb
+                    'PUT
+                    '[JSON]
+                    '[RespondEmpty 200 "Update successful"]
+                    ()
+           )
 
-    getTeamConversationRoles ::
-      routes
-        :- Summary "Get existing roles available for the given team"
+type TeamConversationAPI =
+  Named
+    "get-team-conversation-roles"
+    ( Summary "Get existing roles available for the given team"
         :> CanThrow NotATeamMember
         :> ZUser
         :> "teams"
         :> Capture "tid" TeamId
         :> "conversations"
         :> "roles"
-        :> Get '[Servant.JSON] ConversationRolesList,
-    getTeamConversations ::
-      routes
-        :- Summary "Get team conversations"
-        :> CanThrow OperationDenied
-        :> ZUser
-        :> "teams"
-        :> Capture "tid" TeamId
-        :> "conversations"
-        :> Get '[Servant.JSON] TeamConversationList,
-    getTeamConversation ::
-      routes
-        :- Summary "Get one team conversation"
-        :> CanThrow OperationDenied
+        :> Get '[Servant.JSON] ConversationRolesList
+    )
+    :<|> Named
+           "get-team-conversations"
+           ( Summary "Get team conversations"
+               :> CanThrow OperationDenied
+               :> ZUser
+               :> "teams"
+               :> Capture "tid" TeamId
+               :> "conversations"
+               :> Get '[Servant.JSON] TeamConversationList
+           )
+    :<|> Named
+           "get-team-conversation"
+           ( Summary "Get one team conversation"
+               :> CanThrow OperationDenied
+               :> ZUser
+               :> "teams"
+               :> Capture "tid" TeamId
+               :> "conversations"
+               :> Capture "cid" ConvId
+               :> Get '[Servant.JSON] TeamConversation
+           )
+    :<|> Named
+           "delete-team-conversation"
+           ( Summary "Remove a team conversation"
+               :> CanThrow NotATeamMember
+               :> CanThrow ActionDenied
+               :> ZLocalUser
+               :> ZConn
+               :> "teams"
+               :> Capture "tid" TeamId
+               :> "conversations"
+               :> Capture "cid" ConvId
+               :> MultiVerb 'DELETE '[JSON] '[RespondEmpty 200 "Conversation deleted"] ()
+           )
+
+type TeamAPI =
+  Named
+    "create-non-binding-team"
+    ( Summary "Create a new non binding team"
         :> ZUser
-        :> "teams"
-        :> Capture "tid" TeamId
-        :> "conversations"
-        :> Capture "cid" ConvId
-        :> Get '[Servant.JSON] TeamConversation,
-    deleteTeamConversation ::
-      routes
-        :- Summary "Remove a team conversation"
-        :> CanThrow NotATeamMember
-        :> CanThrow ActionDenied
-        :> ZLocalUser
         :> ZConn
+        :> CanThrow NotConnected
         :> "teams"
-        :> Capture "tid" TeamId
-        :> "conversations"
-        :> Capture "cid" ConvId
-        :> MultiVerb 'DELETE '[JSON] '[RespondEmpty 200 "Conversation deleted"] (),
-    postOtrMessageUnqualified ::
-      routes
-        :- Summary "Post an encrypted message to a conversation (accepts JSON or Protobuf)"
+        :> ReqBody '[Servant.JSON] NonBindingNewTeam
+        :> MultiVerb
+             'POST
+             '[JSON]
+             '[ WithHeaders
+                  '[DescHeader "Location" "Team ID" TeamId]
+                  TeamId
+                  (RespondEmpty 201 "Team ID as `Location` header value")
+              ]
+             TeamId
+    )
+    :<|> Named
+           "update-team"
+           ( Summary "Update team properties"
+               :> ZUser
+               :> ZConn
+               :> CanThrow NotATeamMember
+               :> CanThrow (OperationDeniedError 'SetTeamData)
+               :> "teams"
+               :> Capture "tid" TeamId
+               :> ReqBody '[JSON] TeamUpdateData
+               :> MultiVerb
+                    'PUT
+                    '[JSON]
+                    '[RespondEmpty 200 "Team updated"]
+                    ()
+           )
+    :<|> Named
+           "get-teams"
+           ( Summary "Get teams (deprecated); use `GET /teams/:tid`"
+               :> ZUser
+               :> "teams"
+               :> Get '[JSON] TeamList
+           )
+
+type MessagingAPI =
+  Named
+    "post-otr-message-unqualified"
+    ( Summary "Post an encrypted message to a conversation (accepts JSON or Protobuf)"
         :> Description PostOtrDescriptionUnqualified
         :> ZLocalUser
         :> ZConn
@@ -594,219 +677,133 @@ data Api routes = Api
              'POST
              '[Servant.JSON]
              (PostOtrResponses ClientMismatch)
-             (Either (MessageNotSent ClientMismatch) ClientMismatch),
-    postProteusMessage ::
-      routes
-        :- Summary "Post an encrypted message to a conversation (accepts only Protobuf)"
-        :> Description PostOtrDescription
-        :> ZLocalUser
-        :> ZConn
-        :> "conversations"
-        :> QualifiedCapture "cnv" ConvId
-        :> "proteus"
-        :> "messages"
-        :> ReqBody '[Proto] (RawProto QualifiedNewOtrMessage)
-        :> MultiVerb
-             'POST
-             '[Servant.JSON]
-             (PostOtrResponses MessageSendingStatus)
-             (Either (MessageNotSent MessageSendingStatus) MessageSendingStatus),
-    -- team features
-    teamFeatureStatusSSOGet ::
-      routes
-        :- FeatureStatusGet 'TeamFeatureSSO,
-    teamFeatureStatusLegalHoldGet ::
-      routes
-        :- FeatureStatusGet 'TeamFeatureLegalHold,
-    teamFeatureStatusLegalHoldPut ::
-      routes
-        :- FeatureStatusPut 'TeamFeatureLegalHold,
-    teamFeatureStatusSearchVisibilityGet ::
-      routes
-        :- FeatureStatusGet 'TeamFeatureSearchVisibility,
-    teamFeatureStatusSearchVisibilityPut ::
-      routes
-        :- FeatureStatusPut 'TeamFeatureSearchVisibility,
-    teamFeatureStatusSearchVisibilityDeprecatedGet ::
-      routes
-        :- FeatureStatusDeprecatedGet 'WithoutLockStatus 'TeamFeatureSearchVisibility,
-    teamFeatureStatusSearchVisibilityDeprecatedPut ::
-      routes
-        :- FeatureStatusDeprecatedPut 'TeamFeatureSearchVisibility,
-    teamFeatureStatusValidateSAMLEmailsGet ::
-      routes
-        :- FeatureStatusGet 'TeamFeatureValidateSAMLEmails,
-    teamFeatureStatusValidateSAMLEmailsDeprecatedGet ::
-      routes
-        :- FeatureStatusDeprecatedGet 'WithoutLockStatus 'TeamFeatureValidateSAMLEmails,
-    teamFeatureStatusDigitalSignaturesGet ::
-      routes
-        :- FeatureStatusGet 'TeamFeatureDigitalSignatures,
-    teamFeatureStatusDigitalSignaturesDeprecatedGet ::
-      routes
-        :- FeatureStatusDeprecatedGet 'WithoutLockStatus 'TeamFeatureDigitalSignatures,
-    teamFeatureStatusAppLockGet ::
-      routes
-        :- FeatureStatusGet 'TeamFeatureAppLock,
-    teamFeatureStatusAppLockPut ::
-      routes
-        :- FeatureStatusPut 'TeamFeatureAppLock,
-    teamFeatureStatusFileSharingGet ::
-      routes
-        :- FeatureStatusGet 'TeamFeatureFileSharing,
-    teamFeatureStatusFileSharingPut ::
-      routes
-        :- FeatureStatusPut 'TeamFeatureFileSharing,
-    teamFeatureStatusClassifiedDomainsGet ::
-      routes
-        :- FeatureStatusGet 'TeamFeatureClassifiedDomains,
-    teamFeatureStatusConferenceCallingGet ::
-      routes
-        :- FeatureStatusGet 'TeamFeatureConferenceCalling,
-    teamFeatureStatusSelfDeletingMessagesGet ::
-      routes
-        :- FeatureStatusGet 'TeamFeatureSelfDeletingMessages,
-    teamFeatureStatusSelfDeletingMessagesPut ::
-      routes
-        :- FeatureStatusPut 'TeamFeatureSelfDeletingMessages,
-    featureStatusGuestLinksGet ::
-      routes
-        :- FeatureStatusGet 'TeamFeatureGuestLinks,
-    featureStatusGuestLinksPut ::
-      routes
-        :- FeatureStatusPut 'TeamFeatureGuestLinks,
-    featureAllFeatureConfigsGet ::
-      routes
-        :- AllFeatureConfigsGet,
-    featureConfigLegalHoldGet ::
-      routes
-        :- FeatureConfigGet 'WithoutLockStatus 'TeamFeatureLegalHold,
-    featureConfigSSOGet ::
-      routes
-        :- FeatureConfigGet 'WithoutLockStatus 'TeamFeatureSSO,
-    featureConfigSearchVisibilityGet ::
-      routes
-        :- FeatureConfigGet 'WithoutLockStatus 'TeamFeatureSearchVisibility,
-    featureConfigValidateSAMLEmailsGet ::
-      routes
-        :- FeatureConfigGet 'WithoutLockStatus 'TeamFeatureValidateSAMLEmails,
-    featureConfigDigitalSignaturesGet ::
-      routes
-        :- FeatureConfigGet 'WithoutLockStatus 'TeamFeatureDigitalSignatures,
-    featureConfigAppLockGet ::
-      routes
-        :- FeatureConfigGet 'WithoutLockStatus 'TeamFeatureAppLock,
-    featureConfigFileSharingGet ::
-      routes
-        :- FeatureConfigGet 'WithoutLockStatus 'TeamFeatureFileSharing,
-    featureConfigClassifiedDomainsGet ::
-      routes
-        :- FeatureConfigGet 'WithoutLockStatus 'TeamFeatureClassifiedDomains,
-    featureConfigConferenceCallingGet ::
-      routes
-        :- FeatureConfigGet 'WithLockStatus 'TeamFeatureConferenceCalling,
-    featureConfigSelfDeletingMessagesGet ::
-      routes
-        :- FeatureConfigGet 'WithLockStatus 'TeamFeatureSelfDeletingMessages,
-    featureConfigGuestLinksGet ::
-      routes
-        :- FeatureConfigGet 'WithLockStatus 'TeamFeatureGuestLinks,
-    -- teams
-    createNonBindingTeam ::
-      routes
-        :- Summary "Create a new non binding team"
-        :> ZUser
-        :> ZConn
-        :> CanThrow NotConnected
-        :> "teams"
-        :> ReqBody '[Servant.JSON] NonBindingNewTeam
-        :> MultiVerb
-             'POST
-             '[JSON]
-             '[ WithHeaders
-                  '[DescHeader "Location" "Team ID" TeamId]
-                  TeamId
-                  (RespondEmpty 201 "Team ID as `Location` header value")
-              ]
-             TeamId,
-    updateTeam ::
-      routes
-        :- Summary "Update team properties"
-        :> ZUser
-        :> ZConn
-        :> CanThrow NotATeamMember
-        :> CanThrow (OperationDeniedError 'SetTeamData)
-        :> "teams"
-        :> Capture "tid" TeamId
-        :> ReqBody '[JSON] TeamUpdateData
-        :> MultiVerb
-             'PUT
-             '[JSON]
-             '[RespondEmpty 200 "Team updated"]
-             (),
-    getTeams ::
-      routes
-        :- Summary "Get teams (deprecated); use `GET /teams/:tid`"
-        :> ZUser
-        :> "teams"
-        :> Get '[JSON] TeamList
-  }
-  deriving (Generic)
+             (Either (MessageNotSent ClientMismatch) ClientMismatch)
+    )
+    :<|> Named
+           "post-proteus-message"
+           ( Summary "Post an encrypted message to a conversation (accepts only Protobuf)"
+               :> Description PostOtrDescription
+               :> ZLocalUser
+               :> ZConn
+               :> "conversations"
+               :> QualifiedCapture "cnv" ConvId
+               :> "proteus"
+               :> "messages"
+               :> ReqBody '[Proto] (RawProto QualifiedNewOtrMessage)
+               :> MultiVerb
+                    'POST
+                    '[Servant.JSON]
+                    (PostOtrResponses MessageSendingStatus)
+                    (Either (MessageNotSent MessageSendingStatus) MessageSendingStatus)
+           )
 
-type ServantAPI = ToServantApi Api
+type FeatureAPI =
+  FeatureStatusGet 'TeamFeatureSSO
+    :<|> FeatureStatusGet 'TeamFeatureLegalHold
+    :<|> FeatureStatusPut 'TeamFeatureLegalHold
+    :<|> FeatureStatusGet 'TeamFeatureSearchVisibility
+    :<|> FeatureStatusPut 'TeamFeatureSearchVisibility
+    :<|> FeatureStatusDeprecatedGet 'WithoutLockStatus 'TeamFeatureSearchVisibility
+    :<|> FeatureStatusDeprecatedPut 'TeamFeatureSearchVisibility
+    :<|> FeatureStatusGet 'TeamFeatureValidateSAMLEmails
+    :<|> FeatureStatusDeprecatedGet 'WithoutLockStatus 'TeamFeatureValidateSAMLEmails
+    :<|> FeatureStatusGet 'TeamFeatureDigitalSignatures
+    :<|> FeatureStatusDeprecatedGet 'WithoutLockStatus 'TeamFeatureDigitalSignatures
+    :<|> FeatureStatusGet 'TeamFeatureAppLock
+    :<|> FeatureStatusPut 'TeamFeatureAppLock
+    :<|> FeatureStatusGet 'TeamFeatureFileSharing
+    :<|> FeatureStatusPut 'TeamFeatureFileSharing
+    :<|> FeatureStatusGet 'TeamFeatureClassifiedDomains
+    :<|> FeatureStatusGet 'TeamFeatureConferenceCalling
+    :<|> FeatureStatusGet 'TeamFeatureSelfDeletingMessages
+    :<|> FeatureStatusPut 'TeamFeatureSelfDeletingMessages
+    :<|> FeatureStatusGet 'TeamFeatureGuestLinks
+    :<|> FeatureStatusPut 'TeamFeatureGuestLinks
+    :<|> AllFeatureConfigsGet
+    :<|> FeatureConfigGet 'WithoutLockStatus 'TeamFeatureLegalHold
+    :<|> FeatureConfigGet 'WithoutLockStatus 'TeamFeatureSSO
+    :<|> FeatureConfigGet 'WithoutLockStatus 'TeamFeatureSearchVisibility
+    :<|> FeatureConfigGet 'WithoutLockStatus 'TeamFeatureValidateSAMLEmails
+    :<|> FeatureConfigGet 'WithoutLockStatus 'TeamFeatureDigitalSignatures
+    :<|> FeatureConfigGet 'WithoutLockStatus 'TeamFeatureAppLock
+    :<|> FeatureConfigGet 'WithoutLockStatus 'TeamFeatureFileSharing
+    :<|> FeatureConfigGet 'WithoutLockStatus 'TeamFeatureClassifiedDomains
+    :<|> FeatureConfigGet 'WithLockStatus 'TeamFeatureConferenceCalling
+    :<|> FeatureConfigGet 'WithLockStatus 'TeamFeatureSelfDeletingMessages
+    :<|> FeatureConfigGet 'WithLockStatus 'TeamFeatureGuestLinks
 
 type FeatureStatusGet featureName =
-  Summary (AppendSymbol "Get config for " (KnownTeamFeatureNameSymbol featureName))
-    :> ZUser
-    :> "teams"
-    :> Capture "tid" TeamId
-    :> "features"
-    :> KnownTeamFeatureNameSymbol featureName
-    :> Get '[Servant.JSON] (TeamFeatureStatus 'WithLockStatus featureName)
+  Named
+    '("get", featureName)
+    ( Summary (AppendSymbol "Get config for " (KnownTeamFeatureNameSymbol featureName))
+        :> ZUser
+        :> "teams"
+        :> Capture "tid" TeamId
+        :> "features"
+        :> KnownTeamFeatureNameSymbol featureName
+        :> Get '[Servant.JSON] (TeamFeatureStatus 'WithLockStatus featureName)
+    )
 
 type FeatureStatusPut featureName =
-  Summary (AppendSymbol "Put config for " (KnownTeamFeatureNameSymbol featureName))
-    :> ZUser
-    :> "teams"
-    :> Capture "tid" TeamId
-    :> "features"
-    :> KnownTeamFeatureNameSymbol featureName
-    :> ReqBody '[Servant.JSON] (TeamFeatureStatus 'WithoutLockStatus featureName)
-    :> Put '[Servant.JSON] (TeamFeatureStatus 'WithoutLockStatus featureName)
+  Named
+    '("put", featureName)
+    ( Summary (AppendSymbol "Put config for " (KnownTeamFeatureNameSymbol featureName))
+        :> ZUser
+        :> "teams"
+        :> Capture "tid" TeamId
+        :> "features"
+        :> KnownTeamFeatureNameSymbol featureName
+        :> ReqBody '[Servant.JSON] (TeamFeatureStatus 'WithoutLockStatus featureName)
+        :> Put '[Servant.JSON] (TeamFeatureStatus 'WithoutLockStatus featureName)
+    )
 
 -- | A type for a GET endpoint for a feature with a deprecated path
 type FeatureStatusDeprecatedGet ps featureName =
-  Summary (AppendSymbol "[deprecated] Get config for " (KnownTeamFeatureNameSymbol featureName))
-    :> ZUser
-    :> "teams"
-    :> Capture "tid" TeamId
-    :> "features"
-    :> DeprecatedFeatureName featureName
-    :> Get '[Servant.JSON] (TeamFeatureStatus ps featureName)
+  Named
+    '("get-deprecated", featureName)
+    ( Summary
+        (AppendSymbol "[deprecated] Get config for " (KnownTeamFeatureNameSymbol featureName))
+        :> ZUser
+        :> "teams"
+        :> Capture "tid" TeamId
+        :> "features"
+        :> DeprecatedFeatureName featureName
+        :> Get '[Servant.JSON] (TeamFeatureStatus ps featureName)
+    )
 
 -- | A type for a PUT endpoint for a feature with a deprecated path
 type FeatureStatusDeprecatedPut featureName =
-  Summary (AppendSymbol "[deprecated] Get config for " (KnownTeamFeatureNameSymbol featureName))
-    :> ZUser
-    :> "teams"
-    :> Capture "tid" TeamId
-    :> "features"
-    :> DeprecatedFeatureName featureName
-    :> ReqBody '[Servant.JSON] (TeamFeatureStatus 'WithoutLockStatus featureName)
-    :> Put '[Servant.JSON] (TeamFeatureStatus 'WithoutLockStatus featureName)
+  Named
+    '("put-deprecated", featureName)
+    ( Summary
+        (AppendSymbol "[deprecated] Get config for " (KnownTeamFeatureNameSymbol featureName))
+        :> ZUser
+        :> "teams"
+        :> Capture "tid" TeamId
+        :> "features"
+        :> DeprecatedFeatureName featureName
+        :> ReqBody '[Servant.JSON] (TeamFeatureStatus 'WithoutLockStatus featureName)
+        :> Put '[Servant.JSON] (TeamFeatureStatus 'WithoutLockStatus featureName)
+    )
 
 type FeatureConfigGet ps featureName =
-  Summary (AppendSymbol "Get feature config for feature " (KnownTeamFeatureNameSymbol featureName))
-    :> ZUser
-    :> "feature-configs"
-    :> KnownTeamFeatureNameSymbol featureName
-    :> Get '[Servant.JSON] (TeamFeatureStatus ps featureName)
+  Named
+    '("get-config", featureName)
+    ( Summary (AppendSymbol "Get feature config for feature " (KnownTeamFeatureNameSymbol featureName))
+        :> ZUser
+        :> "feature-configs"
+        :> KnownTeamFeatureNameSymbol featureName
+        :> Get '[Servant.JSON] (TeamFeatureStatus ps featureName)
+    )
 
 type AllFeatureConfigsGet =
-  Summary "Get configurations of all features"
-    :> ZUser
-    :> "feature-configs"
-    :> Get '[Servant.JSON] AllFeatureConfigs
+  Named
+    "get-all-feature-configs"
+    ( Summary "Get configurations of all features"
+        :> ZUser
+        :> "feature-configs"
+        :> Get '[Servant.JSON] AllFeatureConfigs
+    )
 
 type PostOtrDescriptionUnqualified =
   "This endpoint ensures that the list of clients is correct and only sends the message if the list is correct.\n\
diff --git a/libs/wire-api/wire-api.cabal b/libs/wire-api/wire-api.cabal
index 2be85cae4ab..c508e20ebed 100644
--- a/libs/wire-api/wire-api.cabal
+++ b/libs/wire-api/wire-api.cabal
@@ -4,7 +4,7 @@ cabal-version: 1.12
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 58d272ac852b49af92f6387c08a6a4f797f799df93374f68296cb67600b00653
+-- hash: 751fabb66be258a1c5a5cf055e0d9f8f59070f7084eb3dfdf88272f5ed177ed6
 
 name:           wire-api
 version:        0.1.0
@@ -54,6 +54,7 @@ library
       Wire.API.Routes.MultiTablePaging
       Wire.API.Routes.MultiTablePaging.State
       Wire.API.Routes.MultiVerb
+      Wire.API.Routes.Named
       Wire.API.Routes.Public
       Wire.API.Routes.Public.Brig
       Wire.API.Routes.Public.Cannon
diff --git a/services/galley/galley.cabal b/services/galley/galley.cabal
index c89bb3504af..7a494100182 100644
--- a/services/galley/galley.cabal
+++ b/services/galley/galley.cabal
@@ -4,7 +4,7 @@ cabal-version: 1.12
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 7b6d6110c4a94aa87c7d65d1e004acb6cbc1ce6775be39cde27ff7e5eca83f59
+-- hash: 5ca30f9e591f66b924afc6773c95ecd6284e794ced766eca4ebe37af49b4984a
 
 name:           galley
 version:        0.83.0
@@ -38,6 +38,7 @@ library
       Galley.API.Message
       Galley.API.One2One
       Galley.API.Public
+      Galley.API.Public.Servant
       Galley.API.Query
       Galley.API.Teams
       Galley.API.Teams.Features
diff --git a/services/galley/src/Galley/API.hs b/services/galley/src/Galley/API.hs
index 1ae9c9a234d..f5d86ff5c88 100644
--- a/services/galley/src/Galley/API.hs
+++ b/services/galley/src/Galley/API.hs
@@ -17,13 +17,14 @@
 
 module Galley.API
   ( sitemap,
-    Public.servantSitemap,
+    servantSitemap,
   )
 where
 
 import qualified Data.Swagger.Build.Api as Doc
 import qualified Galley.API.Internal as Internal
 import qualified Galley.API.Public as Public
+import Galley.API.Public.Servant
 import Galley.App (GalleyEffects)
 import Network.Wai.Routing (Routes)
 import Polysemy
diff --git a/services/galley/src/Galley/API/Public.hs b/services/galley/src/Galley/API/Public.hs
index d92059d6bcb..d298dc30641 100644
--- a/services/galley/src/Galley/API/Public.hs
+++ b/services/galley/src/Galley/API/Public.hs
@@ -18,7 +18,6 @@ module Galley.API.Public
   ( sitemap,
     apiDocs,
     filterMissing, -- for tests
-    servantSitemap,
   )
 where
 
@@ -31,17 +30,14 @@ import qualified Data.Set as Set
 import Data.Swagger.Build.Api hiding (Response, def, min)
 import qualified Data.Swagger.Build.Api as Swagger
 import Data.Text.Encoding (decodeLatin1)
-import qualified Galley.API.Create as Create
 import qualified Galley.API.CustomBackend as CustomBackend
 import qualified Galley.API.Error as Error
 import qualified Galley.API.LegalHold as LegalHold
 import qualified Galley.API.Query as Query
 import qualified Galley.API.Teams as Teams
-import Galley.API.Teams.Features (DoAuth (..), getFeatureStatus, setFeatureStatus)
 import qualified Galley.API.Teams.Features as Features
 import qualified Galley.API.Update as Update
 import Galley.App
-import Galley.Cassandra.Paging
 import Imports hiding (head)
 import Network.HTTP.Types
 import Network.Wai
@@ -53,9 +49,6 @@ import Network.Wai.Utilities
 import Network.Wai.Utilities.Swagger
 import Network.Wai.Utilities.ZAuth hiding (ZAuthUser)
 import Polysemy
-import Servant hiding (Handler, JSON, addHeader, contentType, respond)
-import Servant.Server.Generic (genericServerT)
-import Servant.Swagger.Internal.Orphans ()
 import qualified Wire.API.Conversation.Code as Public
 import qualified Wire.API.Conversation.Typing as Public
 import qualified Wire.API.CustomBackend as Public
@@ -63,10 +56,8 @@ import qualified Wire.API.ErrorDescription as Error
 import qualified Wire.API.Event.Team as Public ()
 import qualified Wire.API.Message as Public
 import qualified Wire.API.Notification as Public
-import qualified Wire.API.Routes.Public.Galley as GalleyAPI
 import qualified Wire.API.Swagger as Public.Swagger (models)
 import qualified Wire.API.Team as Public
-import qualified Wire.API.Team.Feature as Public
 import qualified Wire.API.Team.LegalHold as Public
 import qualified Wire.API.Team.Member as Public
 import qualified Wire.API.Team.Permission as Public
@@ -74,125 +65,6 @@ import qualified Wire.API.Team.SearchVisibility as Public
 import qualified Wire.API.User as Public (UserIdList, modelUserIdList)
 import Wire.Swagger (int32Between)
 
-servantSitemap :: ServerT GalleyAPI.ServantAPI (Sem GalleyEffects)
-servantSitemap =
-  genericServerT $
-    GalleyAPI.Api
-      { GalleyAPI.getUnqualifiedConversation = Query.getUnqualifiedConversation,
-        GalleyAPI.getConversation = Query.getConversation,
-        GalleyAPI.getConversationRoles = Query.getConversationRoles,
-        GalleyAPI.listConversationIdsUnqualified = Query.conversationIdsPageFromUnqualified,
-        GalleyAPI.listConversationIds = Query.conversationIdsPageFrom,
-        GalleyAPI.getConversations = Query.getConversations,
-        GalleyAPI.getConversationByReusableCode = Query.getConversationByReusableCode,
-        GalleyAPI.listConversations = Query.listConversations,
-        GalleyAPI.createGroupConversation = Create.createGroupConversation,
-        GalleyAPI.createSelfConversation = Create.createSelfConversation,
-        GalleyAPI.createOne2OneConversation = Create.createOne2OneConversation,
-        GalleyAPI.addMembersToConversationUnqualified = Update.addMembersUnqualified,
-        GalleyAPI.addMembersToConversation = Update.addMembers,
-        GalleyAPI.removeMemberUnqualified = Update.removeMemberUnqualified,
-        GalleyAPI.removeMember = Update.removeMemberQualified,
-        GalleyAPI.updateOtherMemberUnqualified = Update.updateOtherMemberUnqualified,
-        GalleyAPI.updateOtherMember = Update.updateOtherMember,
-        GalleyAPI.updateConversationNameDeprecated = Update.updateUnqualifiedConversationName,
-        GalleyAPI.updateConversationNameUnqualified = Update.updateUnqualifiedConversationName,
-        GalleyAPI.updateConversationName = Update.updateConversationName,
-        GalleyAPI.updateConversationMessageTimerUnqualified =
-          Update.updateConversationMessageTimerUnqualified,
-        GalleyAPI.updateConversationMessageTimer = Update.updateConversationMessageTimer,
-        GalleyAPI.updateConversationReceiptModeUnqualified =
-          Update.updateConversationReceiptModeUnqualified,
-        GalleyAPI.updateConversationReceiptMode = Update.updateConversationReceiptMode,
-        GalleyAPI.updateConversationAccessUnqualified =
-          Update.updateConversationAccessUnqualified,
-        GalleyAPI.updateConversationAccess = Update.updateConversationAccess,
-        GalleyAPI.getConversationSelfUnqualified = Query.getLocalSelf,
-        GalleyAPI.updateConversationSelfUnqualified = Update.updateUnqualifiedSelfMember,
-        GalleyAPI.updateConversationSelf = Update.updateSelfMember,
-        GalleyAPI.getTeamConversationRoles = Teams.getTeamConversationRoles,
-        GalleyAPI.getTeamConversations = Teams.getTeamConversations,
-        GalleyAPI.getTeamConversation = Teams.getTeamConversation,
-        GalleyAPI.deleteTeamConversation = Teams.deleteTeamConversation,
-        GalleyAPI.postOtrMessageUnqualified = Update.postOtrMessageUnqualified,
-        GalleyAPI.postProteusMessage = Update.postProteusMessage,
-        GalleyAPI.teamFeatureStatusSSOGet =
-          getFeatureStatus @'Public.WithoutLockStatus @'Public.TeamFeatureSSO Features.getSSOStatusInternal
-            . DoAuth,
-        GalleyAPI.teamFeatureStatusLegalHoldGet =
-          getFeatureStatus @'Public.WithoutLockStatus @'Public.TeamFeatureLegalHold Features.getLegalholdStatusInternal
-            . DoAuth,
-        GalleyAPI.teamFeatureStatusLegalHoldPut =
-          setFeatureStatus @'Public.TeamFeatureLegalHold (Features.setLegalholdStatusInternal @InternalPaging) . DoAuth,
-        GalleyAPI.teamFeatureStatusSearchVisibilityGet =
-          getFeatureStatus @'Public.WithoutLockStatus @'Public.TeamFeatureSearchVisibility Features.getTeamSearchVisibilityAvailableInternal
-            . DoAuth,
-        GalleyAPI.teamFeatureStatusSearchVisibilityPut =
-          setFeatureStatus @'Public.TeamFeatureSearchVisibility Features.setTeamSearchVisibilityAvailableInternal
-            . DoAuth,
-        GalleyAPI.teamFeatureStatusSearchVisibilityDeprecatedGet =
-          getFeatureStatus @'Public.WithoutLockStatus @'Public.TeamFeatureSearchVisibility Features.getTeamSearchVisibilityAvailableInternal
-            . DoAuth,
-        GalleyAPI.teamFeatureStatusSearchVisibilityDeprecatedPut =
-          setFeatureStatus @'Public.TeamFeatureSearchVisibility Features.setTeamSearchVisibilityAvailableInternal
-            . DoAuth,
-        GalleyAPI.teamFeatureStatusValidateSAMLEmailsGet =
-          getFeatureStatus @'Public.WithoutLockStatus @'Public.TeamFeatureValidateSAMLEmails Features.getValidateSAMLEmailsInternal
-            . DoAuth,
-        GalleyAPI.teamFeatureStatusValidateSAMLEmailsDeprecatedGet =
-          getFeatureStatus @'Public.WithoutLockStatus @'Public.TeamFeatureValidateSAMLEmails Features.getValidateSAMLEmailsInternal
-            . DoAuth,
-        GalleyAPI.teamFeatureStatusDigitalSignaturesGet =
-          getFeatureStatus @'Public.WithoutLockStatus @'Public.TeamFeatureDigitalSignatures Features.getDigitalSignaturesInternal
-            . DoAuth,
-        GalleyAPI.teamFeatureStatusDigitalSignaturesDeprecatedGet =
-          getFeatureStatus @'Public.WithoutLockStatus @'Public.TeamFeatureDigitalSignatures Features.getDigitalSignaturesInternal
-            . DoAuth,
-        GalleyAPI.teamFeatureStatusAppLockGet =
-          getFeatureStatus @'Public.WithoutLockStatus @'Public.TeamFeatureAppLock Features.getAppLockInternal
-            . DoAuth,
-        GalleyAPI.teamFeatureStatusAppLockPut =
-          setFeatureStatus @'Public.TeamFeatureAppLock Features.setAppLockInternal
-            . DoAuth,
-        GalleyAPI.teamFeatureStatusFileSharingGet =
-          getFeatureStatus @'Public.WithoutLockStatus @'Public.TeamFeatureFileSharing Features.getFileSharingInternal . DoAuth,
-        GalleyAPI.teamFeatureStatusFileSharingPut =
-          setFeatureStatus @'Public.TeamFeatureFileSharing Features.setFileSharingInternal . DoAuth,
-        GalleyAPI.teamFeatureStatusClassifiedDomainsGet =
-          getFeatureStatus @'Public.WithoutLockStatus @'Public.TeamFeatureClassifiedDomains Features.getClassifiedDomainsInternal
-            . DoAuth,
-        GalleyAPI.teamFeatureStatusConferenceCallingGet =
-          getFeatureStatus @'Public.WithoutLockStatus @'Public.TeamFeatureConferenceCalling Features.getConferenceCallingInternal
-            . DoAuth,
-        GalleyAPI.teamFeatureStatusSelfDeletingMessagesGet =
-          getFeatureStatus @'Public.WithLockStatus @'Public.TeamFeatureSelfDeletingMessages Features.getSelfDeletingMessagesInternal
-            . DoAuth,
-        GalleyAPI.teamFeatureStatusSelfDeletingMessagesPut =
-          setFeatureStatus @'Public.TeamFeatureSelfDeletingMessages Features.setSelfDeletingMessagesInternal
-            . DoAuth,
-        GalleyAPI.featureStatusGuestLinksGet =
-          Features.getFeatureStatus @'Public.WithLockStatus @'Public.TeamFeatureGuestLinks Features.getGuestLinkInternal
-            . DoAuth,
-        GalleyAPI.featureStatusGuestLinksPut =
-          Features.setFeatureStatus @'Public.TeamFeatureGuestLinks Features.setGuestLinkInternal
-            . DoAuth,
-        GalleyAPI.featureAllFeatureConfigsGet = Features.getAllFeatureConfigs,
-        GalleyAPI.featureConfigLegalHoldGet = Features.getFeatureConfig @'Public.WithoutLockStatus @'Public.TeamFeatureLegalHold Features.getLegalholdStatusInternal,
-        GalleyAPI.featureConfigSSOGet = Features.getFeatureConfig @'Public.WithoutLockStatus @'Public.TeamFeatureSSO Features.getSSOStatusInternal,
-        GalleyAPI.featureConfigSearchVisibilityGet = Features.getFeatureConfig @'Public.WithoutLockStatus @'Public.TeamFeatureSearchVisibility Features.getTeamSearchVisibilityAvailableInternal,
-        GalleyAPI.featureConfigValidateSAMLEmailsGet = Features.getFeatureConfig @'Public.WithoutLockStatus @'Public.TeamFeatureValidateSAMLEmails Features.getValidateSAMLEmailsInternal,
-        GalleyAPI.featureConfigDigitalSignaturesGet = Features.getFeatureConfig @'Public.WithoutLockStatus @'Public.TeamFeatureDigitalSignatures Features.getDigitalSignaturesInternal,
-        GalleyAPI.featureConfigAppLockGet = Features.getFeatureConfig @'Public.WithoutLockStatus @'Public.TeamFeatureAppLock Features.getAppLockInternal,
-        GalleyAPI.featureConfigFileSharingGet = Features.getFeatureConfig @'Public.WithoutLockStatus @'Public.TeamFeatureFileSharing Features.getFileSharingInternal,
-        GalleyAPI.featureConfigClassifiedDomainsGet = Features.getFeatureConfig @'Public.WithoutLockStatus @'Public.TeamFeatureClassifiedDomains Features.getClassifiedDomainsInternal,
-        GalleyAPI.featureConfigConferenceCallingGet = Features.getFeatureConfig @'Public.WithoutLockStatus @'Public.TeamFeatureConferenceCalling Features.getConferenceCallingInternal,
-        GalleyAPI.featureConfigSelfDeletingMessagesGet = Features.getFeatureConfig @'Public.WithLockStatus @'Public.TeamFeatureSelfDeletingMessages Features.getSelfDeletingMessagesInternal,
-        GalleyAPI.featureConfigGuestLinksGet = Features.getFeatureConfig @'Public.WithLockStatus @'Public.TeamFeatureGuestLinks Features.getGuestLinkInternal,
-        GalleyAPI.createNonBindingTeam = Teams.createNonBindingTeamH,
-        GalleyAPI.updateTeam = Teams.updateTeamH,
-        GalleyAPI.getTeams = Teams.getManyTeams
-      }
-
 sitemap :: Routes ApiBuilder (Sem GalleyEffects) ()
 sitemap = do
   -- Team API -----------------------------------------------------------
diff --git a/services/galley/src/Galley/API/Public/Servant.hs b/services/galley/src/Galley/API/Public/Servant.hs
new file mode 100644
index 00000000000..90ce6ca3a39
--- /dev/null
+++ b/services/galley/src/Galley/API/Public/Servant.hs
@@ -0,0 +1,234 @@
+-- This file is part of the Wire Server implementation.
+--
+-- Copyright (C) 2022 Wire Swiss GmbH <opensource@wire.com>
+--
+-- This program is free software: you can redistribute it and/or modify it under
+-- the terms of the GNU Affero General Public License as published by the Free
+-- Software Foundation, either version 3 of the License, or (at your option) any
+-- later version.
+--
+-- This program is distributed in the hope that it will be useful, but WITHOUT
+-- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+-- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+-- details.
+--
+-- You should have received a copy of the GNU Affero General Public License along
+-- with this program. If not, see <https://www.gnu.org/licenses/>.
+
+module Galley.API.Public.Servant (servantSitemap) where
+
+import Galley.API.Create
+import Galley.API.Query
+import Galley.API.Teams
+import Galley.API.Teams.Features
+import Galley.API.Update
+import Galley.App
+import Galley.Cassandra.Paging
+import Imports
+import Polysemy
+import Servant.API
+import Servant.Server
+import Wire.API.Routes.Named
+import Wire.API.Routes.Public.Galley
+import Wire.API.Team.Feature
+
+servantSitemap :: ServerT ServantAPI (Sem GalleyEffects)
+servantSitemap = conversations :<|> teamConversations :<|> messaging :<|> team :<|> features
+  where
+    conversations =
+      Named @"get-unqualified-conversation" getUnqualifiedConversation
+        :<|> Named @"get-conversation" getConversation
+        :<|> Named @"get-conversation-roles" getConversationRoles
+        :<|> Named @"list-conversation-ids-unqualified" conversationIdsPageFromUnqualified
+        :<|> Named @"list-conversation-ids" conversationIdsPageFrom
+        :<|> Named @"get-conversations" getConversations
+        :<|> Named @"list-conversations" listConversations
+        :<|> Named @"get-conversation-by-reusable-code" getConversationByReusableCode
+        :<|> Named @"create-group-conversation" createGroupConversation
+        :<|> Named @"create-self-conversation" createSelfConversation
+        :<|> Named @"create-one-to-one-conversation" createOne2OneConversation
+        :<|> Named @"add-members-to-conversation-unqualified" addMembersUnqualified
+        :<|> Named @"add-members-to-conversation" addMembers
+        :<|> Named @"remove-member-unqualified" removeMemberUnqualified
+        :<|> Named @"remove-member" removeMemberQualified
+        :<|> Named @"update-other-member-unqualified" updateOtherMemberUnqualified
+        :<|> Named @"update-other-member" updateOtherMember
+        :<|> Named @"update-conversation-name-deprecated" updateUnqualifiedConversationName
+        :<|> Named @"update-conversation-name-unqualified" updateUnqualifiedConversationName
+        :<|> Named @"update-conversation-name" updateConversationName
+        :<|> Named @"update-conversation-message-timer-unqualified" updateConversationMessageTimerUnqualified
+        :<|> Named @"update-conversation-message-timer" updateConversationMessageTimer
+        :<|> Named @"update-conversation-receipt-mode-unqualified" updateConversationReceiptModeUnqualified
+        :<|> Named @"update-conversation-receipt-mode" updateConversationReceiptMode
+        :<|> Named @"update-conversation-access-unqualified" updateConversationAccessUnqualified
+        :<|> Named @"update-conversation-access" updateConversationAccess
+        :<|> Named @"get-conversation-self-unqualified" getLocalSelf
+        :<|> Named @"update-conversation-self-unqualified" updateUnqualifiedSelfMember
+        :<|> Named @"update-conversation-self" updateSelfMember
+
+    teamConversations =
+      Named @"get-team-conversation-roles" getTeamConversationRoles
+        :<|> Named @"get-team-conversations" getTeamConversations
+        :<|> Named @"get-team-conversation" getTeamConversation
+        :<|> Named @"delete-team-conversation" deleteTeamConversation
+
+    messaging =
+      Named @"post-otr-message-unqualified" postOtrMessageUnqualified
+        :<|> Named @"post-proteus-message" postProteusMessage
+
+    team =
+      Named @"create-non-binding-team" createNonBindingTeamH
+        :<|> Named @"update-team" updateTeamH
+        :<|> Named @"get-teams" getManyTeams
+
+    features =
+      Named @'("get", 'TeamFeatureSSO)
+        ( getFeatureStatus @'WithoutLockStatus @'TeamFeatureSSO
+            getSSOStatusInternal
+            . DoAuth
+        )
+        :<|> Named @'("get", 'TeamFeatureLegalHold)
+          ( getFeatureStatus @'WithoutLockStatus @'TeamFeatureLegalHold
+              getLegalholdStatusInternal
+              . DoAuth
+          )
+        :<|> Named @'("put", 'TeamFeatureLegalHold)
+          ( setFeatureStatus @'TeamFeatureLegalHold
+              (setLegalholdStatusInternal @InternalPaging)
+              . DoAuth
+          )
+        :<|> Named @'("get", 'TeamFeatureSearchVisibility)
+          ( getFeatureStatus @'WithoutLockStatus @'TeamFeatureSearchVisibility
+              getTeamSearchVisibilityAvailableInternal
+              . DoAuth
+          )
+        :<|> Named @'("put", 'TeamFeatureSearchVisibility)
+          ( setFeatureStatus @'TeamFeatureSearchVisibility
+              setTeamSearchVisibilityAvailableInternal
+              . DoAuth
+          )
+        :<|> Named @'("get-deprecated", 'TeamFeatureSearchVisibility)
+          ( getFeatureStatus @'WithoutLockStatus @'TeamFeatureSearchVisibility
+              getTeamSearchVisibilityAvailableInternal
+              . DoAuth
+          )
+        :<|> Named @'("put-deprecated", 'TeamFeatureSearchVisibility)
+          ( setFeatureStatus @'TeamFeatureSearchVisibility
+              setTeamSearchVisibilityAvailableInternal
+              . DoAuth
+          )
+        :<|> Named @'("get", 'TeamFeatureValidateSAMLEmails)
+          ( getFeatureStatus @'WithoutLockStatus @'TeamFeatureValidateSAMLEmails
+              getValidateSAMLEmailsInternal
+              . DoAuth
+          )
+        :<|> Named @'("get-deprecated", 'TeamFeatureValidateSAMLEmails)
+          ( getFeatureStatus @'WithoutLockStatus @'TeamFeatureValidateSAMLEmails
+              getValidateSAMLEmailsInternal
+              . DoAuth
+          )
+        :<|> Named @'("get", 'TeamFeatureDigitalSignatures)
+          ( getFeatureStatus @'WithoutLockStatus @'TeamFeatureDigitalSignatures
+              getDigitalSignaturesInternal
+              . DoAuth
+          )
+        :<|> Named @'("get-deprecated", 'TeamFeatureDigitalSignatures)
+          ( getFeatureStatus @'WithoutLockStatus @'TeamFeatureDigitalSignatures
+              getDigitalSignaturesInternal
+              . DoAuth
+          )
+        :<|> Named @'("get", 'TeamFeatureAppLock)
+          ( getFeatureStatus @'WithoutLockStatus @'TeamFeatureAppLock
+              getAppLockInternal
+              . DoAuth
+          )
+        :<|> Named @'("put", 'TeamFeatureAppLock)
+          ( setFeatureStatus @'TeamFeatureAppLock
+              setAppLockInternal
+              . DoAuth
+          )
+        :<|> Named @'("get", 'TeamFeatureFileSharing)
+          ( getFeatureStatus @'WithoutLockStatus @'TeamFeatureFileSharing
+              getFileSharingInternal
+              . DoAuth
+          )
+        :<|> Named @'("put", 'TeamFeatureFileSharing)
+          ( setFeatureStatus @'TeamFeatureFileSharing
+              setFileSharingInternal
+              . DoAuth
+          )
+        :<|> Named @'("get", 'TeamFeatureClassifiedDomains)
+          ( getFeatureStatus @'WithoutLockStatus @'TeamFeatureClassifiedDomains
+              getClassifiedDomainsInternal
+              . DoAuth
+          )
+        :<|> Named @'("get", 'TeamFeatureConferenceCalling)
+          ( getFeatureStatus @'WithoutLockStatus @'TeamFeatureConferenceCalling
+              getConferenceCallingInternal
+              . DoAuth
+          )
+        :<|> Named @'("get", 'TeamFeatureSelfDeletingMessages)
+          ( getFeatureStatus @'WithLockStatus @'TeamFeatureSelfDeletingMessages
+              getSelfDeletingMessagesInternal
+              . DoAuth
+          )
+        :<|> Named @'("put", 'TeamFeatureSelfDeletingMessages)
+          ( setFeatureStatus @'TeamFeatureSelfDeletingMessages
+              setSelfDeletingMessagesInternal
+              . DoAuth
+          )
+        :<|> Named @'("get", 'TeamFeatureGuestLinks)
+          ( getFeatureStatus @'WithLockStatus @'TeamFeatureGuestLinks
+              getGuestLinkInternal
+              . DoAuth
+          )
+        :<|> Named @'("put", 'TeamFeatureGuestLinks)
+          ( setFeatureStatus @'TeamFeatureGuestLinks
+              setGuestLinkInternal
+              . DoAuth
+          )
+        :<|> Named @"get-all-feature-configs" getAllFeatureConfigs
+        :<|> Named @'("get-config", 'TeamFeatureLegalHold)
+          ( getFeatureConfig @'WithoutLockStatus @'TeamFeatureLegalHold
+              getLegalholdStatusInternal
+          )
+        :<|> Named @'("get-config", 'TeamFeatureSSO)
+          ( getFeatureConfig @'WithoutLockStatus @'TeamFeatureSSO
+              getSSOStatusInternal
+          )
+        :<|> Named @'("get-config", 'TeamFeatureSearchVisibility)
+          ( getFeatureConfig @'WithoutLockStatus @'TeamFeatureSearchVisibility
+              getTeamSearchVisibilityAvailableInternal
+          )
+        :<|> Named @'("get-config", 'TeamFeatureValidateSAMLEmails)
+          ( getFeatureConfig @'WithoutLockStatus @'TeamFeatureValidateSAMLEmails
+              getValidateSAMLEmailsInternal
+          )
+        :<|> Named @'("get-config", 'TeamFeatureDigitalSignatures)
+          ( getFeatureConfig @'WithoutLockStatus @'TeamFeatureDigitalSignatures
+              getDigitalSignaturesInternal
+          )
+        :<|> Named @'("get-config", 'TeamFeatureAppLock)
+          ( getFeatureConfig @'WithoutLockStatus @'TeamFeatureAppLock
+              getAppLockInternal
+          )
+        :<|> Named @'("get-config", 'TeamFeatureFileSharing)
+          ( getFeatureConfig @'WithoutLockStatus @'TeamFeatureFileSharing
+              getFileSharingInternal
+          )
+        :<|> Named @'("get-config", 'TeamFeatureClassifiedDomains)
+          ( getFeatureConfig @'WithoutLockStatus @'TeamFeatureClassifiedDomains
+              getClassifiedDomainsInternal
+          )
+        :<|> Named @'("get-config", 'TeamFeatureConferenceCalling)
+          ( getFeatureConfig @'WithoutLockStatus @'TeamFeatureConferenceCalling
+              getConferenceCallingInternal
+          )
+        :<|> Named @'("get-config", 'TeamFeatureSelfDeletingMessages)
+          ( getFeatureConfig @'WithLockStatus @'TeamFeatureSelfDeletingMessages
+              getSelfDeletingMessagesInternal
+          )
+        :<|> Named @'("get-config", 'TeamFeatureGuestLinks)
+          ( getFeatureConfig @'WithLockStatus @'TeamFeatureGuestLinks
+              getGuestLinkInternal
+          )

From 80576369e75b82e73b68e71e1fb2c69c6ae32587 Mon Sep 17 00:00:00 2001
From: Leif Battermann <leif.battermann@gmail.com>
Date: Tue, 11 Jan 2022 12:24:10 +0100
Subject: [PATCH 60/74] Set Default User Locale (#2028)

Co-authored-by: fisx <mf@zerobuzz.net>
---
 changelog.d/0-release-notes/pr-2028           |  1 +
 changelog.d/2-features/pr-2028                |  1 +
 charts/brig/templates/configmap.yaml          |  3 +-
 charts/brig/values.yaml                       |  4 +-
 .../services-demo/conf/brig.demo-docker.yaml  |  3 +-
 deploy/services-demo/conf/brig.demo.yaml      |  3 +-
 docs/reference/config-options.md              | 27 +++++++++++++
 hack/helm_vars/wire-server/values.yaml.gotmpl |  3 +-
 services/brig/brig.integration.yaml           |  3 +-
 services/brig/src/Brig/API/User.hs            |  2 +-
 services/brig/src/Brig/Data/User.hs           | 12 +++---
 services/brig/src/Brig/Options.hs             | 38 ++++++++++++++++---
 services/brig/src/Brig/Provider/API.hs        |  4 +-
 services/brig/src/Brig/Provider/Template.hs   |  2 +-
 services/brig/src/Brig/Team/Template.hs       |  2 +-
 services/brig/src/Brig/User/Template.hs       |  2 +-
 16 files changed, 85 insertions(+), 25 deletions(-)
 create mode 100644 changelog.d/0-release-notes/pr-2028
 create mode 100644 changelog.d/2-features/pr-2028

diff --git a/changelog.d/0-release-notes/pr-2028 b/changelog.d/0-release-notes/pr-2028
new file mode 100644
index 00000000000..cc4cf7d5a47
--- /dev/null
+++ b/changelog.d/0-release-notes/pr-2028
@@ -0,0 +1 @@
+The brig server config option `setDefaultLocale` has been replaced by `setDefaultUserLocale` and `setDefaultTemplateLocale` (see docs/reference/config-options.md for details)
diff --git a/changelog.d/2-features/pr-2028 b/changelog.d/2-features/pr-2028
new file mode 100644
index 00000000000..03d788286ee
--- /dev/null
+++ b/changelog.d/2-features/pr-2028
@@ -0,0 +1 @@
+Specialize `setDefaultLocale` to distinguish between default user locale and default template locale if the user's locale is n/a.
diff --git a/charts/brig/templates/configmap.yaml b/charts/brig/templates/configmap.yaml
index a127f33559c..f2374810aba 100644
--- a/charts/brig/templates/configmap.yaml
+++ b/charts/brig/templates/configmap.yaml
@@ -204,7 +204,8 @@ data:
         suspendTimeout: {{ .setSuspendInactiveUsers.suspendTimeout }}
       {{- end }}
       setRichInfoLimit: {{ .setRichInfoLimit }}
-      setDefaultLocale: {{ .setDefaultLocale }}
+      setDefaultTemplateLocale: en
+      setDefaultUserLocale: {{ .setDefaultUserLocale }}
       setMaxTeamSize: {{ .setMaxTeamSize }}
       setMaxConvSize: {{ .setMaxConvSize }}
       setEmailVisibility: {{ .setEmailVisibility }}
diff --git a/charts/brig/values.yaml b/charts/brig/values.yaml
index 481131558e9..bb67cc4c495 100644
--- a/charts/brig/values.yaml
+++ b/charts/brig/values.yaml
@@ -53,7 +53,6 @@ config:
     legalholdUserTokenTimeout: 4838400
     legalholdAccessTokenTimeout: 900
   optSettings:
-    setDefaultLocale: en
     setActivationTimeout: 1209600
     setTeamInvitationTimeout: 1814400
     setUserMaxConnections: 1000
@@ -64,7 +63,8 @@ config:
       stdDev: 3000
       retryAfter: 86400
     setRichInfoLimit: 5000
-    setDefaultLocale: en
+    setDefaultTemplateLocale: en
+    setDefaultUserLocale: en
     setMaxTeamSize: 500
     setMaxConvSize: 500
     # Allowed values: https://github.com/wireapp/wire-server/blob/0126651a25aabc0c5589edc2b1988bb06550a03a/services/brig/src/Brig/Options.hs#L304-L306
diff --git a/deploy/services-demo/conf/brig.demo-docker.yaml b/deploy/services-demo/conf/brig.demo-docker.yaml
index 6de26fd1e66..ff9c1417d13 100644
--- a/deploy/services-demo/conf/brig.demo-docker.yaml
+++ b/deploy/services-demo/conf/brig.demo-docker.yaml
@@ -109,7 +109,8 @@ optSettings:
     stdDev: 3000      # 50 minutes
     retryAfter: 86400 # 1 day
   setRichInfoLimit: 5000  # should be in sync with Spar
-  setDefaultLocale: en
+  setDefaultTemplateLocale: en
+  setDefaultUserLocale: en
   setMaxTeamSize: 128
   setMaxConvSize: 128
   setEmailVisibility: visible_to_self
diff --git a/deploy/services-demo/conf/brig.demo.yaml b/deploy/services-demo/conf/brig.demo.yaml
index 90072befc8f..c4243c2942c 100644
--- a/deploy/services-demo/conf/brig.demo.yaml
+++ b/deploy/services-demo/conf/brig.demo.yaml
@@ -109,7 +109,8 @@ optSettings:
     stdDev: 3000      # 50 minutes
     retryAfter: 86400 # 1 day
   setRichInfoLimit: 5000  # should be in sync with Spar
-  setDefaultLocale: en
+  setDefaultTemplateLocale: en
+  setDefaultUserLocale: en
   setMaxTeamSize: 128
   setMaxConvSize: 128
   setEmailVisibility: visible_to_self
diff --git a/docs/reference/config-options.md b/docs/reference/config-options.md
index 03630aee07a..c5143212ac4 100644
--- a/docs/reference/config-options.md
+++ b/docs/reference/config-options.md
@@ -319,3 +319,30 @@ When a `null` value is encountered, it is assumed to be
 `defaultForNull`.
 
 (Introduced in https://github.com/wireapp/wire-server/pull/1811.)
+
+### Locale
+
+
+#### setDefaultLocale (deprecated / ignored)
+
+The brig server config option `setDefaultLocale` has been replaced by `setDefaultUserLocale` and `setDefaultTemplateLocale`. Both settings are optional and `setDefaultTemplateLocale` defaults to `EN` and `setDefaultLocale` defaults to `setDefaultTemplateLocale`. If `setDefaultLocale` was not set or set to `EN` before this change, nothing needs to be done. If `setDefaultLocale` was set to any other language other than `EN` the name of the setting should be changed to `setDefaultTemplateLocale`. 
+
+#### `setDefaultTemplateLocale`
+
+This option determines the default locale for email templates. The language of the email communication is determined by the user locale (see above). Only if templates of the the locale of the user do not exist or if user locale is not set the `setDefaultTemplateLocale` is used as a fallback. If not set the default is `EN`. This setting should not be changed unless a complete set of templates is available for the given language.
+
+```
+# [brig.yaml]
+optSettings:
+  setDefaultTemplateLocale: en
+```
+
+#### `setDefaultUserLocale`
+
+This option is the default user locale to be used if it is not set in the user profile. This can be the case if the users are provisioned by SCIM e.g. This option determines which language to use for email communication. If not set the default is the value that is configured for `setDefaultTemplateLocale`.
+
+```
+# [brig.yaml]
+optSettings:
+  setDefaultUserLocale: en
+```
diff --git a/hack/helm_vars/wire-server/values.yaml.gotmpl b/hack/helm_vars/wire-server/values.yaml.gotmpl
index 4f56a33f9bd..107aec9f9d3 100644
--- a/hack/helm_vars/wire-server/values.yaml.gotmpl
+++ b/hack/helm_vars/wire-server/values.yaml.gotmpl
@@ -69,7 +69,8 @@ brig:
         retryLimit: 5  # how many times can you have a failed login in that timeframe.
       setSuspendInactiveUsers:
         suspendTimeout: 10
-      setDefaultLocale: en
+      setDefaultTemplateLocale: en
+      setDefaultUserLocale: en
       setMaxConvAndTeamSize: 16
       setMaxTeamSize: 32
       setMaxConvSize: 16
diff --git a/services/brig/brig.integration.yaml b/services/brig/brig.integration.yaml
index b5ca314dfb9..fa2d13ffe14 100644
--- a/services/brig/brig.integration.yaml
+++ b/services/brig/brig.integration.yaml
@@ -152,7 +152,8 @@ optSettings:
   setSuspendInactiveUsers:  # if this is omitted: never suspend inactive users.
     suspendTimeout: 10
   setRichInfoLimit: 5000  # should be in sync with Spar
-  setDefaultLocale: en
+  setDefaultTemplateLocale: en
+  setDefaultUserLocale: en
   setMaxTeamSize: 32
   setMaxConvSize: 16
   setEmailVisibility: visible_to_self
diff --git a/services/brig/src/Brig/API/User.hs b/services/brig/src/Brig/API/User.hs
index f1bdc2f0b87..b70bc93f5d9 100644
--- a/services/brig/src/Brig/API/User.hs
+++ b/services/brig/src/Brig/API/User.hs
@@ -1062,7 +1062,7 @@ deleteAccount account@(accountUser -> user) = do
   revokeAllCookies uid
   where
     mkTombstone = do
-      defLoc <- setDefaultLocale <$> view settings
+      defLoc <- setDefaultUserLocale <$> view settings
       return $
         account
           { accountStatus = Deleted,
diff --git a/services/brig/src/Brig/Data/User.hs b/services/brig/src/Brig/Data/User.hs
index 1d501b0f489..56d8698266a 100644
--- a/services/brig/src/Brig/Data/User.hs
+++ b/services/brig/src/Brig/Data/User.hs
@@ -118,7 +118,7 @@ data ReAuthError
 -- there, it was claimed properly.
 newAccount :: NewUser -> Maybe InvitationId -> Maybe TeamId -> Maybe Handle -> AppIO (UserAccount, Maybe Password)
 newAccount u inv tid mbHandle = do
-  defLoc <- setDefaultLocale <$> view settings
+  defLoc <- setDefaultUserLocale <$> view settings
   domain <- viewFederationDomain
   uid <-
     Id <$> do
@@ -132,7 +132,7 @@ newAccount u inv tid mbHandle = do
       -- Ephemeral users' expiry time is in expires_in (default sessionTokenTimeout) seconds
       e <- view zauthEnv
       let ZAuth.SessionTokenTimeout defTTL = e ^. ZAuth.settings . ZAuth.sessionTokenTimeout
-          ttl = fromMaybe defTTL (fromRange <$> newUserExpiresIn u)
+          ttl = maybe defTTL fromRange (newUserExpiresIn u)
       now <- liftIO =<< view currentTime
       return . Just . toUTCTimeMillis $ addUTCTime (fromIntegral ttl) now
     _ -> return Nothing
@@ -154,7 +154,7 @@ newAccount u inv tid mbHandle = do
 
 newAccountInviteViaScim :: UserId -> TeamId -> Maybe Locale -> Name -> Email -> AppIO UserAccount
 newAccountInviteViaScim uid tid locale name email = do
-  defLoc <- setDefaultLocale <$> view settings
+  defLoc <- setDefaultUserLocale <$> view settings
   domain <- viewFederationDomain
   return (UserAccount (user domain (fromMaybe defLoc locale)) PendingInvitation)
   where
@@ -370,7 +370,7 @@ deactivateUser u =
 
 lookupLocale :: UserId -> AppIO (Maybe Locale)
 lookupLocale u = do
-  defLoc <- setDefaultLocale <$> view settings
+  defLoc <- setDefaultUserLocale <$> view settings
   fmap (toLocale defLoc) <$> retry x1 (query1 localeSelect (params LocalQuorum (Identity u)))
 
 lookupName :: UserId -> AppIO (Maybe Name)
@@ -417,7 +417,7 @@ lookupAuth u = fmap f <$> retry x1 (query1 authSelect (params LocalQuorum (Ident
 -- Skips nonexistent users. /Does not/ skip users who have been deleted.
 lookupUsers :: HavePendingInvitations -> [UserId] -> AppIO [User]
 lookupUsers hpi usrs = do
-  loc <- setDefaultLocale <$> view settings
+  loc <- setDefaultUserLocale <$> view settings
   domain <- viewFederationDomain
   toUsers domain loc hpi <$> retry x1 (query usersSelect (params LocalQuorum (Identity usrs)))
 
@@ -426,7 +426,7 @@ lookupAccount u = listToMaybe <$> lookupAccounts [u]
 
 lookupAccounts :: [UserId] -> AppIO [UserAccount]
 lookupAccounts usrs = do
-  loc <- setDefaultLocale <$> view settings
+  loc <- setDefaultUserLocale <$> view settings
   domain <- viewFederationDomain
   fmap (toUserAccount domain loc) <$> retry x1 (query accountsSelect (params LocalQuorum (Identity usrs)))
 
diff --git a/services/brig/src/Brig/Options.hs b/services/brig/src/Brig/Options.hs
index ad631e49325..8487c2c4767 100644
--- a/services/brig/src/Brig/Options.hs
+++ b/services/brig/src/Brig/Options.hs
@@ -26,13 +26,15 @@ import Brig.Types
 import Brig.User.Auth.Cookie.Limit
 import Brig.Whitelist (Whitelist (..))
 import qualified Brig.ZAuth as ZAuth
+import Control.Applicative
 import qualified Control.Lens as Lens
-import Data.Aeson (withText)
+import Data.Aeson (defaultOptions, fieldLabelModifier, genericParseJSON, withText)
 import qualified Data.Aeson as Aeson
 import Data.Aeson.Types (typeMismatch)
 import qualified Data.Char as Char
 import Data.Domain (Domain (..))
 import Data.Id
+import Data.LanguageCodes (ISO639_1 (EN))
 import Data.Misc (HttpsUrl)
 import Data.Range
 import Data.Scientific (toBoundedInteger)
@@ -439,9 +441,12 @@ data Settings = Settings
     --   field names and values), should be in sync
     --   with Spar
     setRichInfoLimit :: !Int,
-    -- | Default locale to use
-    --   (e.g. when selecting templates)
-    setDefaultLocale :: !Locale,
+    -- | Default locale to use when selecting templates
+    -- use `setDefaultTemplateLocale` as the getter function which always provides a default value
+    setDefaultTemplateLocaleInternal :: !(Maybe Locale),
+    -- | Default locale to use for users
+    -- use `setDefaultUserLocale` as the getter function which always provides a default value
+    setDefaultUserLocaleInternal :: !(Maybe Locale),
     -- | Max. # of members in a team.
     --   NOTE: This must be in sync with galley
     setMaxTeamSize :: !Word32,
@@ -474,7 +479,7 @@ data Settings = Settings
     --   setFederationAllowedDomains:
     --     - wire.com
     --     - example.com
-    setFederationDomain :: !(Domain),
+    setFederationDomain :: !Domain,
     -- | The amount of time in milliseconds to wait after reading from an SQS queue
     -- returns no message, before asking for messages from SQS again.
     -- defaults to 'defSqsThrottleMillis'.
@@ -499,6 +504,18 @@ data Settings = Settings
   }
   deriving (Show, Generic)
 
+defaultTemplateLocale :: Locale
+defaultTemplateLocale = Locale (Language EN) Nothing
+
+defaultUserLocale :: Locale
+defaultUserLocale = defaultTemplateLocale
+
+setDefaultUserLocale :: Settings -> Locale
+setDefaultUserLocale = fromMaybe defaultUserLocale . setDefaultUserLocaleInternal
+
+setDefaultTemplateLocale :: Settings -> Locale
+setDefaultTemplateLocale = fromMaybe defaultTemplateLocale . setDefaultTemplateLocaleInternal
+
 -- | The analog to `GT.FeatureFlags`.  This type tracks only the things that we need to
 -- express our current cloud business logic.
 --
@@ -664,7 +681,16 @@ instance FromJSON Timeout where
               maybe defaultV fromIntegral bounded
   parseJSON v = typeMismatch "activationTimeout" v
 
-instance FromJSON Settings
+instance FromJSON Settings where
+  parseJSON = genericParseJSON customOptions
+    where
+      customOptions =
+        defaultOptions
+          { fieldLabelModifier = \case
+              "setDefaultUserLocaleInternal" -> "setDefaultUserLocale"
+              "setDefaultTemplateLocaleInternal" -> "setDefaultTemplateLocale"
+              other -> other
+          }
 
 instance FromJSON Opts
 
diff --git a/services/brig/src/Brig/Provider/API.hs b/services/brig/src/Brig/Provider/API.hs
index 8cebe4a4f6b..3e705990009 100644
--- a/services/brig/src/Brig/Provider/API.hs
+++ b/services/brig/src/Brig/Provider/API.hs
@@ -846,7 +846,7 @@ addBot zuid zcon cid add = do
   let botReq = Ext.NewBotRequest bid bcl busr bcnv btk bloc
   rs <- RPC.createBot scon botReq !>> StdError . serviceError
   -- Insert the bot user and client
-  locale <- setDefaultLocale <$> view settings
+  locale <- Opt.setDefaultUserLocale <$> view settings
   let name = fromMaybe (serviceProfileName svp) (Ext.rsNewBotName rs)
   let assets = fromMaybe (serviceProfileAssets svp) (Ext.rsNewBotAssets rs)
   let colour = fromMaybe defaultAccentId (Ext.rsNewBotColour rs)
@@ -858,7 +858,7 @@ addBot zuid zcon cid add = do
           { newClientPrekeys = Ext.rsNewBotPrekeys rs
           }
   lift $ User.insertAccount (UserAccount usr Active) (Just (cid, cnvTeam cnv)) Nothing True
-  maxPermClients <- fromMaybe Opt.defUserMaxPermClients <$> Opt.setUserMaxPermClients <$> view settings
+  maxPermClients <- fromMaybe Opt.defUserMaxPermClients . Opt.setUserMaxPermClients <$> view settings
   (clt, _, _) <- do
     _ <- do
       -- if we want to protect bots against lh, 'addClient' cannot just send lh capability
diff --git a/services/brig/src/Brig/Provider/Template.hs b/services/brig/src/Brig/Provider/Template.hs
index 579a0149e6d..b2c7828b7df 100644
--- a/services/brig/src/Brig/Provider/Template.hs
+++ b/services/brig/src/Brig/Provider/Template.hs
@@ -137,7 +137,7 @@ loadProviderTemplates o = readLocalesDir defLocale (templateDir gOptions) "provi
     maybeUrl = fromByteString $ encodeUtf8 $ homeUrl pOptions
     gOptions = general $ emailSMS o
     pOptions = provider $ emailSMS o
-    defLocale = setDefaultLocale (optSettings o)
+    defLocale = setDefaultTemplateLocale (optSettings o)
     readTemplate = readTemplateWithDefault (templateDir gOptions) defLocale "provider"
     readText = readTextWithDefault (templateDir gOptions) defLocale "provider"
     -- URL templates
diff --git a/services/brig/src/Brig/Team/Template.hs b/services/brig/src/Brig/Team/Template.hs
index 35946a1404b..1599d810a03 100644
--- a/services/brig/src/Brig/Team/Template.hs
+++ b/services/brig/src/Brig/Team/Template.hs
@@ -95,6 +95,6 @@ loadTeamTemplates o = readLocalesDir defLocale (templateDir gOptions) "team" $ \
     gOptions = general (emailSMS o)
     tOptions = team (emailSMS o)
     tUrl = template $ tInvitationUrl tOptions
-    defLocale = setDefaultLocale (optSettings o)
+    defLocale = setDefaultTemplateLocale (optSettings o)
     readTemplate = readTemplateWithDefault (templateDir gOptions) defLocale "team"
     readText = readTextWithDefault (templateDir gOptions) defLocale "team"
diff --git a/services/brig/src/Brig/User/Template.hs b/services/brig/src/Brig/User/Template.hs
index 60d1b5cab1c..9d44a2ad782 100644
--- a/services/brig/src/Brig/User/Template.hs
+++ b/services/brig/src/Brig/User/Template.hs
@@ -228,7 +228,7 @@ loadUserTemplates o = readLocalesDir defLocale templateDir "user" $ \fp ->
     teamActivationUrl = template $ Opt.tActivationUrl tOptions
     passwordResetUrl = template $ Opt.passwordResetUrl uOptions
     deletionUserUrl = template $ Opt.deletionUrl uOptions
-    defLocale = Opt.setDefaultLocale (Opt.optSettings o)
+    defLocale = Opt.setDefaultTemplateLocale (Opt.optSettings o)
     templateDir = Opt.templateDir gOptions
     readTemplate = readTemplateWithDefault templateDir defLocale "user"
     readText = readTextWithDefault templateDir defLocale "user"

From 067dd56fe7ff8d51ae4c7e61ab761af37bae0849 Mon Sep 17 00:00:00 2001
From: fisx <mf@zerobuzz.net>
Date: Tue, 11 Jan 2022 14:40:16 +0100
Subject: [PATCH 61/74] Stern/backoffice docs. (#2032)

---
 changelog.d/4-docs/stern-docs |   1 +
 charts/backoffice/README.md   |   2 +-
 tools/stern/README.md         |   5 +++++
 tools/stern/screenshots/1.png | Bin 0 -> 163054 bytes
 tools/stern/screenshots/2.png | Bin 0 -> 137064 bytes
 5 files changed, 7 insertions(+), 1 deletion(-)
 create mode 100644 changelog.d/4-docs/stern-docs
 create mode 100644 tools/stern/screenshots/1.png
 create mode 100644 tools/stern/screenshots/2.png

diff --git a/changelog.d/4-docs/stern-docs b/changelog.d/4-docs/stern-docs
new file mode 100644
index 00000000000..6b94b16d142
--- /dev/null
+++ b/changelog.d/4-docs/stern-docs
@@ -0,0 +1 @@
+Improve documentation for stern tool and helm chart
\ No newline at end of file
diff --git a/charts/backoffice/README.md b/charts/backoffice/README.md
index b91a361128a..58b69d05586 100644
--- a/charts/backoffice/README.md
+++ b/charts/backoffice/README.md
@@ -1,7 +1,7 @@
 Backoffice frontend
 ===================
 
-This chart provides a basic frontend app that is composed of nginx serving swagger and will soon be found here [here](https://github.com/wireapp/wire-server/blob/develop/tools/backoffice-frontend/README.md). It serves as a tool to perform operations on users and teams such as visualising their user profiles, suspending or even deleting accounts. It is used internally at Wire to provide customer support the means to respond to certain queries from our customers and can be used by anyone that decides to deploy it on their cluster(s).
+This chart provides a [basic frontend app called *backoffice* or *stern*](https://github.com/wireapp/wire-server/blob/develop/tools/stern/README.md) that is built using a simple UI for browsing swagger. It serves as a tool to perform operations on users and teams such as visualising their user profiles, suspending or even deleting accounts. It is used internally at Wire to provide customer support the means to respond to certain queries from our customers and can be used by anyone that decides to deploy it on their cluster(s).
 
 It is intended to be accessed, at the moment, only by means of port forwarding and therefore only available to cluster admins (or more generally, clusters users able to port forward).
 
diff --git a/tools/stern/README.md b/tools/stern/README.md
index 4a8f68e716a..ed472388bfb 100644
--- a/tools/stern/README.md
+++ b/tools/stern/README.md
@@ -24,3 +24,8 @@ using the `--run-backoffice` option, e.g. `deploy/sevices-demo/demo.sh --run-bac
 
 When you now open `localhost:8080/swagger-ui` in a browser, you can switch to the
 "Back Office" tab.
+
+## Screenshots
+
+![screen shot 1](screenshots/1.png)
+![screen shot 2](screenshots/2.png)
diff --git a/tools/stern/screenshots/1.png b/tools/stern/screenshots/1.png
new file mode 100644
index 0000000000000000000000000000000000000000..f8ee1038b62f6d9e8835633a326779f23481ccef
GIT binary patch
literal 163054
zcmeEubzGF+^DiJsDWH@ft+asB4T^|#E*%2W-LRCXNGKq&bT<o2cMAg2y>tlD-LSxN
zAN=&^`}O{F@BQb#e*Y}b!#;av&di)SGxMJF1Su&<-NqruK|w*eE&cMj3JMD58x$0D
zek?TLKV~KBM8KaLPS2#(u&}VEzAMh7pwOU5KYyy`uD>~h=}rV9ZFg8}U_2b~+-Y$8
zT!{4&bmzHpiQ&`Wmv@Sdzu>%8^Bc%N3_T<P@30*zoX*-i+;ihgkZ(jU?G#g_O72Y(
za@)S_UGGa4@nnF1%fS<A!$-rSd4uv_Kkl#*2&H4b7Dgu!M?w9sA8#=h$Uoqnlr8xE
z_Yr`h#dFaTcx`Yh`r&u;MgwlGDy6Odf*ckN0Tn9Rz;|V1>i<d%;KEM{gDQF+tAd*H
zmn;z!<Dz3=*i6@-od!i(_C!6A2r_Cj>Od+EaghxO8~*ZlEf0!a&X0{d6sLW6GcXau
zhC~1>h9<verBy0)@(u-ZgaK_pSo(i6Z0c9Db6Y%LOG4Du-Qv<;iW`s<da49{`i=jp
zifci-qhpB&NQHR+lGZa~8Wc*FJHM7q%L8!~L1D|ycfZmW0TcywRVnEIOhW*dGS4x8
zslr_>f;V_!<mbP#I;{6B0GDcXg1>%1>J5ss`^Y%ve>X}3aT+zij?(T9qW<y$VL;fe
z8SSFKwEZ+3fJ;aq-d_*sbIdO;60*Keao<}=5_IW`Bvwcf^`39`OFqo}hgR<a#Dxj}
z(vs2p=0@-H?TeF@IJ4xzE=+u?L{V?BA{LgoXZrKM+t((V!}q_fG@40VB3AWB4hvr$
z7Da0jm&a3fjEc$A1zKfQb3Q_o94Q!df32k5Ou#zCm_0&2{;AvDQ*<Qq-0u7fyio6a
zyKZOsTe$Jpz&ppsxTNfd+cTc+pUCzWJDPm2kWT#~Ibwtia=D@tr6xkY$cv+mu_JL`
z1OkCP=obU;_VUfi#dELiFLj@6&&YnJc{*08X8>NK2c5fnSuMW&OGa4F4S~rkpZ<8v
z^QZp(UJ@upX@xJ1ml(6!C(=pcY+z{=>BDquN|Cw^U>AT3U{IZm7a=g6s=h=4)sO%@
z%Jq@F;nTgvqh`@OKy;yGT-i_G-L$-gg_R4+hxaD%)wyhtU=y0X{F4YOdcEQs@_|{m
zzSt*!E+Fx0jHt2cLcO{NQlYu%QhN(+TZ>+oM`M5wq~JFHoZfHQ5BS3{DiPD(_zL^)
z&-em#s%(>jMDrDq7iWOeLd>|$)vWb1{EdoH6bjkElXd4Z%|HH0lZ|_eg5UmlbHZk-
za%;M#?4AGQs7i$;D8IpZZ3rxE)|VL1WAy<&XW@QVj(YlG$bCLFj|Yz*E13wsefu`b
zkaCE<{J~#(Bya-s*pcYeD|6>}Q}ByrF9u9b)Ehy>r1a`^_j@0SS${GJy~cbn9nR1e
z4$6?oN=Xt*h~Ap2%C`(?8J3M<mycmjA_r+BK5{eyE+OLH)?X@mA`dJcIibY@(mxhQ
zU>aJELXzc7txNjzAO^+c#D~&%%`j#(cANcfuv}7b=nJpF*mc@N?&o}6@wr6At(J9*
za{tZr2qG~~jb6!#o)=L5IV3Y0pj4|-=;+#TjxX|T#p`T;A_iu?O2%cHyR?>*qQ1PJ
zEuXNdW8iyvbat?kK!TAy`bAj1>mZ1baeKNZLkz-av*oxsUJ`56CHRLVfYEow-=LIZ
zzI1;2=Z3WF=oco2)TA{Y^|l>MZ=1P7GA-2mUirXw0IPkZTWt?8LYxCn3D&|V<9rPm
zR+bEeGrvFlLBM{}wfc|NM;YYfnNVOlcu;s*7dThan+SS*a&qFxk{$NvT6!b?9B>Gs
zFXh{x{Yg3SEgC8+>N`w)_}3_8!6VZEYMyujM)`PWU=h{sy{d6s!XbI2S?|6FP+>P{
z6n0r3$(8^ly*`?+ku4WjYSP_!JZXg^r;)2<xbQV70G}E#f2Ym}deF3l2Yfw|Rip5U
zar^V9IN9(2;-lG^B#>u6PeSl@z_}Lnfu8`ypXUD8LqD(H@Zo4eHnRI-*B)PGhmgld
z!|2~~34D8V+<wrV_&1UM&Eue;auCp<Y+*14G5<}!e;FrmHOnN9GI_tB-08)ia`?vp
z==IkcB29dl9r!PP{<w9|KtVOP6SnFh`@>rPIRL>f8Y<d=zI{Y2-7ls#9|CyqhP{F(
zW`8WgfAP|c3oIhfFVaTAf7$&%t^nB(0D>rM{~tm8k0Ab7E&pQ?*X!;7%F-YhyU*DB
z+uBMGZEo?$J=vKnI#bJ2p*Lvs3g<2v&QY`*FaADV<5XokBNN4>4EX%+XtsRgt%)+T
z^W&`;cD-7+9sSbRoifpn;^<|gwaQHOs_khNlZ7Fy8ljnIk01SqZ*ZprJQE>3;yP@^
z$8g=A_E>Dc?XMLH>}GAsfFriwoquW-;jq{)pU7Vl78cf0iZl2kywmD~=gGE+({c|G
zR`9g`=!`r+J0oV-<u`13e@te%u{lw;GhJg$US!ZjCFHux=N?KWQv15|ZhlV7K(IXP
zq1W-I7SHx<LjsC3k-(tbjeq(yn)d5mqa-KU|G^vaSPUQ(sdQZGIzQQAeMx?FV*sza
z4j{gSDTawh!32V;1>L1@sYhbXJUuu&-)Rb?5HJb>pC8-M^KY1Sgi^X}z<WQ_zN=UR
zA}Iz$L38=tl!_t+ze*}W=WmD7K)mwhEymG=I1o@laFTee;LXkACel)?QDnD%GUeCt
zFqL$JLcmct`(4{e>zhqIv*d#%y_Js>*S;PPaH$?L*Ro5-*_^6U95hq(l#25Kwldii
z(T0{foG}(5&4bB$52wL&$;Gch2k0x+Mr}B(h(u;p1_J|wQMl5x@`xm!QICUVk@L+m
z=|~11t`UX<agl@NUMu-2ON|U-TXlwtg)v2Y3kvdoiV1Mvk5GZ2nG6V;{iM)3!l>tJ
zT{eKYfOtYJ)Ct(L0rkX*c)GSF@!3vSn{<;51AA#6IMsUkcxx(wWNF1xD$A6qO>>lX
zC{tQBRoqXv#!*WG2<)`aYTAN{SyeIvjf!N}KqZ0EY&y_)6Kc6iw4h^6!1nS~b4GF{
zSfvF33hatuczkAk6!f@Ow!jwcHql|JHlRN71)&;1#bc?ar1Y6H5Y+aJIC3=C%Mc?Q
zgehUdD(7J$uOFbUP~xo#>Ks7h;ll_deE9M+r-@9bc?dhc_vx;o<mU=zpNmuZcy4J3
z3q*o1i!tA|%%WT)6tMAfYm?l2hd?BxCN5D1s@4T1%bO7=z{3>e%S?OWMFw^z;vBxa
z4|d6UEOqPMflMH1y~x&Pvb+Ru%Lh9x`DqMm)}8+l<uoqA8`qsyb##Kjr)V<YK;t7_
z4!jtwM4#YpuZUySg}EQ%wz22PCzwWj9F?Ng!>~Nc2sHD@A>Q<~NQ`7uT=xN6s@cOE
zrPoG-(R7#_CcS~h2`mnchm&X3rd}0Rq>xM{2eTE?KDKPz(#fOdNlC-KwvVK&eO8G4
zo<JWpof`cHaCVRXB(ajZq(y$1>!4zRW{K|2RAOEIa`W(Gl>i_h7L-b<kPZhs@%z_o
zov^9N87w{R*~Z~!MS;0jq4oAz-B|<{OX8G-r9%^XfB&nOi^HMUetP#g`e8V<smT|n
zU7_1JEga4q_pVUCL7T%8;K28-)BM1ogm_F~Ez`o3-r%BjDGm@J{CyF=$#`S?*gU<z
zi%8wH1Z_a37=$QB%Uc`DvYIT<L(8xnv6Yzw>5d1lTqi!jBFmhQpqFJat+k%uT>8#p
zr{Q)n?0r@6ATD7s@5Ou0Kp5h#Y5uXwOKt3WOTIeR`TGO}N+m{;9YLZ;QM0C21PvSN
zBxS9ah(sY)JSrfNZqo$Kx1fiEid&#fX{~t_0hLg2Y5GvDLkb=X<`QKBO1Z0YSLKAV
zm2wuYi~3DBAP=DorDwtzApWX>X``|`gJURk$c<+?@|2QSi%sS&TppuByp#16?8543
zWQ!1z#O5Kdvn6v+%wggE<Y=xut@8U?KzylO9Be=1pD-!$B3!V|kW?`uRb$R!a3fs5
z;K9xSc%}w?1l8|8Bu{$~&8pES7`^SAPioWvhDvfwK%KH;&c7uDC4{@Al>#}=ixBdO
z^Hmq!7<%?1>Jj-*@nz4B*#k!Np`vr68%34t+L9^U8+X5%^aomw+;K@uFAB5}*Bf8O
z)sL^~R-AjV9%x7@^$m=t>A8lJ38WK-ln)~iV#tG~-3yP>e%}}<{A?(zR3REEm1gA3
z?m6@`jNIkN0J2*Jn^1ogG-Yk^JykBThJH0^qlU%OE*w_w0$n{;^ZXM@b$^^TOL-n_
zNy&V581$pw?R0Ma8AC;U=R4N;;`x#fHoQM}E9LEH%8lYlHoH76>I*iidpLaLya9(*
zfZpji*vE*B=038xjD=}u7**h5Yq5A4Zsms`wU7FkFIllNYO@6!@mY@#JhZK=4@eVa
ziktkpdK5i6a%nHXDmf)zchEoqihIt=xo5kimGd(E*@$|xwrzAhRsOv|GDeU6A9y?x
zn;kAq?~AWjZu-xaOH+!WhAYeQ1Th<?Z+X<*YIpVCP91D9aFVXuI4*E27ay9Ty<Z_?
zQS)UmrsP>|nt#yr+ORXB&R9%<+AI`EtF(<z?}<#v8q}8R_qwEIO<@Tc+;`_x$UGiw
z3oG2~p?%h{9Xt{@j_FIc(*6C65F_P^Ziq{UnGzu^feQ9^PZis$s`RmD47@=L_<pQ$
zK+XqV*8w>d4pX?yPQ@Xx@d!D~8&umH(x0*9u2a3#dM0yInYvBx>U0r*cmiyd^Mg5H
z212*Ri72p@N#jg{{V?}$kr1p!t3Y5|SiRhekF^Y1ZHN@P3A5&GxExk<;ok^^-++uf
z&S0k7QR4mjovEvs_k?)l*)y4X91A1%DOeb~uI*9%;N{&G@J$ghc9EaS3Z0U;Rs&d%
z7rQ37WKs%#wL)w<gd1n{1)(-t|7qP{j%*mw6{?>~>@$R$vY>>hjHENKuo{DJgU?jo
zfbQ6M2fXkF9IhJm<Bd^+u%phb<5K;YnSy6U-oZ|BpY*&9qzoPo1r*>JpbUNGwH{AR
z*T;cbdac-9Rg;NPB&cPrcR^T#e^_F_5GRr`gA)hd;vv+#1r$Z3^Yhj6B6u1FH}pvn
zt1}ND<m-I{)51;OF%)1<S{4!#jSP>5_xVHo*x4yxQfnj#X|AdoZWSsn94VI<7N8gA
zqsfauV49e)U&{bn<aR~ZI4VJ~JDHBz#Mk0Jmn(eUuj>uCP2QErpz17X=%5FS!-vAS
z3ZF(1()flH=vX~}HLXjk5Z`pEYu=#k0+gj50=3J+SgMT{ISj*|Y3|#omT}8aMZEZg
zzK_uiuOm5&xU%fJ*W@fB;aObi6|v5kB03L?Dy#?s)NXQxV2K$B3JI3?6(H{`i@sL~
zXhctSVtjpIBXF6M(`_8E5_Wl3v{JKNkcsO3JagrPf}j0#BF7O?#uMd;(uA-6#Ym0R
z#rP}i)q*u<Ml-@UuKM8tR}xqo=&L^y>G?-MfHv`-1lX6-(7;@&ICsGunZO5Og=sIj
zUJi?2%jJDZLT}#J>I3k*+;R1;N(Y5K^d%5fB4s}fC!&UpVV;Irl+}>L+1r*a;F!Xx
z`z)k7lu?#jjj^Q_&7T*R;o54c1H$T-m9vG_(oLn$Rv4-#3)3js%I%+z>$TJxJk#t?
z?Uoq$=}`zK&=3lr(4>Rm0y(KHK4x^@U_VugUN0=mZI%M47EXSiasrXvs8z}{1#p9U
z#=-}d!_3ntx`g0P7XJLZAX8%CiNP~*TX-%_wUHB!6YEG;Dzqg7Cnp{W#f05UH_bI(
zE1`odi#FT7`1n~K2W%NK3Iz?j_~XIGO!VHbsz?oU(Yl{2mwPqPXgl#H5WP@S(~#x5
z<JvF~!>sxOchKgu%VjFaTo3$Rzs51Ew9O=cw}dKRyCjXUF1@o>r!+L5<aYXfF($!0
zE4Cy`3`?FUw2EM2ZF>F!W{Yu9zIq&gX?n?|WI$O&ugh9`)N5~cc15Rl;!8Dd)f}A+
z3pTjf*&Vty;XsD$eqMCCCzKlB-Q^X>wAb^@GI}a{D)4>e*2@d`h=w5Vma|#q+TwdL
z(%9pO9*(*#I`7p0#j@ME-O3_jZMhqY#6HTHu$i-9CeFSX^~|fT*XHcs%juGADYg4i
z*)oBE8;3C9@M5sVg}t0fq+&!$a;W@uK6l8$nTl^n-peZFM|cgFb6?+;@5jp~qZMM0
zQ?d6~zT}^--4TsAO8m;tegCES&TVH{K~;8F^`KDt##m8*idd6;0<Z0UDlGGro|)U~
z0Iixl-;U{wHIB=;lF(|%=eK>eU3^RYhgAAw(_JD@2F)n7?V=A&b-v6gXS|q@Dudh3
z&<ysLWTsUWW#d%Z8sAe<Y%t*ITn6J8obVpoX6v!-I};Y*TfC0h+KwTBbFJ<Z{8sjQ
zUiro-D!6M+;YN0Dex8R39<;fn^X{nkyCa;!7Y&Kb)LO)e^50Y(42enA6J?($Ng5L?
zgM2Z}j?(S)F^_ESNnZBQfN51DincSXU@zwgRjm6Es)Lp*rT5oUzsNJQ`9C0T;k`Uk
z$)`{Z$&S%(b0SW1_MrCvHlV7c_!0D2Sv~DTeXmpt-V%r0y|GMQs}JPQN$-MFWwAhw
zL(d*&L)HycO*N?9S>Hp)bHhirkIU8bOXCXph@h@buW#qS$_;vDsg5AfBYh0#dG~=c
z<s)me&Gucx2$YfBquMj9>C2}QlTh6IOP>;8f<ayMq<Kc$2(?yS%88xaf|WPY%t{$X
zU0}gAnbxlCv1x8;k-3786m6wP4uL)+9V7a~PA~S%iJuK(e7aTP>OW7pOhUFIYZYEB
z{RRHL;FjB^nTg8z%nv&AzOFHNTjp}XN)VE8!0fR)%H)}sg;x@1r|{_ugV?4a(xJH0
zstsQ>1iltwSzqWuu<#l6TgHy`pQZM{fhAubp*ENeOsPR0Cv%zv&puhVc{eK+$8n(@
z)OlQQ+Ti<GSwpX4gYqq-!B_}^lF7|D@&Vhoi+z}!Rm3WF9x0}yvGDtn2gwuAO6x7F
zh7S0Bmj+11>@MyXTBE{~D+FEHY#OtD(YMmsp{cpB3C0XJP8mYgkJei=hc^{H<g#-R
z{QY8HY}+xrnSHNL;Vt?=oF)E=Scyob69UCfy;oQxT_oL297wD;`Y}p6OU+%ONHzEs
zIlJT@k-F*|IsEdN&d(rff7RaJo5b_OAN@T-hGk>*$v5dq4;KojxHR{Vb%wM;$a|4B
zc|7!bvgQmx>dYs?BhnxvnjD#HpHNNYF(zB@)8hPP-toh6bD=^&ke{Vrt$VDX3$)^6
zh4==#MI=dKU}j+ykv71^lCuX5kELc^4%L*{jpDnBJfQ-Mf@9hljcZv>(C)B6wudlQ
z5r6ewHCR6kl2*{oXu`(SHsvGvnsQS3^9NVuo3+X12(0JtRxLXaeTlB+Ek)WNdGp@A
z8Z}Si5Q#~=F+f{0G1UrgJWQ-gA@z<<4MXjT;x0Hix!CL&IxFqhT9MU&s_T~>oDDVB
z&Z;|BC8r0gCn!D=){0{E=3eQHWZbaG&IjwoYgb`A=!ZXBPebB=iF`2h6Y2RIs$&%V
zrc}*2t1#HFc3>>4X_h7qq62wS4zkl4%{`}ClMhX=lJOga)S?wJ%*oh!s?{r!mg4Aa
zBz;hEN%q{X`8Gd%KNhGoub1kR9s-$!V~QY*&szJV;D%m`smZc2&I9e8@WW)?9UCIU
zu`xYLh61-4!Qjwb$zA}Tz#TJ3Y{T}O4(W|N&HUF~D2q7wS#5N;5DeL0oJj@}yy)9v
z6ZqDJ>Sa`h@8e7E!cGLh`OEe>&sUxb+X30knh26>_3X!5(6wKCg}v$`Gq*e#wxAC6
zOy$%vRm~lgt4q^&IJ7JzbrTr~MQCt@T0Vi~ji~zD%8M3N#60s;f20#~{KG0gtTpL!
zbF}<$A@^REH}|<0-A>7JUU6RILFTt2eap5bhS3q-yQ_$fWL6urZ20I~?-01Lh|=gC
zr@3ckBpWTAKKjmC56wVQgOdLG+r(8aP4<|I0e$R6UQrK<V(VV0$JgV%F2$UtZfk`J
zCSGE{Iv%=3tP2k!i5Ky)%wpD*Rbo<?Ooyx$d}O)}R2v>`RI`&VJZ3$2>YOB+Sdn!w
zTtbh9@@Ovu6%>*3Qn$!AarNCMEO+!*UTVCnB^oiiDTBo7pw-<@H%mo+9QGYSQ2V<q
zJkwUry^^r^z#{({^tD_=fdxi~QYe1rtf}2rCNE-@N-JJ24QdJ~u^gC{+8q{oq|)Tg
z>N2kuY`$uM4Pn*#4;rHkxdq6p1kIAMbhln=$b&{&pjL*<*|J`dx6*y(?I$vW&GTpD
z*PrR`nOG5n`%^97fH`t{NMVCGh8ven-H>(px>@8}L)OBGZ1f|G@#3^@J_WFB#=CeO
ze63_tamf^r=#WgbgGbb3o)5L}JA7}pa{CJY#BlhrR{N~MOD?VHyNSq^qMggwn3oN@
z>!6<Z>cr-}RfAlpG7UuQAVm>k>XA2y=jvg-m)p~ycIu_2%A3IJfeg=c->n}hXyDp*
zk@AO;_^}1!ZM@TL2xUbvL&M&2>Hnh_AeG&?4soh$D5Qs_#Ya0rK~xF%_dAlLGpW%g
zB#g4)tLaq#ESMR$;baTxe$27WP-p{Qr~9(x#a*Bfd1-(A&Hbg6a=CI=7P0HdGrGqp
zTl@B1Tmx;fmg=iz1hhJFgDRZVrm;myYh<~MAJT`isr-`zf~D#x1}urPrKx$TUB)M1
zqT$|++-8>=rtG9!E3#KwHNrsX7++R+DYsCWOa*S)D1o4FId+1(;)cdKKQ*J2C#%JW
z`5Y1roe&d!QkQ+n>UbrF9y6T%TM|TpR?=F6Uw2)88dMQKT60c<o#5BL9F;7iV)f2e
zhiSu&AdLBLJYcEJs&KGa_ISDU*5K5QnOI4GhKi5u6%}<i2dAiJ1Q{Yy4;57GT%2_q
z;vA^GD;32x&Sa$F!3A}*R_Gv0^^9zoz{X`IiP5azl$%;Xjm2<wa8ts`!K5tVzzMyC
zcG7gu)MFDp0rW$dUQZei*%M1_uvms3(Yd;ufxyhN=@M-Sb*Sr!tow!8V+z?<q}SC2
z23#f|GZk~<5mhB=VvCuv`l0UNx3Eb`>IoK-?A>Vn7<qKnA|4qnknjkOIIF4(EpOyk
zD8AAW`Rk=!ux()sS4c)6?52iF4l%cyyR4t~Or*Tj$Pb7<?95%%I#+}~qv&-UbwD_=
zgZhBH!Q-K?heb872Abm2z}i{FJ+u$AIUnFayJRkp$}EN%*rbZO;h3G1lAR-ydRycZ
zBk$BZA5}2vs5^bGWU;EbrL<lR9Z9=$*y(ra<e;a$su`>|xq}TvjGAOJD(@1=rv=k&
zxw!+A?~xmLt}%|hsZK~s<ipll>AQ$EFL1<ro>p(CC&avNLrgH-7+=;`@xID#u8@<m
zwtjHZBz?^y4ndOC?fmNesf$RSS!(;pqziM_l91xslSB@fMg(FkxsYn;K&szKz}#h0
zvj6tz{Sp};Aw_+*WluZpR5|Bu;ih;O0qvI|;N$h@s|>;GsS?$?;pbPh@3}dDLof}A
zX>R=G5A3e|)yl@T%Z9iQ7v)l`P=lug18iZ*Tay(|v)$$Vb}G-SomTp2k2LBQ+Cs>A
z9EYDKB-+{Uls0jiC;K2Q&KVkfi*3n`D_C*ceS{c1eJg~lhv<EPgjbKMFHPBwLnQC0
zK<D1Xj?wGe3yvXOnr?Y3rr6|<N4Qoy9an$$P!LF?1^clSn>6ZY;0GO*q$iB&a$z>;
zTXA^T84OCap~AWp5Ch67^sH~p8xx8&Zu^Tu;_}DTC9#i2DMrU|I#{^lBMgb7)NU!D
zKKCqFOF3tW%@<-~xv%!c+_UC`J;gUeQh6VstedTzpKH+6IQsO7sAME@B#2veP@L90
zvSlNf*pgIaz-;As@Q{*$mZ`evv~<$NU#Z5?#FMJTb<mupJPTD8!eYXi>LRGNDuFqq
zk2W?5dsE?Up9ExmV^GBV<GWEHDIFyo>HL;=eKD62;;q1P1H~eUo{kYuN)|2JRy%JK
z?Sh;&J5dq#bZEmCE=sfs`$k~v&pc0(q$Hp@(ZX3~;^lN%uQsq5%no#ioaCsdHYBh*
zS5>$&cRp+75Ay^ibJgm!1I7LdSD0kK*Gh%d`q@y`gtLA*dlDAx87n8D{lUc(CpbGo
zQ4XtX%09Vlln%!mFO8;7A<;vodW~XRKE6I#Lom2c4e%QWV(;y#V<>;_4~ZB?AztgB
zwS}hf8<U=h{R87eK~q#0|DvlXn(CbxsYaxjf~skd4o(aR%`}$eFBN^YdvY>XRacNs
zAI|Nh_+iP*<M(C^zbjR7>XL*zKao?l;TN~%yMflFqc?Xct{8dh{sz_mOi=#(s3rlB
z(@B4z>iRD@^Y>d|*f%JLSJ>aS|Hb8Bw}lwh*lAXz+W!D&{TS&8MsdV((*U?%@jcx>
z9{KlgwMlv(N!aM@S`5kK4u~1pf7^VXR|35W;cPvpe~tK$EAd;`{Xr6n!ri~ZZs~M@
z-hkJ*T%!L0u3UR&pg&6jC=YcE5cZe;gT=op(0<<lDNs(deEJ)5e*MEgrSw$^sPjKL
z{90!H3poMxFf4JY%Eybp67&-_fX7=Rdynq_MfM+8fz|+t|GgLj?@NsJ{+vTXbMUav
z-aj?g@=%FcFZ}UQ4%hXRxvr<&bI=F9Bi^h$zk0;=t};{ry!C1EL+)OcK}0z<iG`|&
z_g?N3O4GkJ!HLU}j=P<?%Q3#X1ZMxn3@vJYw<icl4hUv2(j5=Aj)Om0eHgraSS<P<
zatO2qpqPv)G7}NtX;D9>gmY^)#`XTkUi+Is_49AC{JC3d0@C0Xt$B3&A2RrBLhcd3
zXepVZ9lz3fdI`|-W$xvuMgH%xe<!v35RibFw0CI8e^CGJiRZ?Ezz0u%lyYBhhvYZ~
z`i)TWW#Ov=trbTb%oFOK&*NqzMGy3BLli=um}L#F6_fxqpuboYr@48JlKC+v(E}*i
zC&KYMD*&7uW>gHJW5vh8VTsO|$FyrS>ow~;)Z&rR@W{ICPV3vX-R)2EbldTtJQz;)
zW+h=0@)^;L5s^Y(cxGo>D5eN*IkJZQOIUzBX#r_Gcpv`s8fao-d+gDYnb{cuw@~5;
z?s063SPH)2wLAM1*T0w1QCq$d#Uc-_<fz1V`2fk+nDE{guaQ}j*qSKTS`_v;sGm9N
zwMnQFbW7$mbZmn{hO!h_>Vy8ASTig7tgg`JFk42w5tN;==EunL-C>D-vEm(}*XPw5
z>b`4^+`q-R=>>oSm^>|G?_HalA(|?qLgC!$+WVlpFUA9}=ERYNjAnfc8ns?pTs_CI
zDFBT;u<bu#1?6vcHkTN+?Pu!jsnCOOU;IE`p5MQkm>;+r56{>bE3lf~*HUax`=d4O
ztG(aHsv@7_?<+E8b&$ltnzi)gNPLcu-)Ri>d~zTX$Z@{0%~5ORB38G;01I?QS1mX8
z)X8bS9rPI&vHd|SGs}KY#wOo$$FkZ!{#uzNvFY71<cQs%1qZM8>30rK)7jfNmkF-h
zVJ*M8Kuo|Wgz2y4Y|dWnvn3XQPgOY-BD=ymyLLuez+=Ggt3N8>bAj+2c0Ak-kI{B}
zv>L<bR%`9TGNP1(lfP0fjU1Ix?~35eSl9kUd6qLOnyS&nP(hw7<XI>`tgfZ<`rh#w
z-(<PvL{~cx`45={kVJ*~fc4pe)XuQ&T&;-bdXH&8Pu0RVH`_Tl`ySy}K4XP@A_}UL
z6<p1NU#09CQil0Ho;mHk^`C_9!C-<$d%FIkX?h3nmA>SP$s?M<cd_SNI#rt?;DW;y
z_q|0P^T~nod{gJ8g{88rJ~cYGI}p@6F_SZj5|p~zCfPahjFdX%Jl#77J{<mIFziGz
zH{_8*(XxDsgpPsj!9pG(V{f(&pPhwXS$3b&Rg2cal5|RgNvj!msQ0q1`g*ZA^7(IF
zEPhx-t5r*3dNFwT>_=TY#Gd87%0d$9BX{`S<?caE+aubBf52t%4Mf;FAG1xg>RsH;
zu}Q9wsULTk!QYN~xb?QyAh&-&MeqI@=y6hhHV1D}-@qUUESgZUUgT-oP`jL;dVVq!
zc8w1L%6W|ae&2WHafsw~FAWU?7I&wL#p^8mof-UE`;GlBt|_tc-Ql(Sq~*IgTrs{)
zy9XXBr_4FVli|b-yqB(vw)WFyYVq~pIu#m|%4Qu6pDCe@A0Y>GF`nIcJWIQ!G3t1s
z!h%=Wk=|b3EE+}YowS0L=5CAaM<?KhqQ2U}6cC-q_NNIwA!pmk^oj17+DH1ut4SJl
zIdYKFr;!1u(|{Xr-P$ch>#{p^m!;<<QnQ(=2gU81ocoG0?LJF2Dy_1noyTxm)@$^t
znP@uV6OMx<h>GE#JG|Oagv{wRxZXAq%#R94=z}xFjT9R20Vs^+;Lxn^;!J3g!6Wt3
z)4>N)EB)~ak35EyFddr4xQ^oMM~;@pW<87#5FshY7e9QIl$z3Ra4$D_o=kGvFsD?B
zffe&6aG0uW;9%ssWQnoZg>ZGp#!hse(((BnF=;uT(kWiM2Fs~heuo9~xm_6di2uMJ
zov6=<$En<lWoKUy50j|$r{_7vA(2wizGY5B5#TS>4I5HH<p?*W&OU_OreBlqoY46N
ztUE69v@!fDZjwwk&;Dy~U6tKzUBm8=_8)t9n<9$#xU{JC6V||v1MnvuMJa4iES_^l
z96#iul^>v=G`XF_8-#pQ#tFm}rg;S{n<A=81O^NOqM2TTx8Yeg<GS0BCsu|sla$3S
zhxLnB(|EO!eEtSa3mkC{J?y}6`8+!|ZJK2dvDrnl<9tcyn~H7iX>sZCd@F4>{a6`Q
z7+=l`%R+3=67mL@qLTHdb*$pR&i>hl-Zk5hVd5w6io~kwF8BSc?jvI#=`U=!*+nOf
zf)>40g!yN_cjygAC(m*=TJCfPM9+TnVpUE=w~4_pxC2Q!vb-4I<K;z4hAp;-W_;S;
zLCe-{aLSNDq~DNnmbtfLsPeXQyTPl+BW7H&jlB9u@v60(@N3W<?}|j+OiWnlw2%hZ
zEemDSO7<&x3O>KrhdK{IeGwM>qE(qY(~DMZ8>Il&alL(h2in~z@wi=|qFi@bA}_Wl
z4`z?$WA_h+itrxom9})4c<o=Qd~Z16yOrW(ZBzR^4>M+c-zJVvU!O-!rAck`iPuT_
z9ww>j%O8<U3KzYk$MV9}np;BgA(l0nVYB_{BE&=<slo2+v+v}SZA{<BZsTWG@Ahp8
z-Spwn9MnAGzKYkod5A23krXfX>6VY#=(4{nPq*5o<NS&`iZ*lW5)0@Qkz<&BFdgS)
ztJ}2K`5EbPu%aqEwp}z4CggFEd4YkuI%Zk#!**&Fi+%TDvD?9q67`&WwsAO1KKJ=l
zzVEnlxVWEGRJDJ)XR~#m!)N#YJ+8*lTppH&N%V=)YRfa|h{ez?1UPVQ*S4Q3nPT!%
zpQY+@`P|MbacHTFLcsY)n1NLNxkK0wW|f{;PVesaUZ-ddrD7eOGShy9Q9d4y$C%Yf
zGX?k47WAf2N<#&BkZ}j`yIIQOeDSomX@w(^0>gi_X}2(b7V=om%Bkeu%g;2o$bCRj
z<Es6A(17*$Tg1by<Byo~JsO@NV%4i<Dtd^R)$+ZIWKs>hzG&_Sqa-uio31(sE-6No
zvS&Xo<!h?)n-aA)xFXwykj-@d4(G(a4m$IGyxpRp=Big+*0s)?WfosMB&XK;<2uxR
zsf+7Pj@QY(*29<b`>d(;mNNKD777IFxQrLL)B1*;-F+_=`&V*D$BP!eTjj{@zfWLh
zR)ZC9#<Cna2?s_bq|oI#wST0PiY)kCIWXyjs(ln+Ce)J+s5|-?yOEq*%;*AU6h<P8
zDDXjGO6JQi9@SMXr<|^g1@ADUz($OjU3!jIE9u$Yv^-380(6hEM^4qoMn&NGe4KFQ
z!)6cVW7szJhVh%yMhv8AjUP(6CsXBhQ;y-?RCKA>>eWv`<RyHU-}4|nBBuA~M95#8
zrArum<z<qwS?#{tMx4TPn4kJJQd6<5D{8#sYPVFjs%Y)}LjwC|!_~-T-O0|H#tr5W
zZG5^TR-bMXHf4uT%P?UU*Md*;hh$tAXH&Tnn0OQY<qO^Ct~(&Sqb1px9=pMaHlkLZ
zEH1fzc01<^*G`B~j0(7k>|zPhtwE9eB-nu?v8p*fOt3(wVtHlfgV}y}BCFyqDOc-Z
znO(m=tkAIRg*s2zi(V=Q%s7WAgkG-scZZDj+}9mhA4%mihEghqw2#(f#SWJH^93Jv
zap2+Lv@)V@pFqu7P4z0&T|ksiTyiUpxkW7;e{>n%J0SU1Bw#&J-lko#UkwYxDP8GF
zJ1)z4_c8c=?a<?z!9RLQTORHjhVup#CR<kTwm!imnXX>Zoa{Etz3*nX0alE|AtO8=
z>D1Id`<5*M&s-xv2PyTH8uc!D<MxO(>TgBjv4L!Yv$a@E6gJOa_?d<33YD?#rmpS8
ze65nKv~)0PV~-Y$NgvO4Y^x`{B2s|p(HcV{R^zLJh|L=vc3d|#ONJR`GOAtkH+iD0
zHov1)BoggKX39p%tPw$<-|32q$OZ*Fe^(QT`0DL!7Jgc?NTL97vYJQTs@p$2Hq~Om
zoNWXzAOvWwv8V0u#p@D>8qQC^Bo+x=S`1my8j1$O^9!^wGn*kYaG(5FxY)TLJ|JBR
z*S^>1Ds_~*4e(s-S*^5`<0k#g&i-lx5~q3YcNnBn)u*r8$*``>4eFE3;nmjbpRT`W
zzgEni;j#ov45iJgg*pY^kX*i*b>FNz9QJ%If{N<-T9u!lALJv%bIYF{M=+rQk6Jhr
z(_3s6!Y83{AhaF!q^ncJ3Gs=?x=$CsDHIy5>*0h?cHEXoRwlc|ESRf!_0i8yy(&&M
zd#=V?3L{m%+fMAF05K?P;cdo|KppD&Fj>$+X7P2;Aroc?pSSjg=JJ;)kKvDyM``i*
zZh*a^B*cxoDf~-orXd9p!>~!Qx#PBDXuWQl{hF9BwabYu(@Eiz*4jB)KRYY(Mhoww
zaXC<$*XWzdd#ohP2d{=(IS0Vjb5Cri=k1s=M5=FxGO|{Le!KB|_7SLwDjARizqhOI
zN5U0aSjcsyM`(R}jUbr6s#jSGgEb0TpfjsA6BV_)>Tq|?c<h~+v8er0ri^A(+*z>C
zMxU=D8>5}@EpJnW{Z;4-5Od*7O&+YHC<#;mCuj5=I$SR4qCS5pmv-mFPO{I@cF5=D
z<>}dcb5CNFwbJ#2+beDfFxzakN23`VBIin3-ut!<#RhC$^6X2IinK?gW^NSqjxy4{
z^i)wkt_K-WHmuUZ($mk!wr_F_Un*8+l12S6L@*KAzTT|k=jgh8gQo*}`Ea{wX|SdI
z!EYAu?Am?2<otQOfEFi8E^<XJKTpOIUPXCCEPHey9m}~32c6?V36gjXSt^|Mk80T8
zj`326Zhh+t<3oba`YH%ILRN3{*-fkEE%X(Mb;-MmzTNgVvwNhKJpzSoytv}suj6P;
z5^!lhX~MTVwNoguRE;Xq9h{x$;Nvg1^eJ#JJX19hv>YuuxFnrJa&Jn_^eQUPQ`9(F
zMqYjGggO*>nGM7Cxa0{LWDbw!IXs)joKAD+1>dmyZqjEa329<PRWR#MyW>%QIHnf1
zgD0MN`fAoa)w9vAvfKi4wD>BosJn%q7SrauCmK~dI56?Ni>9UsuPCm@tbHLZ_M)G?
z$+u5xFXt<Rmpi8Y2D%21yW`uSAS1y{`IFVHtUR&>FZ1CApDfxfNul4<--|1>F5SX}
zJm)02EU?Xm%>Z1i1GKgEI9rBSr|l!;$)$BARBSVT(*3*C9Av{bSSo>|Ij&(F10xOv
z8bJ)r;>bP^)Xd0I_}nAx>LDg_RK?CRBCpk-UA9o1!Fr<WYS~?d8p%kZ%bli8?L@oo
z_#OJfrecGgVaW?ObeiuZ3nEeb!(y7pfRImBhM;5bS@)-m)Pu}cSw(%ZA`UE;r*#F2
z$Wb#_OWQM5Q+aZ}@NNOk5Sdihxi218FNf{Rm{y)nmv1&XPE#$p4M)oVjB==OKBI2Y
z63tx4`%-B4`*x(o8ZBm-ZDtL`E+*emL^|<tWXtTP2#u}P`9V{2<h#-a<Sk_6b~20j
zkZRwPI@WTvd&Ua&t&qCAy_y9nz`>jeS+hhzvc%`sSIP|g-81@HB_=Q#{FC$CB3=_8
z0uF^Jeg}UR;;kn3jB>cr+EC7L(g{+(;RoVqW6lRzG3oLM(o&4+OAPT@>eZOr+=Bzj
zo)n%)J$)^93ybn3dDo9Cq**jR@?{L|=?lSQ`tiup3hD1I^jcLrhtE#%XPGr0p0+=Y
z?6`u6N`PT4hUG17!JlIJwIvH(HYDX==!nF9IM6p8S7oH8=gE&MBX?1{Oqk$Mo%hFG
zVu4g~u^3Jpa`yRts8w0fGynZ0i60iJ(t^z%x5uF#Uq~Xq!n0A1O1!kMhUeea>QD1I
zXNYD&{Nv^MfdNK!%X^Ki9h~&oNE(Ats*%DU<{M+)N1x<^yzwXToKM#+fbutC6ZR;=
z5?yt!buu$ybFBoz>@~lReXehD_n~jjyi={+ck1(%55_W+k`{e3Z3AOSwGIigUcdyH
zQov(v5BiSy<nC-eCQileV2_VzP2b#bxzgl&rS_pt)Y^V71ol&_hIfJ3_4nFeA%-(<
zR6H3Kq(-Sr8cC!zYJLQ_8928i1GTRVCY|Ww6Q#kBgbd8j)(Pf%J~J;S>(zmRS}0_y
zn94&fc%bxJ`>(UQV;a2HN~z5HArCzJHVKgwIoj>&W_-kvTZ^l!TBRmDi*o1P20^VM
z@mD!=Wj7DI$#w55k0$ocXJ@t-Qlc&^juvRvSl77dp1+&+ILOW1Ph2Z2Xg@1knGj-{
z%=ci~v?7Om5+3$_5lPa!mG|{{0$!jYD+0>ZzN$@m@zOKyMsFf#Yy1aW;oQUB1(UZa
zR6HB-M)1;l)L!Ifr1Jv{7hIRDV^ojpSm-)*zr$qDw>qmKgd7SvI@TAhJRQk4IO!=!
zEG%x<$h!@RRRXOpj`d$wx*ezG<KGy-F<=+0*_-Z_4Sqyj4}Jzo?S0)hQ!o7JRdBGQ
z9DlX@@R_&##al5vUv?cAh%8mT&1Rvjl&h}rVRv%e_Pa9qQnl&3)piSMZGx+T4NiDS
z&jAcZxSep*Nehg%mh9F17AqbftsJpf98@@LT1>-}O}Ivxua{R<rC&NAI(P3dq?wKM
zI4<vliwwC8?G74q*?M;1(lE(L%9+Y*5b?6h3K{^OlikfyCh(nDV-rjdSYaxttJaM=
zH(q;(J|n0?h-7cRs^Bpg?N@_GwYoNu>ipc~g-Njvs`P}Z<C6iQi1*w%wOlbkj-GGW
zbOL$KFujaOx!Rb8lsZMVBb~`bX02Th0+Z*+xh~em@5|^OReu-@2M3UFXZSQw;AvDD
zdXLtvPNq36k%KC&$LqcJR9MODe0poYT;61U3DvnnCE#v8P3;S}8WFGCNJvh(MK(|(
zIfZ~&iOrN7E<BV*bKR`>T<JS`;Nw^m{eAAD*k#ysbmL__ci!D#H|rUs%2>>(>O{w=
zB}fr6=^|jwnyFLp+QCH8ce1P~nt;gps{c*~r%B(B#5@=(ao_f2gU(f$*xFE`DkL7{
zW`nQPYjqyAX=qe|`<!-dne8g_F4D52FFpbfD!x0?l+C26Tk(R&#Z@fi^D(Cs{&?eJ
z7M!v|bH>v?`^woQYNIk>awJo-EL`jg31_t{&?*sBL<;-)k&^Zs@Sjfge~iXzTnS4^
zQPNm9HQ@c(3`z5*`RV}yD_m8EEZNI_ZAobC-NqxcN0+94^V<5gGX`NTFp$&P!4~1V
z3Cpm6U54@4+it<RChEi9zD^u-sLJytXG#6;u@Q;}OGNsLoxW}5s<9rmkM=?qp#MC*
z8==sP!Dg5-5kwtY<QU+>&nG5RfGl_&1EjlNr5>-f=Fn>Exsy0%8wJg$?nyR4&Zc<H
zw#dn3_;2lNb@pBIhFKP;2H4&^RSvH-*o@7^t8M*$n2~?e?tYGtF{unh&%5Oby%SAa
zJWxlN`jqNOFXON8?)a_?E+8i{houI=2X!bA@gYkQt<wb~lSFVmUG^?=d1{p0@j#@P
z-DMaxsm0ttQ9TuhNQG7tG&Q~MW0OuXBx}9%@Hg;lJ_rTXTrukB&3n4y<ITRl{D4M-
z++Gb6{U+ygsHMcogz&TTuOY-aZY7~z9~udrHG;V83NCr0{OD}U?%KJeG-tEL3*4I6
zTOw7U5=*<k*PA3z=Ul^SoO5~P6-kmEW>8tsshW8Y*?WTX3HsP!1J4E|IAIOdYwAlu
zE;inKtk%X&GzxmQoj+6O&pi=gA_GNqG|yhz&D7={uAmzDz-uKEZg`&90X3t&h0n*O
zlb{<vPOvkG=&v>-{eq`l!LX0(8i($!E=Lg>bL+0>aG016*%RX~?ipK$!>AIQgbKVh
z0vT+L!7#eEkCQ@bQ2nJCLowziou{)G{y3rW+`Mj$^L(<~Id_KiO@H(^k|D;%gHpW4
zg?uj1p<gZ?t^!QxTnxUH3^Vw^-I@#XxZ1<05;#F!U8DK2=)0entt$d7veH6d{Bc@(
zS4o_Q{sY8&*kmQNW_@kUFw#~+1h$N_f_!@NPLvt>)`yap`R?V!tCrqBdI8KJ$#@|m
zIF~En_NEuU`4SJBa1bu5b96d9mx9zImda@>6BU>`zP#Ub6~ZDrWYc%64)ob`xbwhb
zE6M8Jp8ncvV~B&PQoC`XsS|GzU#H7>7}U3+WG|!cO|ENYx5T&`wsbo=OQvL8_+><9
zlEI48x$;fOW`RLW$8Tp3XwuPtf^hBY_F`7gL%#6?p6JaOb^(7w#b8T7I6PPQ?2Tzg
z`u<^yNEJ}1tMXkw%fmH|hTXf+XF~JEqvTg>RLY}mZ8Seo3BaO&_bPoPedN_B-QDSw
zBM=kkT1J`x#4Xq81`QbZ)`X~nWO_i1uMn7nD;s7zx3mZuA`Y_1H*L74N?#0M;0NyO
zpW^Ty$=~PUX48>H_r;7S9}u?rIYx4^cq7`G+LG~5br5M^N?3DVZdBQRJWp!P<ty~i
z9;Kff%illd(*P64Ph0(Pz3C8Wq4{W)c@0#poGKg7txbxch3%c?ylbM|hp@bgV!B*K
ze!jymD)GDP_<frKMgyAFM*ccW9?rho?m3gPGk&Zx--acuk~1clZ(C}cd(Y39lj!#t
zl!gEgHK42Q`#nFs-{!un4^-1<J-1^8uK9qWdwF>u-uIIoy2O8A&y61d)vsIb+*lFb
zl;it7wfPfWNpC=*=TE<6Hud}ay#B=F02dc|hX&>H^|S!XAH@Im<<DtvT_bYmsy%2w
zcbwmq@msC>S}iDkjKFIJ5S`UdYCvbNC7O@)(2ELYfu3v3D)<Jc$iF!vaK8XR80sbg
zsplwuxlGsjy0Sn^evQQk<vXDQ{~<jTG+NxRw>=1Tt|{GnI3L5mg}*c#yns6k;A=!F
zw8IjAW9275sOXyj0T0pZC_xb<qk)d`A1nYvVUYsK(fdeFnqN%&jd(E%s(CWzFT{p|
z77m;@6I9V8Bl?}_e+cFc3U~jnzC-bQ35cDNx!_jtUxxC}t3O&_|D}%KZpAZ!w<v@X
zso#|R&)NUR2n|ZF)33f0r%?e8$V%a`zWdcNUtsiQf&WVRnn?m?G=~Q!YCnnB%e-n^
zgX!}aF#PrAfos9*r>fM_Df-;)xn?48AJ9m~1+&px;0TW<dZ@k_m-$9)##o<lbcX*K
z4PY`pnwj!Phi$F(j6&CX`$OvD53x4uyoB$*Fu6YK4}gnGZy%5+t3?ARqQ4Uab`6@b
zNrgM~KBm|(y6(mK*L>%(0bJ4N?dkP#v-Hp6QN7-kpVE=HG6vROv;0BePf`Rt*CGiy
zXnyn`<NP+PpE)C-@W~_<lD{3t{`2S8JU_pU3cUPaQTQ?LfAaEk44O%7Kx?i!Q5gTl
z%ztvEECJxTBmDS1XxEn0%;h)QtwH=PaV3RkL)TTT`s&q(uc8?~lxqOE87&SVRt6SV
zoHYNQ3(yFFy84a8)C(A5z7uzIrb5baVl6U9^ej&}_NkJRQV9iynEQc<m8es8KUBFk
zn2~m{?u(e)_Dlomy0+-nM3vEC>7rDK%Y@U9{w6b-_~XO8VfL!uj^g}HIY1D8y#}7$
zBSXK|@eo=hqnu3qBa5V)N9o@lX*|*@{APC$-5+~KAqFmxty9Pw%CtN;I#)8&tN}x2
z81bX>)kH^<Zzu5dMe_Ae>CH`7dgME;FcUIp6lgQ+A)NaX{>aXN*E>9$@2zMRo#E_a
z&0cqmkX5i@e<EUS&`DnEJ<Xcm<San`TSZ@49S~rY2#?(Lp~t|-egN(^W_RJ-@*Mkt
z_17yqnya8lF0(yWy~YAE({uQi8*ogtYULaP1s%Vh*DNve7=pRy-EFw(<9LO<47swl
zU-jMmHh5$O=dn90U|bydqn4c>*^JA26Ms^$y)oU^s&Tu{<GHi8v6_zT??`G7bRu0}
zV_O%0_?F0o$xO`~OQ*SdLg%r|Z&F1`c_KSW7s##d-gUvnRTdYdeQQ5LwMjCkVch(C
zK+|TN2Ora+-DHgz&Tlb31z?y5QP;+uUek=IxS|ksAD7`{PbzZHSurSvdwsv~0Ii(v
zZS2T*54K9_Th5fE8q7|wm5$~qNw}~SBo8y3X|QTB%XWQ&T0L?7k)nS7M*lK?#L|6x
zvxZk*$3!~ZaC~LXd>CrNdVkFPGpmjI?a}n7WlJApv@Y%bjika)u@@3V315T_N4aj@
zDt0|vg`GGdOrQ9&>lZ8O@HAF{q|_vhUChVok7~-yV6GxB4{4Tt&f#pH8C0y70{R#3
zx8r$7jM=nqAVn`U^84kk)+{GV9m=$AXX>*$0Bm&iz^CXhbX0BV>-wf+)^^88Bl}5d
z=;(PvvVZB1-tUVi&$^Fu6p~9rU3O+0(k?NrO0-l>h>98rj)y@TKKq6{PaeF`VA2)z
zjPI%FQrCHG*62NoP|e}cS(kHRg^vt|d}_E6_Q!_i_wsITT*>P_?i!xc@A)}ydV&<$
z8Sd2|4Hn9K%hZENg$mEV0Kt!*(h2SnnKsl4h_SMrMi1MTN67?hW%|v^)GuB73pB>O
zh@Gz*&mG2p`g8&YKPBW2MRv*0^8HtIKL#z9kb=YS4d+iuZT0j$OwTdz`v`h3z9m6A
zFYoV=`iLsxh%EuH<|s`c%bv5Hz8&frEfeWxpQnM7*+b&K(PigpmQ?S6Ja@F4NXw?s
zKOXA(5-znOW>^|lq`0&W5)pXbL9zv$k45Sios4Sj$>%@cpC&7-b6uS-mn@5^bJ41Q
zH7Hc%su;%toKE_Js(YCz>QQPH5JRlwlhL8W67I16wX?EU2f}PndA0HmjRT$KwO2O@
zn*L+6*`@B7gi9UY)<~_IwS$9VYRqG#+S$yg)tFLtnT$vEnzc=Y^cKPeI6b;8ZFaP_
zhp01QiMsUps;C_(qfuou3m&a>xqgpL)6nOeZcSsJGqZWhRm&X4F94XlaIB8H0tgBP
zx=B|x$+sf$&sQJ#u@^O^U+e)j-YlilE;cK!*Inj#+<X1lK;amCdo`h*F=Szcqtd#`
zxwY%Mnz)gDbpOb#@$K39t@Ruy%PVxcOzEMY2S$OUn8@AL!A@_JO|ZrRD7DYMXBK;O
zQJ)@}uJm@xY^t3KNR3_I{^%`JTZ?Xry9!^L+e|Fa)ZdlbK`7I~kd$hrWk^cT`JK6w
zK2hHd$K{8Oc0YWxUE5VyC>##9w-QclIfQGTc+`I_`eAh;2M-uCtxZ;YalE%-hMUzj
zTQ!a=5Q))LiuwNvi(PTKhF%|LRLF_cK2t?B>YjA11;>6FOPQMSIcu)C?JGyZv3FF*
z*WI_ylA;)lnIm*jZ8bSGtkbTsC2}?}bU)6HJ~%RUs}$9eLu_LdfFx|JFFsOrgixC8
ze>a)KkgEZ&ynq}^Vn(e-J??AGM7NpoJc~VGFG&gJvEN8R2E;H15;ocN1#s4JP*c{p
z6`I}~O7F4OLniRsqIIrTy@V#x5C8DCm7c5V7z-XVG5fu-n-<tOD9ktCqM$v|dv$p>
zQ?b$jJ9(HA<KyxwD27;+eKGPX24|<C$?!DM_-7%bS}n$|yMAvUnihe`G79@%mjghB
zk0t0*o;xhqH5S_~d}*_s8?;vIruVMIq`C!WVcHjmaOHdA^LkXq1-+^j`@GO1RJC*O
zbaWm-{?!x@iY83NcNDEg^3Gbn&AX}F=$mVl$&GSg`q*NmLJai^Rs4&5$xQ|OlLS`U
zkM5`3T1(;c6|HdILdIWKM|LQ785F<qfwgapy>0psNAncTlTVS#%0<SPT{UgmZt(@n
z#msgV-cI9jbm<$I_hK8q&kf`DD)NdKSsDp6b&OKj$vVFwrneL+gbME+ZokpPz#*Ql
zcPLAMeBiD=Z&1lnIGeE(i}!Z<N~+_cS!?eQB3MCGiM;GE5M3YJ7_F+c$lsM+W=|hE
z@{xEq_iat8b90!quPcr*h6?|}(H?S_n1oH!9Bp9ES3nMXIdb_l=VhFV&cToF^GRI2
z9{r0y!Zkd!R<!I3?Y)MUJV&O$i!UEiV#cVmY1Ym+e8Hkpuy!9}d;=kqh+EGbg&eoa
zTQZu|H^b?rC$~uP<70~i!+wd^LQ!7+KY(j#<@?iSJoId{GYRTjN{yi-{d+Vrwm!j`
zePkT26!N9dCZAdLW0;Rx^=&^+;58W6nPfb*9Ju(QkbG7ZETa8rtqie7O$6f&8QYnS
z_g$d&15TX({{qlz0PjosKSyX+zy2Meb@zFcrJ-}@VpG7$yaNDSt-PzX@)Ewx?10i_
z=&k0UJn!aI3bjhKuUPhUQU4cvZy6R<*M<!XiU=rJfHaD<fJirpNO$LmbW1mg3P^Vj
z-8FPbqeyqd4Bb6+3=Di5<9WQF`@X;L`2M{=-aj03%(0oh_S)B4>sse|o##5<i=vNJ
z1pL9=8qL)!&7p7Yd!s49fT0$pYvHVT63>1ydB^%ve%^47Az;2`)qi4=NY25c|KMl3
z&#ayz(>mDsX+$~UTMxb!h|hYVj@5FqHtLB-xSgK@?N-y`E8kak3)>dja9YL3dT+_@
zWV-1Ov6v0o1tIBZjMPh(_ZrZa$v{O%0Op#<E;95i>IL<YdwLU#Xkp?6o>Tw9vE)4L
ziDm_7$y<EML`ivb#p<`yex8`worQ8=B*g7{VBaxWXTCV{I24SpJ;;>Ts#QKB>}10>
zalzi|-LT=v%rJ>UK>FRnzl3Z*yD#7{2@DxJT`h_t-uim==uWSfwH`9JG*ORX*ZUc>
z?cf*nNg~i?spwqeb*+&he4H;%?FJmK>EZn|bmK2k^HNhi6U|&WndpX@w@B>nc%DP6
zpKrbV>1lL~T6byp!^7eKH+f6XsGepgj)RlNJJZzE)Y;NWE36`9R5mvE(f1$)j$XfK
z*lyy{hGc&IwVx%sPpx^m8#lqp%)@4>hfjYT-`233F)DjCg&)au^QH#aP$te}<%k6L
zJv&1qa;I!v^ep2rvEJN+b34pw{nb17#lXwalzzRL0~3f|9J=DNG?Pl{cc6yq_Ud7-
zhMnxoOFzXV%h7f^uC4x=rDRNf%`NMNo1V@zt6!%~0Mv1bGiv~;Ggy2io$$28Lz-Z<
z+4ln$6?=|C8#fmE(YC5a`N%}u@j$R)IJYP?kBFC!3tISeU7s|D%)0FEFOc>w1KPtO
z){Pex<Vq?pJ&)+1I^Hj83J`A1r&HUikk7U-Vtb|Hm${uaONk@u;us;M)Vq8Rd?&W^
z*HvZmK8eJ|6|GhQ=6u68d#%m=M$4Yrsjqt$p^395#ElLrB^qW4o8m*@HagGEi09s~
zA2qllMrt_<uv7Wp>BN9(0UmYLrH|jnB)LwLX;U@8CIYBWQ517OoFG9jN>EU+^+V50
zo;s&7fJxk!z0WaFfezjFET!y82|<@4^ZphT=#IZ4Qcc#co8RlC#h-`sfZ&R{_3FPt
z^Yvc*UD#EEO6>(yE+v?<DU0_YD$^U@=5Fz0DBhf|F@@(~4wyX1QjlCxPTqLpWYIh~
z6kKrbv``cS*RmyKDkZd>{*nvrNd$RDf;ZisPM!2ltCdRSDr=4fU05tSg4}p)*8}06
zWYaq{3G<GwM>L@7wE8l>`L(-!%5lLOhZ}B}EmZ<{&g408l^%`{e*lPh^_IvexOuC|
zxzrF)pX$zcB01$?^(SLH9^t&u6137UG!nYf6Tj~P$1&r`$(P<xf$(`8sO?8@D|{o7
zDvzOEnsYO*_*Aao+l#GNGto5{?dJ%euGp((TmI~qzLlA;O!S>Q)G~k7#wTmw@e-E~
zFXOdI;}VRkO))t)*3-ZTaG8GXGfXS=De1ds@>76@;+;<8_K|#V)oi=FEl7haLo%sV
zd!NmEH9fpXWp^GYpxl{VbA-%6+M;eJ9o}hQ6k8d}{r^SXf*#RqOxURqJJ>BHb;($q
zvcK8;^f7=+X+w|kRU&>Go^pC6G;wUnPy%EAOT)Nazw_W+CUsHr82*i@6zx&!%XJnW
zwyJa5GO8eO`x0@%Yf8CV_-q|phRGN8$bE84jUy13WyoIbTE|a|K^!!|o$ao_C9t1w
zqVT%2a-2an!wQdNhZm7~YzYN-RD<yqDaA}V1|6>}3&}G4m!`G&cbYbKQ^OTKv#nur
zD+*V0G_TdVF$7_%xQxC#|H|)yYL3Fdg;|IPRP=esP^N75-gnO;9UCO#&`RJ^BZxa%
zLU;UQqrXJs-g3Uxk&_wp=_Liu3%5hPw0eoi%2w96UPkP&KNwnF&|etZ`kBRD&&<A1
zo&4h0w$@)FzWR+MU2+x;M=&QIzYr~F5=DCr6zW1S%p$n34EILW`_XTv_Oj^IIpr#3
zSK{QSR9a#atOwiuM0LnDFmuGbC0H~i6`#9|Wl|iawLXS$OMh5|KXj8hK0edC)H)O=
zrcPbQ*G!D!G@p@g323AnlAhD{{wRHxnxFj;#ujp{%@s{6zM~qWv?a795nSmprP|jX
zIewh7CFom}R7s}9u?v=i6uo|a$X6g;(~(4~8TSpnFsT^6R9sjrBQ8waqn`T+0Zm?y
zph>SzutHh#gV#8HufFifGs*Xi#q9Ui!zcNsD}QuY<5@uTJTF0PN-A^8QIGy=c@vBU
zcJaP`0lmQI_hu+lsF{X7q6UnSHsJyyDr_3{_CyC4ny;gFo$Xfm#;%JP=U;vj_YT07
z|B8N=L-4|2vdpZCPCoYaR9ZjO^sj_%e#*O}gbC_%E}5@#`L=R$pO0nAL(<cYI-*Ac
zS+<xwl@%<9&jkzslp8cU3;m2)8UIzf<g+#pYIpKVUn1zglx@bYIExYDS-$nfrt=ZD
z7e1qLQXG=hLs7Yf#t_kGJeXF^N5W}QQ;s>1mr*exk2FHaIy!T%w1%pzdvpVw+X9n%
zu^JgsY#U3K)X+zpsLqWU(~3MvE1>p&Yv`RV-sTkRw^DD(0$u#xGnmrKJDqzBKas0f
zu3jn=W_0uC9m`=gN{Xieju)pwl9sFZ=cYu1vH-OT)MasbASc&|yfhg%6|Id9m97}x
zN49Ugpq?<Ev;GlZ6k~5D{KQG8?PW@lXdE3rUGDtLYH*Cbt1#|T?7MfnS^H=4Cup9;
z7h09;bTPb6Fg0nDwiaOkY+2*yggupPVemSmBGoAP7(C9iGTVr*{q8NYb>Ed~vL+3T
zVp{o|+g1IO+oiX!{uvgF+T;c*Qx8krpdSz{Ape5AZ*|*R?`^Mf3#YN>C6#O*;EDTW
zZ1t1=VAzl)2SOh#NpdlOa@tF1e9^iQ-9|%q)!D#L)L{16-DRs<P8=butEg#G<+<D|
zn)ZY*>Dh)9NypF}0)^e#B<j|)oqhl>zTUvRK{kvzy!Eyc?WSs*E3ZIaT>)&=eYhy5
zd2XG(pvVOusH`s3O7D!m1CC+RF%{7pD^ln9GLsT-Z?>WGNfeuu@VG7ckdUo^8<Dj_
zEqv3?e4x@}2`bBB5z8qa{+@&fK3%<!{G6;+XmG+IU_Mo@e#jk8C5`Bdx96#}^vvDp
zTF>3o6OoS!+OT1wfA)jVMgIprSLk8r)<5yNvqy48P_(pAyZz`(ag4D&v(bD$=SdJy
z$_1cwU_STg?Y$KnpWdLykYQx(<1K?$RiJj!o=9M<GAcZ>@oXLp@N)5*_e?Eoh8A!@
z?vBgDCQ~_b>fPKRK(ZlUQ?vh_SVPA>A9k*8n+%yLS3X-|x~X%%1|vH}5zcY_Wf1IT
zOq&8mxng5uc&PGZH2RS#KqY3Y@|Hzoe$sxPJ$2KXsOp_*b{WS|#z?v|BTAn9kQceG
z4=o|_UCCC-a!iVGz0O1=wRl>irx(Z+D+d`BLB*&iblLQK8Vy;7O?hhpNsZ3c6KNs#
z?k6UGF#w*E<$!BBs(;gxBt55G!99wHcth7(Z$<q^6-^1EEL^(*D>m&~jbUMz<d7_f
zByqV#VA^!&xdph)A?P+G@zGeqnFZ;{8zG#j=R4_7EE>m|<w>*(=?fHJpeq!d9@m!z
z1zMKpD6M)^bL5yOHnScC2`V$m+i$+IUSP@>=stXM2_yVT_bLE%?`Qwtbgvb^lbVZZ
znTN8Fh~Ewz&)gu_<ptjlL%myny6dIhD&VUv+h0$G<D2d)$Bi*fHRM72-PuF>`K|R@
z*0c-KOH&WGdfAK|>q?GbayR|I^Z-+WYP8u9UJtR)=E)uwbx3l5(8+Rdf_9BoT*=Ud
zOM^JpP#crxC{Sj6`*QiLsVSgy&SEMRB0&w7uGknm9rB#SzwVP4>yuU^!RJxoS`|vA
zSt=#2eEDd+_7bAW5p}^k+tsJxXq?Woe5DZhJKLM*IJs8An8!1)aA#~p@}Y+Ez#_o)
zrt0hdFV&0VZAZfGcGT04Q+xaf3CjT-`uL~H<u6mO)8jkF+%(wQw#hWi2QyD?X1c>1
z*K^V+L7qn~S7OSsJmyt!>L~RMvST=fzkmlxwcXr(T3Q8A*30TpJTogM<;rqPCaz-H
z%Ooq$6vgv7YQC8B`tb;owV#IEg5?k8Jl=n6V2oi0=-GTe^}6pUJ+I>gw2$Di`AHrm
ztpgT0*(1cWyk9;{B|r2OYQzRV^t&jNko9dP^}ev>TL7guj--Zx(2(2*R$-8Mk3<~P
zik$a{o6wIC0U~|uhEHOoOnzPV)d}I+t*3%;T+>WYKJtqDJsbZA?svc4v;=-XJdjOE
zEZ_yj26n{$hMT28XG(bD;l|#VUsfoQf(2o+B!g-s+eSe-_Xw`=@f~h2-0Uhq74&?N
zFpAo$9?icq;&$64UU%HgMchg@W2|~*n&_NTACC2EQ|g|##2tbok=ht;r-reJ^<4jv
z2?ZmUY$Kd0_^x=5*TOG?N>KmSf4ScmH;uZfDU0EIyAo^uyt(PNT31AeAC@_^yrWz9
ziv5i+f##%|OlUkg;prcK?=epufN{ktF>8~9yxj8km`x_XW3BXwrnCUSrgD|W^>`T0
z>)H0(f7jQMUfHAmOvwPok8(DKtqa}VHJFU;D6w#gV&_q^C-({LG05Jd-pp?>WE+RT
zYk}oIEbf1(62Q^?&VOvx@2;U*)r}!fgDsfQbOM_w>|G#bbgwpi{O@s6{g*tRyZbIj
zi#Yh+INDXtdkqB+Xg9a&SAyfNbdduRO>JYMjrYDhow`&*!vc;B_<2Uab5v2++rpG$
zv9pVZwjpzZ#6MW1KUguZHY!1k;I`L2UjIgN#Zm&moMEDs%5Qk+=Mw#2PL7uy1+_mU
zDE_Bk*nhwO&nIR{fPv}eo+-dXx$*M;j$}A{hO~SJ-xV7y$b9F=!~FT@GxrrW*jxRE
z3ZMp`qVYc)q@ojbV&mx95l6ND2bCx};F8|lfaQ91zX7=>CTl2JXFYBUekBkNH2lI@
zzJH<QezfYpre;Zbk%hM~|M!uuF1p7Ebj&Sk1HnJr_A~YTMgP44o|_lvU-}K@#uE|X
zu``Na(ENwH{NIKEZ1VMgy7iCm{tsu9KVzZ%$VdG7R)qfS6_guSYFXL%e^$#H&jxw1
z923{SYql01K7ldWr-cwM=O*=0n@ahr|0iGoK6wc3D6s)=2t!Q(xXWxDP_n>ln}!cC
zs*YYc#O~4cPZr{J?F29iaDEPk8+T90T#r#e`-hj-36Iq8mp*;^*kO~v70wr+62&Ot
zTUlc-#{f~GhNdy(DVc2XnZoNi06xekHf+Ze1Zv#4u(k3LYj>IwC7pELK23si^_|so
zR42nvJ+Objz0d(5UpFdOjobxt_q`i~o0CTS?*=_^BB=XR{`L|>y?_!4qgniz)PLi3
zL$1W%3&Tb;fBWB`lZ4<+KscS~1=8~QQEKw@%fAE=ugulBQ%rWhngIUkR|u}8z&Aat
z3I0{c`_n|x{pjC>y!uxmPH@s<U<~|z6Q5TzI?iI(0;g+h<L5tK*6-VgC;*R?K5PiO
zx_IH<i6b;pt6D3*()iTLp-<-*wMM>xsTB}>hq&0hFRqKg@pGkU<@{`m4+sKz{_eD|
zD+E?3l*{0yyN`1mS3ESz;uoWQ={Azaw*uKX1lOIFO`t=%Xn$1bictX5#85ky5C<><
zy_6otp7ssnL15gRoLTey#=re!2S2`lo8^zckv*7#JJn`haeF05=iYf|a_wL<dH6(I
z5gxI}QI&<CWkIM5BsJeLS>|a5zuVU^s?2)4qoN7Qc8&q|h5X_*HK%%}u}S}W5|DSG
zeA27IKxVbqKg8W{7yt`9=%@R@Btb5W0q9Y7U+wG$C)N_CW728Pw~)%li9T{z3oo@j
z=bd*=UmWguz{I<+zxKqV<$RAFqN;aZl-|Q;Bz>9faoCBrw_K>4Il1V!(6c0b(|x$m
zIXwWMk$0-v9ffJ^-prjb#f{MdQ&@qJJcx;Hq}n22gg(ZIM)BsaT)_ozb?nQ|e3j|N
zfz;`XhC*caru^i@BWdT$N&lRzl`zUdM~>_S=LDOl3bc}VzQhhBbW8j8wqjoZty<8!
z$fUas%yqFd?p@D~q(eu?O(jatU~_`=0O$MS58ltyUd@7Db_}6>+Q&(~R}mMYoucFs
z69S9OQSYAOubmp$S4HpPF4l*8JK*k1JC%f2TWxtva^{2Bx(bs*YShn>nIT#GEElJ+
zp{{%xq>uQ-RGF-Og9j4IL*`b{3Fff4b%)Q$yyD$-LIcx*@l395QA5!)P~{?I46)p?
zFj^|jvoO(b``CruY_tG5?NTLEe{<z!uLFEC)%1`s+4E4^No{;DGr(&4OIT#R;%{D_
z)a!k%Z7(WmFd|pydk;?)a>rW~s&dc~1Jhml8qmh1Wd>qSMm#rZUYk)({$fW7?VH*?
zZ1o05_U3nEa9B<?SkpU9TwoPqb0Ju7Ii*QlaMn*b)9ux^h#n{Ubw)FoA@3)B<hk*>
zZ8Dcjf24hTY5n2xb2^SQL-%7s4_W2?Gq-J_p2pzdYVB{-V@4zrcpV$&mRnLML9anY
z%8^=$N^^l0k13)_&)`!U>^xcDDtwz8VjWlQPJ&837(YVM2&L@_D{?^#Ps%ENSFOsD
zlbG!V2aG7LLB@BfS+LFT1ixz!gD8BRoZ(Y$eQ~2e_o8O~)qbfnTBiI=Aajt*S_2kW
z8O*+DyU2?SyMFIz#<gfV(A{9Z5I8hs6FGUHI{Jl;`clnN;;n(3Hov)cT6vKqF)=dr
zq@(-#S?_D@kl+zT=sQ>w0=-Xrz=xZ%f3NmV;>SG!)!O$ZQCVrOoGTA!JBl~18xfB?
zJbB6V>M~1&FzQ9(V>Rp9`4GvFiriTij~?-gtkgSeN(y=<lM5|5t4zyeP`hXI>phPW
zHBJijQj)<KiqBm94xemu+fM)j)Q_Vr2NEr7d97!s3Bp(ozBQcsW9OE4CK%0B^s*tH
zt|1`X_0FDHs?0i_0?l_jn;*}F)Am-Z&+GI$_AUwmAF@ZG5K5B-cLE&vWJlV<yN>C7
z1V#0G-=Q;xfRShGh1qYdW=`Ku>mI(+Vj97cBZt+U4)+*&XaZ(aO64{BF^4)OSsJPr
zb}ip7*bY$rTsE3q-j+B!sgcda2VE?kH@n15+AeJ>an0lhVZt`)ynoES9e{8&@ir^_
z)!ej=v3fR`R%N<Q-zmy+<f|Q2IGcQS(qh(XtNDQ<-m|Rt3z_X%@QT^Kz2~Mat}?&N
z=`K%*|8sVBhoeAGsQqRF1MKol=B@2z43p?Ktk!jPY=-Y_UNY~^x!ExB-dfuoFzeac
z7>3J<UEd1PNFHLVICc42xuKeBk^0$La_gfgpp-G4<|rHFru?KhQUcL%<kK@H|NHob
z5bfEubq|4OT$OuGfc5lLABFYa;9;sQ4)RD#q{Z_%p`qY?%0M42SO#Z9OQWP0@-?jQ
zvVpH@C|5#|wCgdA&P0jL#a9v=QSA`twGfga_T(*<sUk~^KFTx3M<}ZgVhY!?txcF(
zBF9Lu!Q=Th4z&eD!9FW}5$$$*dQ9v*4i|gU-e%|(^zxZ<q)6q_<B-Jt=>p3ek&OwC
zVgnr=Ov;R#2L6_2oXl0y9gGdyc1qSA&Q?k|jSiB#L!YS0FDrHrvbV0|K2cQ&woI=w
zCC6kmvlMC(qHl05l|l+C9;k#3C13LJ7f7z9IVWCD*i;^WB9WXaT#MbmL>?aY4%g@L
zmZ)allMLybzW1UQWZ#7;-Q~mpbNqTskX|c4cCCHe05^Jz!$dXe8i#jC<^cj!yHcl9
zADX?kBv*BPKknkLvRn1OEcg=Y)Jj~(UZ6!%M!!9o-SDAuf<LJQG&coLrZeNsG;X+{
zVOUu~z}6qYWnopzAGs&WkW3$3t6G66=p&O37|KDjxeghl+8R{%mx+?5CMqAoM6+RX
z&Cb&K9!$Ye#CM<lXaaM+HM<PkgL|XtKs7%vxJR#P+zR!Qu0e~lXlTqpV#U7V(ss&3
z9YP`}dWbs|6XlY`6!KAr%^Mu_I?~o{w);9+1+9G5m$u2omDh|s7y2Wv=*9gH-ABE&
zyLn<-E%$eB`F$~Q|J2B1QG~79L&0Ue3$4)1inuZPBd=AEApZzji%^g%zglF*A38NE
z?>g7MJVdWrmiPp!uQ+cKL6%q+=6)&LO~1d;3!H0WIm0k)jt#z(<usSK)D=mbuD3!R
zF<6>!W|{1E3h1z0cXsun4{<^KHmfOF?4aO4R*z2A0=qYt)0zXv4cBw_B#Vw%tQ5+P
zt$BEA$$W4E{3V_`zg2J%A^DYui}9iKtSjSvX1O=U;Ao9hDM)kDVdTQax7462>it60
zhj;MKRP(E7gziVorCj;%79}G#@BH`kUZOaPdK;VJS&tp)Sd5oy>3FMH<+nUjzkqp`
z6eQ;xYMKQ@617#P<R5C5z&T5xC#_~>dP9{7BhQwPqV`OD;2S{!#+}7n?qyGU<J<E1
zxMAS8Uq>)&O_nRRjp6Z<`CsxF4Om|0?{3L2U04Rkqb2k(=D#g6l@n6i=zK7iyiL3a
zBkxy?wPK}xqKx!2R%e)pGDx>88{({06fLIHPFwHsb1)=2o^^;J`EntnBp6+B3}%Pl
zw&TCtb=$4Ux^8A1Z^f7|QVVDJYUD4?!I&mbgCe#yPkPqZx)p`!PtR)nP`s|NvB!@t
zELG%fJ!F<Q(dmC$nZKGIoEUWOshVdZgDCGYLU7Qh`7OGnYDVoRRqao!l`D#rkCetU
zEN>M!)m&psi(ab3@z!D1c?)iPUlD5$IMj%A+l$#jmh=4<<G(_<u^fFdL1n494rKi`
zv8S@eJ&8;k8+kNkug9u{QaP!gv$|@xePqU%TAtJ07px(5=Lylnwo*OI^PVa&^44^W
zy~>oXd1YWdzs|j;GJNH5F^@S+Kes#hiNsoRXmG(ZTN;B#>5D>C%2S8+F@cNqkuuH1
zlsyX`JD2@L9Dh8f)H}HEM;kx#yU7YfZzTwjt#7PYMLq<?=;x7@i1pfgWc9~Kr7ZzT
z?j?>hW7FLW%hBJl<$jytkd`!6tUeM^WpK><Tvn=2qbdyZKXn;l$a$2!TVSA}Z}3U3
zGk{Z@57z;C)*^~~seFTH55a)Ott_NFfpWP$<ME`_Mvyeq`uU)gS=zyT{R-HlY&(wd
zV#*A$R4O~jp$I17ahO|QUbrXpQ8k_?{S=~(8Ba=^V)8&yevRLA(_G-~5SBe=Wp2t1
z>`SW?YxV)L9!ks;x_uveu!QztNjR;&pQUNR=a@1>YBiOi3`0Ivhe);n6G#6>O%=JP
zs`A6Q=uC8Ckn=}(BwS2Y_I9yUaj^@T^`qn!Pbs^<zU9k57<yeT?7$;p&Y(Hup1CX+
zA3WmANUQBr`k7PX>FV>wlp{whHeaX>tn40#QsePSqL2SJxVaXZYe+K#Gr_K{V?2hp
zeV-l(uuSI5@6jWdnK9>2DBbNYXE1u`$PQN>u?yr=-qNweYsu=N<&^QAD(;?m+l|S=
zVRl*r<K@+e>eF-o<T+UR-FN7ieoO+6K(Wp`f^9zkxk`%Tiwzc?W^jl~UnR_n7>f?w
zx(J^L%77y9!a9!WMsMfGn55d;nwpCpz5@fjscJXAtj=tDQmn2ZqA~p5#G$jOvHRm^
zJ>W}tzTQ$w-bUqC66bbR*bGiGkLz*{^MXdz#vAjCqcgIR9E%#fLAU*bx<(m!nKRcJ
z!9b&^taR(L==6q5!vk50izHra#AJ(iz;uWlbw63suVb9NL}^oEm#f>sD3_9@y3>d6
zM_Z!8orXQzVCTiUO2>N@{&DyB=-Q17Q|N07nkyx|bvuQ2C6t#uovffb>7|3@thW!8
zw2HpS7DA|>ME1U1iVrV1Cqgu@wPlK4PTMWR8<e}lq&Mb>#3O=i0Ejq3MA4c}db}<b
z@QRPRxsV~kt|~{aY4Rc4iZB2B!_J-OSw`NRkDa>s7p1;odO4OpwXp_&Xo)8*_)by8
z`i#|Rg-g2A!T$4^fmZ72<q=5kgQ54@9ZI(KwebC-n7r6CJ*lP9=1)UDIo~(}f-O1m
zvNEaI%+6*YMxqQXJ=D)FF|5o27h{r^aCg|&!4K@dPxMm-0*g%D#>qB~uiqY1$hNwU
zZ6O<9UB`~A-=@_5G6U-2vLYI474P}{t9=GVk&UPyxsh1sXj%avuuF2AJKka%!EvhA
zO+9guypkupZ~BNC`e8w+CFjZnY!aUn-&uGD^FYnf6h|9kV0vKR<>WFm(Pi&bI4T=p
z1xKPFSLg70!LEnvQNgly6_fVBDOgq_;KFTI%axZe=k2<`el1a*Q5`d%P|mZ9`%31S
zVuak5v30Ps$y2W_Tnecdez`_i@9uWf^Ym~~nW#{^{%D~J)HZ>I^Lr1<aO=F3ms7N|
z;IJS%RdFWLP^j85s$RD<i{-Uyl<B7BlRHCOVyn0URhP#x@3U@_aXX5r+XV^u%4pRj
zkEV-oSy9f&8Dda|^@ljm*2GHr`QS1Rn;YAvZgWocBo*Y=zMd<=I#x``eJaz2xni%<
z#>xXbkBIz4s==?Z#+g-5oMGN&ZAh<q^wjT|ZAqPrCb07fx67Pq0#~)mdH}UVu+BX#
zt8qdI4QHL1$wo9dsw4kZUu~b(sJa)lMaqnw&JdE@v&W3nqxNdRMRVi+R;Gcvl^(8W
z*Vwlj!-V^p#PZ=m#q<NqiFEWLX_^GM_c?Fgx73CCwPT`bMNx=6HZ(x6tBx{fO)Rwv
zO9w{>T7$U6yO-$XN0(2ava>tI{NJMb79oZr0vl>J-=K=SY+^rNqu>hw0inJgBz-l5
zyP|5!zM>mQC8c?s$f&AxpN}Po@#XD$H${Qv76sCJXrPH_3<Kz^Si0`CYr}biFZQ-7
zyJ`9>$%paDFYxoex3sY3Xxw3t%sKP+f5@Qp<ula_(HU0hV|L3bc;TGhzTrghkq&uE
z=s<8!=fhu+ZxaPxe`iOhWXeQad<L(B@=h&-e>Kvovv?pvJDZ7Kr@$#0wKi|<tPvNL
zNym@0WHZ+0nQ?FFeLS;j_O2v)(}I9z71Fw#*tLv1**I!XNk%2Cp}BYgidlMk4|<%G
zKPh>4j-^Ij+h3_pUVe!?OoqlsUBH*yQQS#Z|K_-!_&Yn#C|mon`FH!C>;0t1Nq&T7
zFUG}QC%n%?cyb>2BXYUEMVnCGAAdTRodnUIP3|%BcHllo;7Ep;b~@zmWeMD4u+pHG
zb58JdE&S#S2>?^$YpT$!#ArT9Xe;8PWz@qix-S&j3s1v6bw~(Q@@4Zvv|sjZh6xr$
za_B9T>|g<97stsJ4BMYR-e7<Dc`wbaV)pZ%7Y%C>n~WW`7b04g^4;yHlOIMO@e;cz
zql0};_xH{sDqzZ;9QOMJElapj7jG{f+fsDu)b9^3<$`-xZxK{2XE+nQ+o&Js<t@N@
zYA`bzA7?7<Sr6wWFp0Bht&x`akp+?}k#8#t;MDLPUX`MBKT9d%zO2`j^vqtzQ9(<Y
zN|Y{34FWUbv4W7<lg`U)FGB+9pYXb!mbP5K>49ey(xXvvv50g;H1wwf`+lA(E6w_O
z0ftA$!$6sLbMfP3c2lU9<h`WZ{1;>2F?uws1{8tAosf2`s(lU{lWDq%Di$yvE*|(y
zEj88hXbw=1ioFsOCa?)DfxL!rSKCyZPnYY$w-cG_hQ|!0F@KHm*#RsXw&MAA#-oX@
zlj`7Yb)mUlPWS%mMR*J`pYvM0`;oc5ziZv#stzNnbfn7d8sz7oc;7SUwr~ke^XgQE
zCvMZsJNsO|RE0d5g8Qxv0d%j7mHGpruPN&zUA`rZ3JR^H?qk!pZiUf{9ur>Nk#uQY
zYmP~jypv>K+~T;=by`iQ`HcfBB<Dj<FyQQFu>XkrIMmQ|rMOE2^0_ulp9^KY-YA__
zP<m|S#++4cv^b)C{shXpRBfq!UdDyamiD57@qw%Ii<QpjR%yf(dMY=7eNVZ>f$BWI
zY^16DC=d3V1qEknD^8?+jO%{72*NgGk5FUAkEduVa3s&AGo1uPHXqqIQQi*ogj<}9
za9gky*scLNjO4seUX}%}PxR$!4p_r^FL7BU;)?}po8UJFyTWjg*B&+nySRy5ZBs}V
zoMT-;edO5uB&h0Q`hh(~mL{8kt&Nei4(Vw1@aN37n?2k)bp#qg&l`>`NJ&T0!!J~l
z>lYF(D#s9D08VIhOH*>Yqwu5ZI`p<z!9v*$v$7;dOe#ISAKT;?K27n$F&dY}kDc{$
zHNPz^uzM|?Ygbff8J<^P4C6=!o4)M-gijwwRKV?&X|22r?^7Lq!WBKlO=_Ht?!zwO
zg7jPPaKD6%Rc-SX7?&=oRHdaio|w-DdS?0f`l2aAE=G<iYVA#73#U5nAlHS->QEG`
z#uEGe)}5W5I_G-LN|WPh(d&tca0a(Vx3zgIpF0y}t}z$-Oe(xPfZ^Bb_>y=9uYSKM
zMdKya)A@^*a4>rT(TmlEkLX8JKwYk&pkUvME8h%o($^q}+w|uw6^e)U5In>?1agU#
z)mdQ;vG4YOAUTs8SJyLirV?)pImPU>E_jMl_0}px+xhM2QK*QOfkM#1g=zem=hFjI
zi~M~K0z<poSNa(-r8mIIXRj0EY?oVeCmW>A()Cp-hhE&jk@BD=0~Pg_zMGdXhM<5%
zB08p^Kxc3X)2|&;`wnW>wF7T64KSlKg*)IP;_28{6~P<B?(8aFrg<1wT=vpy(w*?e
zBR(aafIdUAVQ)K=%4WM~v;d$Qk@gDMXtg(?isJ}IT<5+{cJub{-1)~;aMvjTRYEvR
zsms5LZmIkQxj=6r@2ETeo{fh4N%)HwK;}5%$SzS$(Y;noX4W|VW8DC-!k6!f`$JyF
zx&IY4j+2|!urptn+bCyGRGG%wvFrSV+8PS7P*PJ&f+4?%lk-<^Mcq3)r1EBg+`KM&
zMZ2_{1C3;X(f2z28t1>b7<4?RB7+k2X)4KRt)q!5oV?_~J1pZ=8WD0`bcV%3%)~$Y
zCY(kPGx+IC`M*BXAN<AaS7413h{dn?%g+Nh{?9eQPh8{nlT-Q!mEo@*dJcf*ILjgy
zKx=bQFSdhC+>A{ceNBi%xBo^4G^OJMTFcd*2@2F(86sXNkbvx^TSbU0(ku~9#6PIY
zzB7gLU1U4myy}TpsK7o`KtPc{2<Jp>b%b?VxaJ?IE;WF!Tz0x@y%eg~srLK-Jjaj5
zhSR*8HCMWCrf}6E?Te@xv+axM*P4HH^<S_2ak;`3lV{p7$oP+Z!!7dAjw{+@@A~_>
zf8!)_uh_&2eUty3HTyqz0onk(-&2&Poqu@&Uc>hRpiQH+{NLzEeH)<r<Ib<W`B&Fl
zQ$TYk!=MiRH>Ko@YCtU~<#Fx#m0a#;d;z`l$0za%AV{*KpKbk{STarv=qD<HYmffT
zH#bxRcuYmfXor7$N-0L5pCZVv-6s3%t^d;;F$Ul<b15Zjf1r<l|075RL{?%4&NZKZ
zbKcE}1|D-bJX8BG&-R}i2$Dwt$Hw*k-*EUpBOF5cB0`dX3@dT`Ta7OC#ygnl4ek!L
zAChD&=uhg@ILKWq3&gD!2gVZ0=j_0H{Dr}8vjU`#aJ_%m0=T#y{f2;lhl`*g{+pY2
zh61RM0GgFIN3i~W(sdZxQ67FM3wR1ZDW@-u;2$e@Xf{9%q%2OOUR@lPe4UA<zZaT6
zhC~wpfA@r4F@e0Xg3g{}My80yf%5jiu{;2A=Qne0&!is!jzy*@sDI~Zyt%~_^3Hb?
z^Y5Ykg{cX5g7^;5KEW4grG`C&r3uG16uNDUT8HgX`<+3tyJoVCP+R_!c{cpB%?kfo
z9Ao8gJzTyTjRdx}2fkewtIAwY=Uaii%b0(!u#YeayO!C(V8<t2_i-3Uoz^CgQtzc{
z`b!5>R>^2(bSA#bvr06inOpsAdksYlv5mf&{ODOTJ0%rF;BW<@h@YMou+nuX4!ggE
zv<27lTdh=wbp@M^d01lCZ=l;@?~N$VF!6J*H|o_WUUsn|j*%)YpaM-fM{^aG(=jY;
zt2@Du4y8^Vv$wTf7YB)?1CDaZ-T_+zd|Mm~Zc<VbTWSDQmz2B6Hah_ycl`!9|L9e6
z6kw2J%<fzjkc55~3^vc&5G$PyA~cKNJ%AVyMIX3i`80m0)Kj@h|MpC{s&tuZd6Tos
ze8!s{*UilaM&Dn+4KNNGsyiLYZMw*?VzL<G!|tduO?v@b<hEX=X`X%ZO%$l<f&c6l
zHAQ(;spn$1<?&kgb*A$M_n!AP*j!R1YNf~LM4nrg+S4l&P&5^?nv<^rXIdn-tn?98
z%FgiofszH4<VO?r3E2VljbJ_0s34?|PQz*I;uK+j*Bwj~k1EVFsc~yQ#1WCS|LR5M
zgRqtK!EHM$781ulr_>+Q4tWruGMAxXx-oUdHPRNJI(_-@O{6Yi#1-Fn6WDRUcmr+2
zIB=~SY(?kRTn$*Nyu0C`^w8{xU9~yw9&7e(0r?h3SVy~v>q~~~{fF22u2KnHI=prk
zTi154P<qqG_rA2B&m|VVAuplz`%3y1-z;4?-M-#4$hz33RV=PGQ=S=}DI%*rh(+yh
zsk6m>$1%dRu(IyRfk+TESeQ`M9m~gaAR4VM-+jLRI`D`m$32C4Bd)sdCf4QOmIA^1
zXzeJ8uW0hF7X9NJX_l=?L0?j5;l-!Ems2h(Eb&3SMAq*g8aLp&p0z^MY@M6Kla^O)
z6FM;!(49C<z6y5jL0fnOeO*-M^rR!%)B5OGzjf+5+RD=FyB&N}_AaZa-c=lBI!^7U
zhq@-zKP}nYx0f>E4g{yIPgiecoAbKw4FU(m()_Zs`g5$^#{)+FH-6r$CG<P4+-odk
z4l7t&B~#-f!y-jqI3h9Xy35hgU6D^w2V7L6<p;@2d!E*5eVBM5YA$w5UnTL2ChKrr
zskxUOI@}nedCCIK%s|cwQfnDOVA6G&0*5%tfO~|bz<$T$8Asz?Tu5w%f%tv;wzZX<
z?IjS>RyAVI41k|UyUp}!91{$k|94jU!8DLxvxxA12`o+IIw;c4mYU2U#xrwDH!Up^
zxTk-xj<ws#H;TRy#vN<e{q0^ZY70(_@3}p9XdTN8(vehfC?4^y%6?iD=CV8w{JdV3
z*|-by^#>DMzY>03x2g59jL%`g&00bmPpFD)5<FCBLS5H*DlVW-F5UjK-mdI!XZmr=
z2K5VOaW;Qn9GesXABVQ<z>wT|gBnjhN!~x?0$$S;{(xESKA!bycX$gHU6#C{GIp@Y
z=F3<=`sH1p23p`sp-7v4m86VD#<^vdNpCRM=KPJ6Aj2MloFHEe)nHiHCEuumFJ^&b
zVR&QPI0V$oBXy0NpQiI~2?BYrpv?yo@*nZ0h6U78*jM%$M$%ult_#N$Y{W_yih^x~
zd6w!_K_;xh361fB$Qwxtd#fKvWjbG5aCsq)rZ$OdCT0>HNDdn}2QgGDr@JoWnfW5R
z9=k5R=hcYruOX!Ty*>bM;#bE0UK+(v5T>7c7l<RLH(n_(otNR5NCS~#)xw0Ks-&Kz
zp2#dN;6w}XM_Ehsr9c(K6{0H35KY@BO+&N|oft7@!TY`z{y<Gf*+P3zPp1=oj{DAJ
zRO~oxhF@8Qh|bH0&aG_q^9$dH?;P{go;#vOK^)7sUVV2A2pPpWIB=*?wcN-B_p#G%
z8E6Onpb-9yXTTRB>l%tN_}LGn2<O?3(8hc`39sn{GiAXl;UX;SZG*}TB%}xz^5kS;
z$N;^UH-#*D^2mynfzTc~3XmcT`N{8q@u$<sueuB1w4Ul7S}e%{i}oHRmO^?FZ>OuL
zO?5WMqP}i~e9HC36r`4$aA5)x`%YOTEbqa+F-zy_#m)PXmpz6ekbHSS!TP(`et#N&
z*v`!_S)8=$yrPry&5-g6r0@!4NU`e%Qt}r^j|fQq{FjWBCa*I2iU8M)Hy>HADiAZ6
zytZIfL?lUEMwSUlRaQe#nhE6&ZAV~!Y0y!3`L|3sg9unX)|NBV(*L(Tzh0^!;wqPJ
z&|&(&Kk@$m$iBF%I@{F1m+Y~lGO0lNw=I<*;obJ6n+QRCU?KH7pxZfIxlZw|8OWN}
z*W+vD2Hr|*R(2$|ZS7(kP8Y0Q!K}(zlM7p|&71B=jf#EV32Vr8@bc?m60Y+zCW`6P
z)uFcDv*!zMHGvWS$jbuEalx}BTk*!oXeFM<(NDpEkliG#t7S<S8fXRE)q9PL^-MY6
z^5Y3z&g5P*J7T%Vs^R1y4qs<)pDDJ9iZ=>yAUs(kAHJKAV7t@>hkbF*M@8`_g?}bp
z=C}xkfU~79C}b`rqiM&G)jA<ga&x-6&AzvXWe&$8(<2m9zlm&cSVqtE3CvkOb>9pN
zy9c^+!6{>gjU7yeb4oX-z4QCH_ly)^7xVCY22h~X9*By-)TngJEG`ZRSn0X2og7!4
zb~|RK``+40I$o=Zvf4K8>pNpVfr-lj0X@LApJ-_rF}8qjlU$%(|I9B?$G|`yT8Q@W
zWMilZC?Ow6ef+p9hLOA2v9HUjE`pHR*n94NuxHC@aZebFQ6}BU<RtGP8&jgJQp&52
zK?u~b#$~A!8g;q$tc3{fz8KFVo2Hqm;O%=J1WHp{Q$1_UZm^iDo7?e1%JT0gZ1Zq(
zXDL`cusE8SE?Ts<#j3TlUVx6Ii@L$e#=5)%@B*yz(Ft7(wHRB)`Vx80`WF4_b)1{0
zr*&3J=FJj*uS;TA4l}u_5?~-f^t+LeXzRS(lb^gfVS9eGAA$*9&+kohE<4(W64-MM
zP7UQ7z_3LE&?R2QJyAhcWe7#!v1G}N2CnfJHCDKHW!dLP1IPMKcXU*%)Zc71=TX+I
ze5X_GuRL0afG-CTWp+jv!BTcN*A#_&6M7exr&G;1E>TfTw^Zy7CgUzQr%R;EoIaQi
z586G(z2J1qX{eJXz0A+Lcj&PtJ;Lj@({!$W2>^4a2wdaKSE@`_WXfl2wMB$%R+;s1
zSbf>qetiIXw1gs)n&4d8i^)b;)sgs$krE!q?NyJhn?ZInS+NEyY}EBa5r)cnBTA{v
zx$9dv0`|6!W5VEvCZ@A?04j1HuehvheQqt2oBz}em*V0mKsJUUer(&1S~)GGA#Nxu
zfzzYAr#W4{i`_-VyDfw?Nx%$o+TX9mSWSnfY&BevDR0|*V3I9!!>A)Z(=-TLV`K0&
zfdFx>%JH3AiN0=yhCR5#wAOwBvASyP{)v#ReTg1zt&E$Bz0$3vvj<kLx=PpU3#oE!
zQ0|I}rUeafsWNW89O$smSJm?K-#cXL&qF?Fa9pt=lvd6mE;n4-TU`YsX1B&O!B568
zaN>-HA_Zk!T}iwU9q=*Ro%dBALr54@OG<k{QnY78pj&1t=T(MFrLmgKEt1iuu-t(9
z`j3ZJZeTd-Ml+1u-p<bEz<$s@=3}+(VtZKMnCx)~G55|?OtL%YiDW&=!Oq@NyKb__
z0Tc!|3#>}BTAS><;H$;W7)>Syy7W1;q<Tod&eWgZb?I<4B<=ixCmG+_Oe5}$DvwJ(
zW0JtiW}Kpf!vv~il;zAR?FL861@|D2HvAaOVYO}nOYKs$+&=ERY0wqj^GI7tDv%JU
zvI7bCi;21)M;(d*Q_~@bT0&KwM!yd&+o1kzF~-kDk3jIfZ6m>~i2f}ghN*6p8nC#h
zL1_=bZ277>$&9kcZu`g(ATScR*Dfdv@tG1p4f?vij8jQY>jcUwIcefu>{fMWVIPLE
z4Es1e8NWXgZ=Yb9n~QnKwY86cVKQGHb%}XD=O^8>|N7E9D(PEJnenuF#pv;2RjnO7
zSIoB%Yt&=L4Ze`TW$WO2)Y8{*AvE*#V8nXxq{N<()dQJ`;_U8rabi(Ub%y}lm&~UP
z+JBhAsFouZKU=o?>83)BmUn%vBcVaIY+}D)XJmfpd$lxSvG-2~EOLRw-$YI@*?z=y
zbgIfI29Y(S#Jw9m23rX_<}c7Lnge;Bd+eS&N6CT@MB^}{rU`fa_-&AwvEh1?4eqYz
zvB?LIhssoEjFLQaUv;=<&m3(|dLR}tdcGFO*IFigUB3<-jE;pwzwMTJS^HXP0MR^Z
z^T6E!S*5QF#@5#HJQk*WaI!F#jN8Rdmy-*WP9g<PUL}uEe+=1B2w}Y?858~_<<aWY
z%#pe>R|9B?_Jjz8J`#`H#VUT9>4C((naG1A+xYmr!O_blwrP&Us2G@)9N*b-fAK7m
z_jor$>WCwo2p<q8DHQRKI@u{>N_NVtO>4$%$basYNafAkz|9T!m~+eVP!jq&->ICx
zu~%y3+E@?=)nqRyBdz_gRwK1u9i!vE1vwtc^tLr>87r;k^$OEyTvD{k@H>k5Rh6&*
z2$<mrmNWGMSF4@z8wVDmpj$Bv8Yy<6z130};)ezuVg#vc_Nr`HjO(QXT-sHzQf=S2
zl&EZa8kF%U*<?M4fjX`pKYo0h(VVQCZ1ps*N1N09r*->FIM0-+8jF$}tfL@uT&#-)
zNh8madWc5ZEGB^685`(}mUkyWR+W%8He}~YMt#ULp_7YPh75~~s0EsmlIq0Y&aum^
zxjW+0+@_QEjJPeBxW)q+?^0?tCL=N()RnOCK(f3UL+)t}11_+OvA|qBJQ`gwlj?>%
zXbS-}t*Ig~Y(&A(cPX5rI#&k^)#P+55gsnCwW0LTCq|T#`HQP_ALn#qxcMfu$p#Q_
zn3KI~9kxtYEcp(+OcLdV$f_mSAvlY`**~i`5%skWPYX(b65^C~w(F8H@{5Jm0i)1&
zV@HryDpLv7WaG-*L7yC9qrL>0FSJS0U{t`oS^hJNYcMh9+dSW0<Xef{nG<M>4;y{{
zSYbZsnA=vX)+2q2r)o{j|Ko$1TEUU~oOKJVX-zdU$MHBeiPp5*g>~|x`weWKAW#1s
zA{PMy`}^Z-&2<jk0YyEBDkF`ArAPUW5rt1_6zV=je=fFEhnL3NuW!gwDbs^;{d>5@
z$#Q$D+~|UaU7kh$%tk}y(Zs%n$%E8efs{8y>`iZ=31VOj7mc%q7g<m;CcQCgKJi7y
z%V=mZ=b5@)Pl0@4K4%nW^CSxdl8rGC!>H5G!Ht$16d-(9kVi{up`@7ejqSKzslBF%
zw!5T+x#pD;a|}k~MS}8JXg)Glv*u!Wvfwn>5C@HnZ*Ri)ct}C?^(Ue}x|6rs0$Y(Z
zbQ#ZxC3ZAQB$Rv32k|A-t#<t=q5C&z?oUMnaT&^vW>;O$9nF@XI6cc;WqAj=cs)H?
z;$13^_>>i_r0XCz;&^LXxk!HK{kN=qJ|)G+h7|HXODU{vie$y?zPaPk0UPx=x{i(^
z#kE2uH!Sg)KCPE0%L^rMVP+=c@EP$A8`Y+bx4Lg_cShyhfX?Nz(xl{mPu`r)1vPUA
zOhVeQTD>05Fl9v|f{M<cb6d(L@|L)qzKEM_AjxmUvs-U*QzMkyt;aerNA;~@v#Iuv
zq6$Q+d#bMHru*WISm{gbWP-!G*Qecaa45JFnq(lFGA@48-|`ZAwsqzMD6y8;530xQ
zHK1RJ>0}gZ+65<^u(xKizZ+D&eQW3ZO5q51M$DpNNzo)je2v=vCydkn=nA-R-Dsx)
zlvgDftj2>{Lly@NO4YGJGBj_vJ$nO5nGOctzDM`~LOR)=#Gx_y1%K@*t>D1^%!wdy
zRiS)#QfDJ#^Ffzs^n$z-<@U~YuiGGF_r@LphTyzPSGY)7wr2U3F(ZesHmiMCjSZAG
zEWGsH>by&j)8O~5!6oTaj{A4ZCTtDz%b$gWd|R#rHiLpt{4aN1WQ3UAJxpKZj6T~!
zYIxcv2bu9iCRd4-%y(AvS{~#eg23ww8noB94W&Q31~4HCTsontih-@7Rog__$azbv
zQ_k(~;j=!1IQ<9E=#|0B_f$Mp<}i8j$K8@3s+|DZ7LSFlMVaW=(wggUX<0%J#UoFq
z(V$Pgnqg2)>i37o-C-Zmw@N3txH$={&6Ii)zDXWiwM~!4ktsILJ8!6SoC#94auMM$
zDSmTgfER3XGc}$D@0lB82!XeZaaYqtu}!40q=%+!Oqx9d@W%`AvY$7ELEXBt2gM==
zW!Ha=9_A}`O5j+SJWy_<_n`lkwx0YmTby#t=shN){3=k56LUjSBA>ekXr=rpWu8z&
zUXC8GRduLFE8pD2Cpg^okuBmGy>S%jepGeMJLRE@XGRR_98rdnk>0`)#d~Ln0EJY_
zLl)Y%8jm|;ALb(Bi}XpgYqG@3itdpJ&oX1KUVk@)sE}|-<&U+o*7AFyp!t0*eDH~h
zypT4yNLds2y^2F{S6J9sk+!Yf3x>w%NN}1w_Z>sGUiyz^{2oD&X9DI7u-&~QcItz%
z>|O8um2UCd;iWw583rgwf94m)aXfL6AgR2B@20y!+UUx!Ud0|-*>-(=?&T=t)&qSu
zHuKcqj%>V&N3(KM<K~3h==r=i)-nt8im<R7Qd)dO(KI`nZ$L-onRW&muf0i(M=Je(
zETe(kfx3NU(9}>@<X0(<u9D<i{3?YnDHo*k@;l9gyJ~**bE_Dn_SNrXMXkwHMf)Zx
zz3>(PN9y<9hMQh2bv64!yTne{?W}uiIg5!)qWBR30kbP&7(JdKyEC4n{!OnG<Y5Na
zdkJM-ofl%D@yJCb{1v(!h+XDApiI)Juiu~BNG4h1bmsm>LD;T6yd;L+r$}6lXsl4-
zDRfmz;rrgw@l=Czx>UK{TxVuLce>cv!w_Ue%Jo|r_fUF7RP4m@7p$g>9TuxVCU|*+
zOZisu9kDZgp3p^s^3r5}rwW>ULpeJ6B8A7^zTPIm>$wlUS~~7O#AP5|osV}#%tRdA
zOZ|p)b)@EIHE0>hgCN9I-?~7WRZ46^OZ=96AqEr`>+FCPRiefy?sG}}UPYVtHn{mu
zYw+nZ6umOe-wyVNt1<B3SaP4Pv98B<B^m$P7Q7mKC}g~^eHZi*BW7a|WeJzd;h=b_
zI)Yw421v<^BAB^%(>daIUyFTBq_YUN;n*lRT_tP0!)04zk<GZC5pJ@o6?XA$0K`T#
zS~y6?vYe#ZfU>`6Jp^M}-&>;a#WtTQrJWm4=Qp#>V4vBe<s8g#42k~<bm%_?z$&8*
z)rb;+M~J_hqX1bR5JngEVCiOa+^$Tl>5b){Fsyn=2bsyqeM03=HD=MDAys`AGYTyr
z%PtlVV3!EtJe$dl=ib_08>zGBNq-rE2Z`EO+Ks_SG-UaWGc}we>eMeSbsAe4H7lPu
z#z;yqaVX*i@8MSLg>%j6DSVHwG-t8c`z}A@p2=Ed!R-*oY8l9^(~~OG_;78BGClcL
zM&<jroiiTHYRPf_e6*hVX?+qtDT(U~X>C|cJ&C9A?=x+$X6n{9is-5R^()F?CH7^#
zO@I<evy3(wNPI_zD-q@i9Q!lYje&zIH8(T$*Ge%QVP6Mw)po-hk>`5mn_HMb$}(1H
zG+cFFe0bDrWcjKKr_yxHWINCV)7PXCu_z8UtEb{MO_EL%RPbQV&3&p8V3n=$vP?L}
zl0KRtiN!s>%(l?9VqJ~w6C%h8$@sbG>!+>?iBB@2GtadRl!vtx-Q^xSEpmXkxp?wf
zxR=ti%^MEyTk<v-wS_R(Q`#%5&%JHo;X5rKRbz*aH7xg@7$MhjCAvq_q+RzlI-{)w
zk?WVPgP)27E?>dF^iCz6I(BB99No{JT>i1Tyvq>ZBpUg(y1YSEZ!^Le4Rx7j))r~`
z!B!`rnqg~WcEiKD+In+-z@+mJ`bFqGFS$Hs`{#C*Q;5B8(>}K!ykUS?A3rqFv%^~M
z{^E3T&caj|xqFkyD5GwPWm+-;O2Pe(J<nm+H8)Pd6;yu3mSzb3z}xEMukg0*ieGq}
z9pw`s%4WMnWByBA4EnrRAzSbfG`!z`u%hRSqh9EoGmxGBP)FPoVjetPUjF2_|FW0~
zio&~$a+<Bb)&Q(Y3+9U&Pc;T@s2KHy31bWmX&#fMG{zZa;JkmS{1bdu0HlI;rt5?3
ze}aVMp`<s0$$0iw;ChpMytVxM1*7wlINCCXWGsDR5g6YMe-4F=@@rfviW-qeKnhBN
z8G4<Yq`}zk_t{8SxKSIeAogloZePPaLGnAdfD7)_-Lm_AINg6A^w(>cL?t*K%<D#W
zzHs?FF#dzXnPtWby^dgRytYY-a$_){>7Zj_NK$o;`p>rWW(c-f_VMdung6H_dUNG1
zEOteEg+FZ~OA&vYcK^?-e=cxu9t&b(WB;~A|AQm@aaTY92)HLF(iO1&zqu#t{k-<C
z(D9G&$d#`ceN6hGztK3qAzYw|kN$So-@hb=dxgS$llV8F^&08~U~hPJH8}+18R$7Z
z#NO`$n4A2uSd9l5TVNSNfA*%B8IVd1LFr$5{^)fnR6tg76A*5{C~hh@8G5m^`sgo$
z&RC%4!uI)9FPTV^A52zL1}wX}ELlvK+C$d~>i>cMA(aEFad2+Ew!dmm6k0Gb|G{#;
zd*h``tg}GTq4Pjj%k&8WpXn<)c=GZUP~A;g>@??gS?4_MUY5+fX+w#*w(rnZ3F(k?
zT8QF@9>IzlK9_Axuox+AN3_urSd{)+D}O}bnl=!;E}m#>0K*IvEFta?9ebRP3>tJ9
zoTt9{!S8sWpg8~#d?1glp-f1li$ZcWfTIO%j5Rkmhu5GS{uzU_LN~;|?viT^UzKhs
zfKpTvYw*)7HMX-AW2g`JFEoqbQ}y(R$H}jci*=iQ2v`gOT|frlBNdVvkp4P|+j&nP
zsM(rna97N@4y&?CeqrDr?}9uW+h6G;BOu^1A1^kaD6QY`<tZ#Iq%FlF6e1VKT<lm-
zDVBSzXY4#VN#+qqlC-K&q)Wkewj*uO6F*`|u^R;|kb3+_yb?&gC+H{GL^A+v?{{+0
zWD<E#&8rx__g!(BLW^u`qhAL)^%W+@CuU0#(s>r1MOZannBJSIyFR^TWw(7c*SxL-
zc{IB)w-Qw=pSTWq60mhvnNJ%hO^($GC5rNev(`1PuCBHO;OBq5L&Pri|FHMgQBiK;
zzqp{NfPzYcfQpE;(hVvl-5ny`(p@4Vt<oSR-7)0QC?MV49mCK$)ZOFJb3C4Ne(U$g
zU3cBJ?)M+pFuwD?dp~=>&wlFjdA>}zX5=k&##PFtiY<QNQ&2Yx6nKlDF_p2^s|X89
z;M!X?&2iIqRU(f!WqU+q{<9W9Dc4M+>}|fU_{3^>xWHUn7eD>thWx!chiTspA~Im5
z9Z$!xd$)%78(J<fQMwZyCCi>Iy_pinZJ(+ZZ+<fp!Kgl(CxqkH5A&`zZDwl@A!S{q
zwUmRUUB`5;bTFQxVPhLC`Y@x7MJ=C`=)Tw$XRexuwPa^ET%zj&L6q!NaB5fDD|Q7R
z8K=0j;%?ga)yhARWLc$kXlB;rHooJt?X-IEy2vME+(4%xZfOMfCI>k&!gdMEncn1z
zqDr;3k9F1?O=w0$IJJ0wrV~N97(p!43ig~102jrLvJBl-&K5gD+gT*^;d<bUMaD6E
zY}w!6yiuEMc&`2uL25XjrTCC{e@S-HH+ny~oX>S5_wa44{T_{eTMuK$A&tx*M6uw7
z5(Aqz#+h^Z8aNb~z0}JrsAnHpcIK?Ino>U~vgk1Jx!dXUhVY9@nSr8T-A5b4j^PU3
zSm_$q+OutWLBaC)n6oa0j!~EGm37U8RreR?H3ZJKm9NgKTC1zww3a8*^<kwe5_k71
zE6vABvz7A~TS7&c6X(X%B_t$VrBg+n68PNSUL(3Sbpji6u*9xNrcunwK+`S29>I;J
zc#n<-wKsxmC%zC!YB)YvH}0$InF^(1GoHN1bnhgcyjFQl<xa4aRHef@9pR1cQn%)J
zo0}p0j)q6Ql+S&kq$Dn@{eDdyF)(k<nTAMh*UsVn)Fl@)jasFk1Wq^S(Xi)>mkH>j
z*v-DZ$fbqBLoJun6TU`Ya$D+*qZ%z8FSUd4Rob41Sk=-D+5?6#vaae^3u0lYF~T`V
zUmT8M_w~IzJ=5sb;(3U2VoatCbb7Bm?a;%lIx<P<?zY*9%srV|dQ4t@ZvScL`e4WE
zp7Z`nUgJgays@I41$WD;&31V%O&x_;-nl7rbv9|hxeC5zGal9O5G7n_4kqi7ZexSz
zsJEF>-V=NA%{kk_WpM<A@E*wcrvK0wci>mwzovj!;qQWC%HD*!oR#zCHoYaP%2O8m
zPtN%#DcY`VqM<7>WoEg)G}v^iV$6x!t}6>WOV6%&@Z6biC(>Lv?aDcd*U|#P1%<E~
z*JVyL0yYbkA*i{Fk5tXc;uXnNKW1fy(~1<^kTMI_+{;Q(TVtC`hV`$}Xq9qglI}I^
zEOvnKwMKI=DPG-mOicA6y_T6TzIX+l;k3#vA1OiHbba2|aweY@K$^9x5v}30ttm+@
z{klzovY6(h#hIFwrA#lbk#hB)$T&QZj<2#=l9H4ld-TGS>}<P@F@l<-orsf0DJLUd
zP*AYyVA93H!U8-?y~gz@Q$C%AUL4!|_3PEaTvJ0su8HhEJe$S#krLC$r?)_ec5iP_
zF=-+9Mg8kl2sE9G)ujL34jlkU)ZK_W+F&^)Jixx3V0Ey`vd(VQuQ#3`&t|SNl=b}L
zg6*04tadof6(M24haW3lhJr5#5oeEn5^4(!`5=9{>UifJIa`kQSfW+v{RU9jZ3bKS
z9@QY9h$)A<jp0{!JnQl?x(C4^I4cvoS%{SzldD<XYb0YxZkKLawoV~(o`$`@Pd~T*
zt-eR+Xk3y~ETZ)TMYE-@yX=DWW$a9q3b7R?{o_42uX*cyT8BEZAqxqc1){#$8+TnH
zf=m&j8ue9HhJFM!=1HyXRzpjlK?I$mT2NK*Mu)O9f5IzMlEGYA7N?e0J7>Ry^{r12
zCTLBMVmGSta~r-ixRY^r*7wLB01BU+iX&|g{-?Ec_#Fx9x^+Wcj586;!w@c~zFO_6
zAlM*!irOBrE|o;@=fra<R{czb`ED0E7Gmv4i*ZG=Oy@YBk8!u3d;M@E;CO$1Q2p>U
z<Z@OpgIhPzDcX*K<ycYUSo6}3&X-sgQ=J=br;SUYXM_aS`#Dx04+n;hu}^r`iIa$~
zh0gqN?b*NqpWZR#qjeW#DQ^sy8J2NnJ@RsI=Vj}%Y)y*h+~21eI_I>Bda$BVYo)2}
z<$k!I&EFitoL9kCih*4j#&`LI!#VRt*GgY{$r36WhRTM=c)8UG#87!$NtznL^YZIE
z)1f?SliP%Z8ID^`K_qxL*N5^Gv``i_luncf*5GhPt*XOj@`JpP;J(F+sV2NOixRJ1
z71%FLPbb>%uTOAW%?dU~?ku#WH&BQKKa?ROCLS#@Rp#Xe+qxr`9Tx1I9plfWzA-vA
z<pEgqMMB6ZFPNXI$-nlzJH5Uxo3U9PaJOjbn~p)IOlHyg@qC+QSQx!>{mG`7LfAU3
zjgJ9QzINqeZzHBKsn5sIysXdw3`evp<RLZ2Vtx6qHuqpdQVCp{$472%tUGEBSpyly
zSOO%V`<QuadWtoyD}q6qPcu!!i8mWN2t-q0!3^&nA1vv;Dp)^oJoCv_XQQ?XMUC9R
zIxN>U?DO^Oc)Ig;{5hqUe7e*sdwCi&37mjli>HT_l+Sh(WWl^p4y4$%s+|{hGv%9<
zQrjX}KX*B2Fkk0dC~%rXn6R4AYjNZ&j_v!EeyXQ&<y)qp5=m!`by)5KIGNu3wGENe
z&&<0Z8%xBrMsi)r);abe;>0zdj|(Lc6KnSBvWa)CVP_9#`Uig3W0MVn{o9;LiM3Lj
zA;)&RMFS*z>!vca%kTq!xjWq6JwL0OdjmiYbaz{<M;a832cY`%WvG{|_Ghb|p1CS&
z#*u1k?@jFG^HV+SNzXQ254nO(Et5FCp(_G}%GJ~6IFM+!d9S8gufW<TJjhR6tX_w=
z7z2;ScD4UG2Q<)au|3+KkG5*8*26>S4J++Y8)I$NtC@xfdUcb*oC>oMCi6Vu;^l-z
z!L9^;kA+qj96b71w>yUNSP=}GG|G8qyRQHVG2*SpXF<QE1a`>)<_IDMu^{KYRpXG=
zw-|Ut8zYeP)etgXwY%FK6iiJShvj>sNQRGRi5A{(b(_zPb7z)~{GSt9>U7{L9k!fw
zXPjuAyJLv5n)a;jl}(+_9Za>WI_Jg~G4!N}r|u1LHj)bmVLj9+7y1GfCZ(Wydt~!$
z=}Y_AWJiQmK7Y)Ji3YmPNKtI1@0Lt0YGC62Cb_Wl!X6t&khFI?^gzMLW%zv;?vPR*
z_JWn%g-(Mcy9Dazs$LxVc5K{zX11|q;8h`67`>lgc5sq<;4#E8#jBYW>+Nm44zZHw
zC{Y!c=gR+>+6InMi$m;a29#ohNX#cx)+Z;YZ4vBoTt!Z%V@Z9X()_wRnS*dHg*-V$
z>6NNr1`ci;MA#$;?YVjuCdKvwdt6x7P-4%AXIIFUm8&{P{{-*1-~cy=hrJYuR+K<R
z<Yjo+j4t&z_B55n6cmU@Qcwhq*s}#;k@6&NV@cbt94wAOb+ypi4D{O?02j;drpC7s
zK~sYQ4E7Bvw*C%-tY+aLVxn#TW5O+s)B-||Zd=K`qco>h3~3Ts%|?%)z}x=BW7h=K
zEuxm)C`V+tv(mahestG>>czCUZ%#i+oqN}ZqO7b;;g}SDIY=h#>CzyIk#6APU8+$O
z8sOjbqV2;cl3Tl~59MSARw-&o<9Dws+ML%^Bg!PAt)*?<#M;_p%Jvv<Bp%18=aTz$
zm0GgK88TV4W~Feevzg0PIWFy+FJ2;E#8~7;9MWjr+nn|~MX)eOpmcN6=-QWpCR!Pa
zhKnbSQ`bnc^zkC;wNfq=cRYm|fF(mYM@8FR$qo2~dtb4wHCM-CYGg$9`Tam&P~zmO
z7^<a|yOpQ{QJ$<qcMw+P;5%KuNE$8VkKZTV5Y9XaiJ3UJjl|kBy-Y3icJk$*p=sb<
zWppN=DDz2F3_PaR@DX8$K>jaz+O;|sVwMb*l|*LcKOFlyUEqnHstk`%1Bd4ZO5+DS
z+-@c%yKF@aIz@!5QAS?)nZ?&G;n$+E-gMeYA6u0fw9|6g%r){6izaG&d>n^Sp9yJt
z<dmCcH+bV+dZOes3&q~If@~I!OWdcp_64?sj~_5Ph(1}4m+SB{pxMviLd(k^GD7rq
z&MF}ZA03$&nX-#ICK`>uI&WkpvJm^69Y_vmY%DD3TXcxdWLdXGe_S*uxfHz~>-*^|
zpZs+%3Ce<(BXX&(tZ#Wh5)bH&gs(FMG#ZEVe$!s$HR*WgN(|?We(FR6#kuQiqZQQ$
zHeG<{=1B`qn1LE4hL{q1R;m6@lfiWp>SNyzkuAe1b2yqTEzYxtQ^mt;e$%?>8|&5B
z{7z@l>65T?=%Bc*t*wIfYRDD0JnhG%>Z}f(3mQ3&(=m#){ZChl7IyPH8s3a8jrbD0
zvbI*T4rJsfNm2A+)jdtWITbtB4`b5rO=#WCO%KCtIN8#wHZVW!^{5zvY`7o#b>7<;
zuPJ%Ca3?nMIjcqQT1ljq!r+`ll*hBc)Yh<x0`snUeyVF{dUgCB(r2)#k;SR-2*ytf
z#akSVM!}VSowMVstVS6n!X-B{8oINU8P473m&;ilfA*IQ5vwbvyY)Su<28?7US8g*
zS*3v!iR&EC?y^{z?7K%=q~UW;a2nWGgo<HVwU>8GfOcqUJ&wCLE4-qiedYWiw{M|E
zIB~z*>8GoF77E=BZ)1p3MBi+`SBs#^Us^Gu#m2_g)hhUCtl}^R05w8@bumecQpRGh
zRy|WL_2lFP7i)8uC0D_Ix(+3ErJGb&=b4SS*tiah{u(6>&FbNn%l05QYoyA$CiC?8
z#Kd0MA}8R=X&<hQ5KuT&C*9oIdQ3z6xVW%FNvzmnWVljJRGnW4`09iJ(UXMU*d#6J
zsM4#-N6I8oSUcAoyvj0}gC;&3t8Wac&l)h@cPdE$)dmeJj0doDy|QDc3+@QJPY?1;
z?)JGJZHF8#DDNz)P0A27J32bY^V!X|%}i09WG6`;2iHnPrEn~Ih~sy~@iON}mfcLt
z!Nn~$9Lhtl4GHpxj%RPsTGkq>;S3lgby&zp6`_8qB~M~q5AzgSk)ea2JHYoPVD@kq
zo+H7wrafAvEV*n8Ufo*6Z~}|@TkBlgjo!@X)iEHc+IQ~~TV=``1HD?AtUqC{s2Swx
zTgGCCSKR~X0m?ajoKerN?3-308qN7AKUK}Zx|riGWM~yiRN@C|JEv;T8FYjWVX6Oo
zi@#v%ktR^8<nC7KLPg(`00;j)C)(g`C~nkL*z{|4;+rZpFO+~Q)DcI-?_L$LC|`t0
zslkR(Qa<I6M{9c?z*zH0<U<&WE~vxsXQX|hS^i3g(umLFtm<h?>$jY$c7G1(I4;H5
z<>T51gjq2W?EPQZ%t!n4G}RrN0*R6b&T$#LPxNzdXJClMB$Zsca_y0jD^S&`fkY@M
zC~n95CGJMMCI{;ip${aPO1FV6FNal<?0NY9?z3GX=h0$gVPYdYVK;ftG11nfPyJ1|
z%@@##Sd8AsJ0n)o+rpVUZ06qrhOut$&rbsEi5xwz(d%Lwy>yAo!uxLaKZ=`hJ&b+O
z=D~lGo$G?d=PJLFhZgs;hm(vkzp5>Q&Ut5mPwlCUX%LoU*?EK{36%sWU7pVfTSws|
z6IaS(9wZ*P04g=6vJDS#lG5a5p!YvNOJ~ThI!jv@5f;YX+tI4A4^=w6#^;_R3tyE_
z>uOz?U0qzvJ6c(hdW)6r=5^69*@U1rvYQ`%5J85F$x$;T+JywN8FogKq;Kt;tC3Jv
z(nK#BKfcJ-xMhqiN)@={gO;V3orVvDl6}J*RnjzX*EGL6jiY3?%@>Ol107w~KM-mM
zBgXMpoP^q$qJ^<OQ<V>Q*<HSwo=Fw&_*td!B_bkQpcJ2;PQEE@`q;|?cuDYq?8w<R
z40BqX;s|L4Jyig7754+7Bkd9s#oXYGZisV6OOF+?@_Wr5!;TaNP3Z1Lcx3DMz*mS$
z9fx<+Ywm&eDSJ|`)EC|>8JU{g_QjSX#jY*)0Hn~Mz1+{AFMFr@xF)L+oi>u1Z=uVt
zg+yE`w?`*IzOOf&D%Whwb5N3mINIjp5b<9-^Xj9E2%X(wz^2Ib?gBH26k-w?UM{X#
zIzOBXG3<&TC|(9(f)r6pyXuqfq-O(RPM2-{S&knC1(I?rp>wGf8_CwXpZXg6n%@*9
zKyCMwB4EUc3zQas$<gE-Z89f@>(BN!28@+jtnZmQbc}Vpp}o;Wb@F}zbp6gyO+5i@
zT>w3tZf7q4Z3H3-8@j!F6sb19c~{-Q<`NxR6iUYySgvS|J1fkIs&5{JlGA*LFo|A4
z1yT4?^RZO%$apS0npD(oWAkB*ccxLTD(3SSpPNo3^M4mx=G|8S_fMmLv83)xcYe)X
z#HZH{T+eP;?@J6>Oa!43f>fmQ@qB<^MfmH=MCu=5Q&A`|fK$|EagZAUWS_xtSftKV
zI+1=B98NOdNT4lodRp*3cI<_F<DqKSu1`iR_SAbNX0}^I{I2rFFMvh-qCUso9+Gz6
zmt}rTtNi&a=1^p_P}gpiRq#8>Jg~ROkY;vsL#NdDWCIz*6Sd~c+v_gvaW4-32)5sO
zkAbRod;7r8<NDEV=n!HbIP}UdTI52{qi0}Ckr<VqpZ^>%5+F7!-2YodSyTkIL#?=1
znrrou<{#*^I~S24tU5-9@A<~wLQnjM;?33RupbWuqW<yel`^PGzXDL9$dnh3QTJ!f
z7#I%e4^j)HSiXm!FL+%cC~(=79R8gL^p`8X0(X<jLhzr&oIh`&heT;yCXW5XJ^gD4
ze}1};1g}|9nEdwz&%pGVx`&Y{*WX0&$DensP*A)5NMtYm=LJL{Mjq<b1UN$feC*#p
z`2oR6jlU!Q&kKHK?E2SHi2nN`{WW0Gw_ro)B^Le~@BZ841ZKe~ao9g!{<%uOkM&nd
zg@2#wEhLPu{3h$aju1JNkI2SJL`G)+Qg;4_K;D;wQGN}|_|8}O`v8#p=lwMx>=prC
zoc~yi3ts>4Y>992f#%=0<+o3$Gs>1|*R^y40lQ&beynb2uNEUa-Mm=>3cq-V_i6F7
zmh|jn)tXs{b-m2f#;opdu}HeV9Nm_7r$>)W{vk_If1s=XfL9Al*ZhRqnX7#3n$Q6N
ztjReCy%(g-w@2{TFoKxt%&G3-y4ioLw|sx?q?MWF_q)jn-?`X1Do#YGhRpBG-h8;R
zfsl~&m}>z5|5)fsd%caa*x|f?x-)_yPwT7sK$5tQa`Hr+O^iqpz~6E54|Qk6uDF=(
zf*jp%8%s_byqc>d5TGr;m7@ZJE9wimD|Nybxc2ws0QgOE!d3W)w)GHNGnJ*1`r0Y5
z$C3yCtfPVA%G1wlHp6I$awAl`j?e4tx)zaVuSNhLV%a6%u1WWGXInEsR+UhS-3~Lc
zG)ukA+TuLA$h>sV5&`Ah%}`Ag$#p5T+$ja5BJGo8pMCuUJ$l&+M75SK?PsLlT29%+
zR7@{l^7ken*x)?ZD>+u>z=w0@-#B4x^QMQ<it^g7C+QzEWSl}NdH5~l8@LauWhEwG
zIXA?Frhmz=<Xp<R{eB6)D0DhOIxsVXiN!eV#&=?3Tf>7Dqs)+Zdt^;Y3(EIzKtWXq
z@iD@oZA4o+?rM!ATxrcbIi(<SXSU3A^~~G8&bi=6_1Z7*70BwnLb3A??Y#pWz<Ve{
z;;d>O*dn^^0Me6EV0P?(#AhZy+mt&TuUi%uP?eO9o8-QA0GHx~xb-q@rXqZBB^3_`
z+IM?)-7r)_*0k1Pd8rQZ{%fr6zAww0Al`=LCl*^b8*Q$XU|*w|XLH>50!((Q2zMUP
zfw%xR#izPIM%8w^@)g|2YAnbcXIR%YuK1{E!KzbslK-G#VyUBRorlPYZB{s-XtD?Y
zS+|t-q1!R^i%vc(!-;d~J(3WgY7UEI^9BFTkNSW)F`<1}yE@}|8jG^>(t`3D$IwLB
zh;|1*kA7eDI_n8bF~TdJMtN6t!C&4IJ=jRIUc^ZX0ParbJ|@ev#XsJ!*`97ZNQ0Xz
z^xB9e(45BL%FaMaFkN@_h$fy3Uoi`gM5X}$IGTQLMNw5yy^)?nl?%e1O$6_tMA-$_
z^LtVB&0koR%dDvLpT<iOm%gm=$l*?1sjgl{Th@UvIhkT>rmjE%*InUp`vR=&CBK<`
zRa6<Zd~<*urW(_NRjZDmtYSuH4WsmU#o{Jq$5lQY_qqJ*>BlS&ca<QYowES+@6!m}
zUCUhq5>n#V^BVAj_-hzKm?dvu`BibgYC8Lpq<nE_!QV0j-L|(#eDU~kVHuw3nMwW3
zJJYhjxXvlktd<G)_25E>xwa<r`t|OKbVg~9+!#5V3_+YvtQZ|{E#$a1(sXAmIyqT#
z$1;pB1>1S_ZM_PTO=f0)Io|Vi697>O4-ztFE8%+cpLvre*7IIxa5$dvU|E(uOgmn{
zoR5d_&TsEU6*(M41!8?2Vf;yF^q2VVuwIHni6hP`_Pc;er21lf6{o~E&th-FSyEbw
z?yxz%jVM{uZu#@#j1v7?T1JMuwE<+u!DieBQ4~)<zmW26Tl$=|)|#RzCe8V#gN;ty
zEE%-+NTvKtkx(u49f0gT<{wLY9kNK8&u80GRCCi!={W#YV!3bmQ?uH*x=193F0#>Y
zJp49Zl~dM~>enuO^m$@QJ!~gf-l@?mK<rj77NIVqJ3GaGJhLpKEW?4JV*@|t@!ioX
zox-Y4;%NZ%Wjip%HOVUPNdo}OCi<mHNP1B0I&GfixU}$<Tf>afe=nXu+B#zBfJrX(
zzA@l?WeV{8T!)awb)1FD13ngGrJ~2%@;Yg@x8sB@ir$plu}2HvWL)avia0UbM`?VX
zkT;W0)V)aE?mS2_bh>wX+s2?Tq_Acx`jxyl-+5a~&he2o_p-LGNRt*_834GkU<2&j
zIN28bv6mF_b+z;C@xB=S9O|YxZ&%h1Rca;{DlREj)@<DN@XPdNblBCg?(=>$M<oOA
zD|}gaPf`&mCSTu0VH?TMN_-6>(=DSZ`9>RrF~DHpUj<9MvHvbrM47BAMHG=c%#BeV
z*}n9WM=?99d6t&|FcdzKPY;)O@eoz06gvt`|JZ}lmS_D>VgR}4Ky}m9_X22)o(c-(
zxXgHk@XZ6X%BQuTJd8%$6zP2t;$0XFSO@%S@N<HACDfqHl)TM3R|hqwSJXSDR^=N-
z$CJ$IL#bg&X(Wan)|MUB9Pb>8#=D$#c*1uqx<?l2y?C33p2xy7WI_|e{ne6Yd@7%b
zA4BmEwL4AQ5bhSiU!Y;7bX&HM(FXA>&Hx{4de#w*%brNzf%FtHQ=x-?q2ppJXR35}
zuiKJ`hV$Bpb{VgB`ZVBJQ>>ku*BpCI0f2T2Fm@=HfydHDwE=mM(MEIzI2w%%iUGzk
zVj_95nv$qw#@qf*P5mFlGQTKZ;3XotInW*(17tbV2hT-nT92(I8!P}A*IJ2ZwN9lP
ztaZ|a2l0Fx#COtM3&%!euDZuip0;hzec_tI9Ez_s6N}LqXVCOhs!|MEPGX{lY3Cjq
z#xuAv^eV{9f6OH*Q+-+8EXZvPA(eDGbFSAx3kdhAuu;^8ahdE3d<zGtNL+$acO^;;
zb=p;4!{!S1^HE*^8V?TN$(FGTzYmqA&VRy;eNuxE3{g81Gp=6jrp(nFhA5#V$C>s#
z9)YiSJXY2?TRzI3Fg@f~PWRk5qEj<c5ZAh5W*`19it-7HwLtov2a-ThF5c>Hbv)YU
zxTgI|#U_Gvo2!wRbxgVKvKkGcUkH5!jG3}oMvt@g9#Qc&lXgJxr$&w1pS1w2rE+PQ
z6Paq?;1=FwCa(bS*T&n%;gkIHpw9<3!p&4<Q)D>Hdajb08uIbtiw;C3YlnW~Luz5H
zLSu8|t5=-0s)?9gjyc<`VTIW-G=#eB2QrUgP)dmfWs9#`wXo?h=GdOj7V)8wPqii%
zJ9QNq9nD|x(ixU#^oZP)eDrMZbl!0MCj>b2Zr!!zewkE26!;Anwe{>oExF<1*#x`(
zoUy+B;8(qc4}_IWhfn)K4t@eReA51&T>b2l3BjTH9(t~D#vXbc9FqC!eB@!<_)X5W
zHRx%PQ0QxlJfRRkt=2SDVs9n?ZiK2VvtC;njg}{u=qtChkko{2nnU%44pXUq_8Q&?
z-7Rm%`tL7W5|C1dPYKm)!(wvVj*-MfE`9qJTx59zXcT$PfSJhZmG4I}vRvw}n0n35
zDMeXlv~C}R6c>xVQ$$+o4t^&r$LA7N4rgYf>tjnp-G0E3*Z%<UN|Ti>3VJS`PB@(-
ziR+aWPn)bXWS%Gp+<bKhOXh3!!KCqeQM+|mOiU)cIH$e0h>0F@R;ppVo||cG5<KoQ
zJ9+WaO*GZ*^Vvce-c82)1oQ6e0g?G_oV7b78#dfl3CH70<s39;d@rp8!tYhAt*u!b
zw8>2|O4pA$%~D6zoo2uI-cRUH{}K5f@gS*FLOz9Ifi&>jOYvE9)6FGRijC!N3#hGQ
zZs|f+id{0diY;U_Fm7fwCdp)S(BN8YR-A8V=!;P3zQlWUnvq+(N)Q{R5cVv(cJ2&N
z91vya7&e+q`q1?!nNUhk*cvPj+GtgLy3D&Wlx(3R?ixzC^(0gRI)=Y6d$Idq%DtOI
z%xVUmQIWXhWO=(fa><N)V>PTq=`lN={-73bbivu~C-~Ap6TfyRd8P8^ULZCLZJWzv
z@Q#;`EKPLoD5)i{?07lnOj%dtsnOZp)8+Mmd{$a~{F}U{Felxx_nSsSOLi0@r-bUb
zo$=kt9~(}oqXc?k`i%eZ&v<U3RQg3rWhGl!;R~^lwY;}Q`d2CJC<CPXjMHYPszOcU
zG^b}-D3Y$1S@ufKmP3Z#Wu5hyw5Qcv56HSuEI-&T_K2Ur8nSa}9v(1{NV6GfHl=R|
zF`FOe&Yg=_Z*!3=H8V<IR=FyUG=bzE6oCBxT-{LsKGkxPCQPX*f;W7&c1H60au~YJ
z_Z}jiifE;`v1Q}SS1o7}IbPx0Ia#DM#xDn+KO+3c4DQQ&-n!j#DftiTKDDbEhi_>@
zuSL5EG#16(X41w8(kR$zXi3~mf}ixg<O&29!{1!j3#j;jCa3hBpYZpujcH|yJa-%z
z!$@lP=VSX0R`LQZIB&PQR7$`#8#9XHN^Nv)e@^XBd&KcQ@I0@y6p(^hi`t<y)9s6h
zuu1OeFtuI)5b#y1<eay5e|Ori-g$w8+V5HF*VlgUdz9sO;}8f61|0j+8cvG;D%E2H
z4)N#%Ddqqqx$M9E{!$JjxB#&j_)n$thXjV-TmWEljt;t8|Ni?M1vTITSS<6s-$nLA
zf?y7p63u5>Afo^Jd;nKRfD3XhJKz2I!QT!s@SUe52(kSC7DDO60^`%EDOb)0eC5s<
zWX0Y!`bXxyi~)<CVlVxCvDS_qH)Ef(ya4Spen?xO3IE&2!pP=TARaFTyu<CjkX3dQ
zwOl3AzK0vNBemiolSkDU?vK~JFFiACTMXkB37)2Xf?isSXsR6D8Q2Ud1|<OP71osi
zIhCo?x2RgA$7)IBKG)RiV{;LUG%z^W+QuedG5^Ve32Xm!WxmM%8uy*pQ2AT5yycc%
zTgf8vW(Nwl%;`q#;A+d-ZRZ@Wug-&DI-GHu{*jxO$F@{1$AO!wivT9PBylcz6)QN{
zX}f$V$HjN(7XBy@PcHhKOIJt;;B=}*<>iaLLY1-*s#_YxeHDIIJ+!h#wnOo567oR-
z0ms{+*w3EjuX;!z$W^(tQTzTP?Q+xr6`%YJhW<|XK(mVb@0rsflhvk81dQ<syyjy0
z?)jWtTr@J-A^^u&dcN7A+@W5ww?&_~v>xx2@9VSj{2=nUq8u8}?_$t$!r9Z)LqAr`
zuD#Px!F-WXb9K1FwA5^bL6c`AhBk6v3mv2C)%w~q<Nfu?XbO=|Up8^5*XJ(&z%!<7
zZ*SC*iizzvm$ZANo8Iw}V0Oh*7$%@t3JMF8@fBFE2WE0wFYYobJ}}1Fzvt;mkGcFA
zzPjqXJ|0cEvj}j_#YS#jLfofq<%_LuEYmWAj^*<EYfWa-Wc&t^clqQc&JWwaN5_$`
zLIE`jYB!r5R23MAD$fOgeZC%b)1ou7R^atDeQs{<##cD=kqfPHV_%ppCtZ)iDXR^K
z_Aj9<+Zaj>S&mCQZ&vemn7M~I0EHO*ZtTL+Z#_6fRUOIQ*l6h1Mtjk0K;P=m53?MS
z?!gnBq>|fXInBE|;U=ZVU#0*Ook6|k<E?{9!V?{U8#GtAHJ-H~K1H@&*z@8vM$!N6
zQs>;{ydRZ#B)#Q&$;+*$l+D%Kh%vE+LHqpIlWEm4n+=@I;Qp&o^y=ZOtadp!qxjsm
zzs?>(7`36xni;QdCcI4B?~#=qt#KH_vQsQEfM1r3!Tjo)!{TINX=xaRyGi4?_HD+~
z`%2)2-49=UBN(D^Zrxf_ERd;8PuK&Yn?BI{blyKTpfiD6*D_(GR$;}SG@<W#NKnuK
zbRRy6M}iZV@2Pwo+?82~U#VCB=`g79F{N0zabHsMy@}PC5TTvj$Im2ecfG1zY!N2?
znN+?ksvO<`g4B8`FrYM@Vf4up#HX&S0x)L|kHKAes^F#0&~&G^LCUr;`6VbFY}OTk
zIX`uB(kkZmlsmO$eESwM<pQh7W6ag4*+rC?f{GFN=GqQtT-*Rh1wl}E_Fdwwc|Tpi
zlsS-EDnAry%ULwf6g$=-NdR|qu~*8K9lJ4Ht*hR`q<^kjHh9T;ezSfdfMA&^&vMCV
zbb(g!vAy|3u@xx)L?lR6V1#!tPDcdBGMNYe6)|>n1%Y7xn(rN^1m5DwNc43w=xAc1
zrCr2Y&sRx}xrf=*TC&hMd0IohvvB-{j~#VfN@@fzR_V69&O0Y&5A9M%ug@g#gq7R&
z@R+CB!su9THaxN%l=8GYYNXHwE9C<2kjhFY2&k%rPnD_jlJpqvX!?su#~wnSK02Ku
zPU*c3Nt0}e=M{;&9EAJ!(7Zv~f5v`w`*UycQfJhnHMgmH$bvZjWi+jI?#)~h_B`ph
zLr6`XMHtR=+n2^gvNvbSC9H_moTlWd&id27FblZ_oPx5QdF`g!{q-Ahs9vU>@Bkiy
zn>QaXES;N=6&E_gq1<KWe9nh5`R*6-Jow%3*Rhtx77jC~OQ9>Z%z4m#VmCx6;2A&0
zFVUZK9(W|Xi2zu5es^|gxd-)5fqM+yrzfC_9t{=xQqMo2_9fxaGq=gKuJd40^h3Ap
z{EL&$T@!sagZ(W7u>Ne7imbe1Sy|b%yMy_s*+aA!NpIgakc#D*EAs<fNka^pcSG%Z
zWLz|NuGE~mJ04!wGz&TxQL&C5P=o@cIR+OA3c#P2dTiu%PB_P)b`L$xmx|kz@59d(
z3#ZS=#@(|@tMpBebO4y&m-TBaxug8>C2f;~V7N!FidybsoSXt!Zd4ttzskcMbI@*G
z<{*PLK5_!57C51@0=MeNE=uyBTcP^ztV*5@dJIO^#IYEj$sDRY8MCY*%&R<#Zf0yB
zdw3OOWG|wn;R!0mk2Yd1(Ite4iPPH7uC0A$DeGOJnQz<BcVF8pFl`-@r#Uz!U8Nlp
z3zmPU<mJ~O<c60rd3a#L%58PB-0^NR!hFn>X;p^5sjwA8c~t`vVID@B^C+lj3AA~!
z_b4+i5$YSOHH;K90Nlc|HZppu(SG4sO3DmQeN^!Z7Rj$0NAooHFv7D<j4_Cg5#f(A
zl9NB<IS-bN3MI8pW6)41LhSn98c3HaeQRR2tQjQbS~bu}<C<QDm;|YD2|ioKK^4!+
zOu@sP1267pRH#{&#m6&dWg;V14!c<u8JQOWZ16qpvKp+9&0pk?8b`_SNW*zu?A?Zy
z`pe2&8DgQmc<KZ0yDMQ9RIg5q1Ox>gF&Kyu3_=k(s)~`%rzRiqwL><UTxc1j&eOYD
zHM|TYpSN^E>pf#f(nH4B&O_O?y+-#)j5$p*+YX!TO#7{;;sMBRAVX7nNMNE+;C$$j
zlHN?YpIFh&KP?lGAbO7y=OxV`4$d~ys}CnlzLEyk*PL1l`iqbr4;W$y&^qNlT`;*G
z!}lQ(l-q8c4^9K5SGHJFOn95N<I2Ko9}Fs^<hos;j}^G@Z7+5#M-ie4&?f}m>tu!X
zld~f*gS7HxaeVOFLxQB?ZDG_s{#{SJA{C&c3c7+bmJ@YitO5#mx!jN8&ZN!{uWYuj
zggRTZ-sgDmz`3`Je^}q2u`+2XZQ7@YDfdhf{vl-2O|yr5f^Iu{sqzSSr%wWvQJc$Y
zZJBDLRyQWR2A;Qsaqs-7`6XKNfY#$=rm`=v@T>tDjYU`&Uqp)g?u7l_hxaIO=3Zs4
zvgv~crYw#fAHwSh@tl}*2Rq9_E&~-svlui8NY?42B4#yBBC~Cj(TuxEj>YC2;O}2W
ze9NP;Tf`QeX!6yhigGlwbEd>?wtIbeS|oed@ifaqU3!ehs~W?!n?gwUoF?7|(JEwR
zy(Wy%GMJlXv3Ro4K=Ur;Aw({zO}R#1=Sx&l#9TCE&GP%LZg$OmcyLHMtTj!#Ut(<U
zL+sXgua%_8_FoyUIyPW%j5RqKgo9C<pfWJzrESi7+!lPSUmc{}t@OB6uu@LtiI-Hk
zfs)hpaJ==2^Po!|N_47@Yet?3SuXfKee9XqmdNMRD9e830?AsM7N{85v|>8DOWLj@
z8SLh3iXcdmifcx>LAkuMf6%$%Vq|)<Ul|?;mlP5LwA!P|Axu6&UziM~2(+7JjTa-e
z-6S6`96{W>Oe0{qH23I7Z6D>ztoS?Ut={vm&A3<E8o$gJ+N3pMBDcqmMLu3@GV+oB
z+-#Y7vt#Tkwrf;YCQktxHxgHbx%@KQ|5<JDxs;V&GFDNZD^#t<%-(8H{|W6wKwe>K
zRl8@ZEKSIt2dFzRR7l#OcC`CbRAsyO&-|lL0^aiRxw>^<fi7mN?5xApEBDt-ZC}pl
zD`kRiO_rHzkl;K``Z4?Nr9^B><@SlH^__{X2Ys-G(<Iu@-&@dqcU%OrFj4{zPBNiS
zxsc?gWCSSspNWWyo=dA(9%B;hRp1k688nT#H=+hU1BeVQB+66DIg7<)wVBVxK%PXT
z`LNhX{~?J>__P7vr`IbqB)N`nT0NsIhXfkM!iKAK;%>R)NJt+@_Ul;)3lfgmnF<;b
z5Kx}4Ue?eVda79dW!Rl^xoAspOp!)#;IrL1?VO0VxOBH+%t==4jjV#VS!T4eJPu6?
z&m`1w?b#(2rNa^)Rs$d<47TLYXPTv)H=a6}k8pQO@Uqmm`<5j~*7Q>UWsay*U+bX~
zlVc3sdvLH!_h5WY$0nc|&(VjaVlHL%*KiH(Z6fv_xh2)x_I!({@O^9){He1e!7O>S
zo5X^Enu*K{G=3*!)UHZ2bz#uNv(&x|_ILM{Hv^^v@Z-@jC?HKq4QPS3uZr_zohNS$
zE)SOY$H(HVpc=*am70DOE`r3WlkJ>4TuMD|t33Mb_!AZZyfimpN)ECc3WB5J&Il^T
zah?ivdHBN@f3(}9wHq6?XS+KgU4m@A>!?_yk7z*9FI-(w5bp{n@hhXHQu;I<>xE9Y
z#s23dvV~U{j%cPUt>7kZL&wuKK$*fH#Zd1YOrKTj=nUanD(cOg6%m4@xRUwx30i3@
zMIl<2_p4sZDg$nv%5~x;1$NV!IL$+OYDud&qj_TKt=CU<dw7I26%QS|I=L@W!^;dN
z5FT_f`DWZ`V#T+4pO=c7kacIdi72)lF4<@HWwDyV#23Iy093|!1;lXhY%d+P&;JRx
zepjAxwn=l^bq~|X$E04O(@lG@hHJG}&)%w;?Tzk%7c<4h-nbC(3@K?<tiV<?E3P7h
zFQCw(Kir1Rd~g7yF~rhCUr^Di4JBi9OwOPh8^cgl%Iz<f8dIfC$qW_Ht1!7w$5Z|-
zCbjNxni7Q<4vpjiVqrA7UBz;*db$tjSt9rb`l_Yv${_)!MGO#N_yyq8)*!m{5zCKJ
zq8U7)uX43_A|KQmF73NjIuJ!3U?^r8-_3H(g^!Z#S`zZA&Z({JJ_5j%pFSVgjl@eL
zTpZ{UNOYfLlqb_1F7DuIqOCgr0zo8$vMl@8z9$&otJ&i;L`g0x*AYhLx3&x<;&vC(
z$yfJfNVy%NnccE_3fFB|7rupPUnd`}QXCuIBj!6D$Mh!%Av*H2K2R%hF**9^W0F>$
z<xhO&3fiiHlKWXIF>6S^p~;zyqW|QnHfS%NiQze3MU+%r1FFh0$=)pvriyH!K@0;=
zS8bZjf?F~3#tQtf6z+c(@8ZKWkR)f`miKwd+67l<Cn9At@8N>DE&A9P&<KroOw9Qy
znd1b8m)44@lwDVNH(qP2x{z|<s-K7v|BzC{Z@#7s^O<Q2FhK!5`0IWst#ZI1JdhiQ
zX1U6?{<hl%q|?{HLMa}psJp;(W?UvZRSE2USzj8o*wSodJj1aVwT$s<m)pUfsE?7N
zNwR6kWWZ8a^foL6apoIYRz|}&HZry`TBDet+c*JD4cO`HvU@BkK;ZAhoUU0-EZ3i|
zatylfz+0+~mKokbowMInF{F3ZbWeP%kQ&qnltDD<!Q?}GJYIpfKD+FaCJrO~Q!(v`
zJQk1gpt@P3%au$(?3xv3et9Q+ji<IF?4(gSR^)KM#Gj~A;J(|^zF>dc_gpehU1P?U
zTj&9@U1UmW9m13L4DFM=3ohahGUvJ*GLDG3gGo^9>`;Z_toyxOU^5Eik08_;LlF-$
zR5FG;T)}*XHQ?N?UCiMnP&t?zNbf>Zv4T#?VYY+Uko8wgrdRFGR%LnGUJl_ei3l$d
z8i5Ol57xaze{Q?)+WD`4>S{sc!-@X)sL!7PkQDz5>~|&bl(>E&XP$n73L*esM1tJ9
zwMu_sL3{t<(l^geQNz%Z|GM3ZD9DI#aS=)U=$ZSEaLhMRFdXLI5xpOc=l^jd0j^t#
zmw(=(7g9HFjMKNX8-=U~{Bz7aPrb0>D)}2GmywLN1^PfWmb&h%a-&|o|ICwLAk<4p
z{vQt(m@Wl9O&#z4b(h~h0YRWFE9j*D%TIrVwNSgOF8^D2>-%?d$mX+I1-+mM`L`SY
z{1e4U>%W`NX5Isd6h)O4Tri>E(zAd335t#K|Lgz$1moKNe}Qp_{@N73eG<q*78w1x
z2kyvvWn^Tm$0bmQu{)^N-W$sEc`*7m==XX3;0aPFx&eZX7rl^JH{WY{s+l=uhI#&}
z{?|#FMAapBRH{w%Crt3Fw>e-_1GMKX=E|`{+He?bAv3`%f0vE_{`JAS_vaWA30xIn
z`3|TdkF|r=Mpss@-1T{Li9J(!=ZOo>M2%U?XFJoO92JPpSuek)h6axL7vbOK#1tqH
zaSd_{ANiiCXy1AG(5SEJdj2)X+&3OApt$zB(?Krn6Xm9}4XTcLKo_IQ#k==(XnoEj
zj>oB?i_zBE<jbI@kUzp`=!*B0>RIzFy1e1=$jF{MlJe_xdBeTnY@Vp+mKWevT4J2u
zON<c5?+o$tbLyTHECa2OO5cTqc(lm*t?L6~`JXHP$0vYKy|#SK{;4YHY^$PJS1FUk
ze}<?OKOh@0>0jM-jU;f{JJa2Is(V?UO4`=JfqZLWSx&!oRhu_~%lNgukMGo>+v@xQ
z-$}Wa_ggy{JK;%vcXaK!{i$=5;!?*8e9Rn;t>)Jikf6odlfzmu{gW_wUf4eH3Z)ac
z7T`k&WE&6dytOXg3AQJZRMNLS(%iCNljTvmVPKIXo|u{C5MMi<t_Ber_(+Mouj}5?
ztDR?vgO!moLx;WyvD5%s3iVo=7pG>vgF@R2Ta0Q2V>YCU_0LGcS<lsK`Gj^VBM%OU
zSgpV2s+Sd8H5R2xvzcd99b-_sB^aqF1Lmn?B&;^ZyLYFSaLe!L70>Tf_jO#TdIIXr
z(Xzk?esJk&zLs5EXtT;{C+S$0LUz)c!D*Jqo`(AFN!^*7?1vA)n(f#XyxVy3ct56e
z_)WiV`8QCATz%e20>P(KBtBk`8*_7Y-Ro%xPfS#0PRkuBXRUudJ39;IKR0WUOC36c
z&_CSVrmfa$g-3`)Z<D(--3zH~uHs}?K06KZxtxGS`f-B#7?E4~^mYE)1f;FL{>c@r
z<K<Ibkq|m<$eEbTi-XRtMMjxKo5=OiydZy(kTZ)aKH{GI{N2^F-Zr;{mEDsqU6H*O
zUmuFzYrnm)ULqh}in#f*7Z0@dEA}+8XpiB8L-K3ba9^WdbaM+Z*En~GG)y=%U%ZWt
z9g-}9S}Z=cmtX1Y+pCKgb#~UQy=OWNvZ=ig&yT@)N}aKc2`?*!9ohXx&LBFPbxGcs
zXNP?QtdW+5vzArNqUhfMajMlfZ+l~n^tBO8M<=}9eGn9U9kX&VkQ&D$u5uZ>_SRXn
z*kPFmbZ%UgIq*X9Y)@@hymp~AUUJ#H&3EG!HXv1(aAmK{{`Z$nP7&lfGF!!$fMrUH
zT3@dmzcF0Xw*y|In(RUYG}`23-6F#-S%Bj{CBefpAI+nB-1GQo$7P{SxvqFZDTQpz
zj%KRDFhQAkD0geo(>+}(UeuWsQE*q=3!te;I>f^0?0|U~hNtGVRE-V58dHf%1JSk8
ztYYQ>bIJvrW+~E9;)B9ZOvViW2OsDKNI2DMUQ+gr^O3U}d`m3j<{c2`z0a!yVz_@-
zcJIZ&0VIzeVeviX_VnrN1e1x+a^WUfduD2-zUk?`vcLn)xp&PUJ<I*|$HWq4umbjO
zJEw<_=g!jMTO^hnvmZLq-iF*RdD-zcTlv|lLUx8++w*oMa{lpJ_MV^vcIMJIz9NLu
zxQCO)x>EtX+GP7PE^%DNO7zCb3C576+#|zmcQ*Jiw`B`PvejS?mhb?<+z=LN!bBls
zqU}nNbeWr6Dkm8W{@7n<{~t#JXv7Fe4-Cb-z9(&jcPk`Dtdnbx>pMF;ix>UFvp`#(
z9#PeST4$}Km-=veMQEUR@*MxUL5jtAftI2ho?bC}PP4}c8rVtOys@<18q3j8LU9ZT
z=@X`N)VC_!o|`?|NlH=<g8O2V$-uD;4I}Sgu%7>B#k<y7{m?uA5>bK#A)FMV?^0;E
zfd`smt>(6p`2^q&h>MnJRAJ(=xqr+kNP5XgevO3Bc@2B6IY{!Qt^Mx>BtZWCo>G)5
zP+)Jw-nfccIhZtnBQ^5Ld2c111fAHFK@}<i5O4__qi*A6$#!GVJjVS`JX?|7-Q5Jx
z+LX&Q&0FI;n&H7}<6YXIs=D!Aa9n&>bl=E>s@~Iky1Fk9;3MV|@=qoY@3o!t*_%x{
zgD9_9c=l=vIXZ_%rkHD-{(v&4-R##S?<?EOldsEc#)3qG)a=9}=?~UPE>4m02#%~L
z*WMn1Nb~ni3MOQn?q=4Ss~kAgoE(W@k*9T+_L%kN^RHYECnJl84dyBN1XUgFz@{RP
zcY&68f+0amm|ICf1FJCJ!AFNG;<~KN`s|Ugb$+CT?dQg_4hS~uQ^Xd*p8u=``2DcR
z1oj-4qSMN4P*71`S4bfe=$I;YF*d?^ca0M79Q5t_7Pex;cl%^NMcZS4i=J)aU<4dm
zgywulYXMPFQ5Icx{rS10rQi_BxYoIQNGDxV1?YSX+Lf0~Ve#H+6|{X$UkgHT;R8$8
zgJRg^^;9ckczcSJCZItu1?3Zm+2ZK5rdFQ>E}Kd9i^l``szM12yN(so=R=bcF*75b
znr!EgLeungh+YR`G<GAS+qcKPD^HW+?RCXdBXaU7aw-Wco3>>5h8v4S$E2HXT_Yxe
zKjIKX=nM}WED|_(a#m_RI1V)x;WE@wR&yQ|wb#{uw|7L%zh{C?0xhh3<X!H6H>Z1Z
z|FEyWJ&`I~^7Z>=Q@vlmgcXOKJx7pmyAD~rTp;NM*gJ?Z6KajDP`&JP)rr*i6|DPk
zOa#UjY2PURV$J?dF=Qeus0aLr{v(44ZVTSMQm08(*56m`$7%n56{%O^qELRH&QEJ@
z3>Pr0$1cVF-#vu)lmj9!E&z3Z=OVfWhr`U_hdHX?_-_KHVv}<I__V9?<5acEXY-`O
zroSHvHwvBu5wSUqs<HroNc7HhoepSKHg0XVKF%OSs`tiwpPYxrx1ih9JylHa&0fLf
zf80P6DdWsc@hK3m^SXrVJQ!jrYl)V~++Fms8W(h~wBxg%4TNN4I(4@!&LPM6x5YA(
z@FebLvu{uZy>e0%1j5<D4WvuWf~nyY6t~kCNU%^_uEKPXoi2Vm5Mq!ECm)IA<GF~Q
zv2L^SvC)hNkUdG?eb*3ysbiQp#47$*)c%i$-mybM#Pb-d|7$<7(Snq>fiy4X@8-_W
zG0Q0fe_<8T3!IkUNA!JwFCbu8=KKASSHDm6$Grc~4ncGS_2T7SSWmKxa{}egUs>Hh
z*MN-f{X%`^FtTg$ofnyPK_u+1t{9Y~Tn-jx&wPXLLuprn2C|3V1qL#W?ygVBOE-m_
zbFMu5SaR^~1BKmcze=sU{MKxv<P|KU?aA3jOb7UAWKN#ZPblCoGP;k{kh1t}$b-EF
z2VfS}N=$;R+6QyhFJE^yoc&5YIXOA{k+N-q)?807B{@0SN0a~Dl>k%yALba)7NQA2
z%6&^tI!b^$CJKFcY%G#melTixp)GPRMddLiezPI|@iD<hU-||hh#ksRS5A8BgNjxa
zOwM2WqW)zcM)<^SVqz{gM9w8sC3GxGrSt8!uS44893E#paMm+Y_I2O%1osC|=7a+9
z-B0(F#Y{TG+e##3OUYdyDLl3+Ia-6v02&gt!db@TYHAp#Nbqejk3r$Nse3~H7L!%<
zPZCc4#ictD0WZq=&G%oBr3b#4fuzSB!-Z4l8y@@<RZcs@g}NOvta5jTuS#FJq75nq
zS`N4PDSO(Md#2v_PRV#*37;OWa+2?gXRO(3Qpb59!R3B(NMd=d%Ka2kHWe)XxeHJh
zWE?h~QgVFcc%%7?=znZf0c*5!bRFwPBP4a#ef321v3+`VzD%{-oHmPe+BH?%iRlv2
zdb><+hz$#iidc4!dn0i%q?;Y=$*{rPgY`=9@NeT8vU7kisOu9aXc7mZUY5@scTSlW
z_$52`=f+wmxYPQo79Dv^c!|)-WGNW$kX72bJV%+$$T%dqcD6q@FBQiXJLD%-KMZhZ
zS+dD#D|Iofrj3n_#=00#IpbhJ&i&u_zTo!fy{G5HI;xuY;oRd;yh^>6&(}!?6F96s
zi$~_2J5_P)kXe9;lQw*9ZP)U(?c(roR7$h8ot>SP)pO`|m)~tQFnmn33>5RbxE<dI
z{vdJeBHvCsB$P^edv`ZSyVk4BA<5T14iJ&Nd-v`N>&^jVg>fH$T6HX&xx#LRpx>?0
z+4c3CxVDYOw0G{*?T**q&5ozK`ut$I2O=J6fld4l{x1tt1mZJN_yj@7eIY{8ojVqA
zegd&-`PisgX<wEig6A+<>9En0EMnL9G}+$wNcQ5Dni}_0Xcs?u(q)gcijyzcz7Ol*
z3yL!4s{`2%GYv;z+pbpZBX@4v#U0@HE-xQ0CD5W?yqK?5ZDIzbGn<{iU!o^g{JVk#
zYK{yUno1I6L9QfOwZPV_d)DaM;^JVAs*Skw#^h=0XQ2Q#%gJ)R=e0hVOH>>w&U?iC
zr@OEseGe8RnWd7U%REPV*&ir2F2%5R4{3Ysv`~>BA01VlAv}k)TqbODyuH5|CIo%r
zuzGs5oeHR3UYhaSt<Hm<=ycJy%zrx_kc;4pF)Z0`D;ET9#B(>2Cr0jOBE=VOb$I8f
zozL^v%Mv_b;}x2{=5$lpv6luj<&*7TrQVmT4Uc43vKESsceIy}o<d`8h5j<vIulgi
zPTzs8Hr<jL!mCJyVu=a}Xjsx%JbGp?*_aMN!wdDLDcO0GF55bDJG3K<rprB_b|obx
zF&j$pgPI<3#=Z9GY<;JHtmca`<N<Je0s+Kt1yD~6hDdt#-ie7*Sbp>JgEva#2`K-v
z=U~VZvUpYsq=9rxrW@G4v@-v4yp-Olle}s^LkIas6y=B5?p#OGv!QT3``vx|el~%B
zO7DR44ZoAg^uKDpdIiAwMx4le|G&;ROyu<b7=q&^RG|R836IU?j@S<&iTTY{n0Mbj
zy%Tc874^@4ZYfCUp#qfwFaQ7rE?=YDYw!Hk<|f^4wVIhb?*pw2RMGzN$dq`2h<;d1
zJo3E=y#IcR)<b2vM3<`b&6~I3461Y#^z^ExA3RaJd%LBJuu>lX<M+df7f_5ycvk2D
zk)PbdY2~apknFZCisp35*n|cKvhyzrPS3Ce6Ufh*TQGj#cm)8nW@P%189>rN#EfF6
z%-(yH$UunhuSDffli&t$@Js~K<LP<-)2g5cQcsiS5BN{3LK<mRjPx@9V+w!lf){;A
zsUvnFj{jv<>>(Ha`w;4MDP9;xQZq2D7e+JS{1P6%;KhR1J$9uU&=q_??ft+6#lwui
z(NCmtC!pGGE%#cDaKztQBZi0xSd#BPn3dfVMxstZIoz~$bYT}`Hn1cDE`dr}SHMK_
zIgRD7Vi=$`VhO%KrNHU(1*A{|z{u3U3Q~Y|A4YZ3Bz<NfDAFwFL!p~ssPxOj>L_k>
zlU%8G>yCXV(oLX=oHrYCvtE{B5*GwY0KHt_;Z;XG<>sj5%WmxCmw+bk&o_jPKC$eY
z^IT#Xwlj`S-wiq>TB|_C^Fnc>0t@(UAnglFOXaV;m7&iTZR&3(&GbAjgr;8|=_WdG
zg)sdh(T~)L>{p#*6WKAH+Y;HaoR1UPZ?>#?FM=m|24UzG_Siwpz~$3gUOCZlH(u*Y
zz9O0!LDw(>{44ANZm{Iv{N-LZ9$i{no892bfOZM-d<r|306jmD@WvOQX`)eEt`QP>
zq9NcR2wk%6m%gk`)%GvOSq`NDI+p2kW)Ok=bFROBdZCNl7He-H8oxdmsknda<~n5i
z#9Yb_K(Y5z1N`liXAn~H6ykJR|BF)keiKvV1raQB|NeWhMi0OmHA!)_{kqZqd_EWn
zn8Srpwcfz*7UsVUVmJ!OgM@pA?!P)+7J&APM*ky({}IBC|Jeyhy%r&WZ+iVJ@{JZi
z;Hi+mqCAxfj{YUG;wb>d&6ta%((DX)j{JHB*^3szMcxkDzVwPsONf4b*N9^HnxfYP
z^?3*kzPPJJTl@BG{W-ht->UmnM5dQhNd}4DfdD^XztseR<B($_y))o&8C~kN*;S=g
z(9>XcWf4y$_^ECFRqwp7LF+YNhxpN-c0F=S&@uQ$<zM(itr-I~&vm_<=s&B-(NI7P
z=T(I2KT<S5blLmMK+E-Ah`ak=N=zLz-89EEjAs2Wv*>^C5NI)PbGknCU`Y4bSyXY-
zc>7PyP6EK{=5ve}B7iH#cK4Ct;O-~RxY!aSW1MXL4?kx0!p@7;_caZcrtY3jpL-pv
zuQ#z<VN!!gwug$_J-Fe{vcU~9JlOeUmfKPuFO;D#G5v#h$Zm8o_w~yL-|OkUT+oUx
zd{1A$pFvyfiXZu`7;852iRna4_0Eq2g-2mp<6B3QwuKBcccnz0lxjA9$3&UV2RXD)
zK^L3zIV+adN~{>eT#WcbjJ?yF%>g|1G+bCHH2yqd?yhCmc<nY^O_iA{ymW7XTqHJP
z-?8w2vG-R2ac#>QD4akD79hAwkl+vq7TgK$5In)%-5LqOEx5b8y9IZ5Y1|!}#<@+h
z*4cZVz0cGC-?#hLbM}~H)*Mwss=gALHOSWZ^Y}wx3szW+Fv{VdlK}}2A~~pS;*#5H
z`x$m8`I^yQOP>U(#xS0-Q6+j;Xdrocc$>U8w@Rz3l(OMpp%+3A$@9KHo}*|2^yx-)
zWh>ILTOZw!rpF#iSxy(-5=<?vDT+>FGsrZ#JIxSU;2r0n`fz#^c7)(kA42#L<M<58
zByA%FySU^Rg;}T<YcwtVn*Se5LNVFtU@&G}v&zOrSWc#%rNb?-cDPq4#AeW~i6+xD
z<x_S)RfC=Wa176ZkpGpVook_lcXrn3{-)sWFkY+WjV9s6roFRq8j9)HwJ#`~$w%Vw
z+4pwd*{%k}&jZW<@A}+#C<*M_bcaCo?q!0iIpQXFy<Hz6z%h!s2Gdh^YK)ZhqGyv!
zhu8kLm^O0oC4M#YH=TluyXN_ikZjfaY{vTH;N`Rf98}cDt5uXK=Yv@3I0h}2F!fq}
zc_5M2BF}V%D$uh?_2I_wskOm&%W}T4q~h7}d;yZnl6`g9X@ADb`RvyXHfL>_O4fFs
zP6z@#vUZED$mVcTY={j0UsJa{k^fOMjF;%s<z)JIH(-AgpSHF0-T^Di?LwyjB~<64
z@=)21B74e%!*T)bY!*V}CnWRr$?EDnQ@o{+R)>$Aj?*3dapr1wEOh7gF;MW^&396}
zyO_Pm$%uo=^D-$YW+%j$=&EMdKwyhpX{ioTmd%CyQ?p#vs@*iAXXEwhxkp@<u4PPL
z+(pzCg$Ivayz58i8r5dCBDvISE1Tg(n{S5$8-Nx?uJJ&VjUQwkY4q?M__kH%0y`NN
z522;0cy$K+=s*}Q#$Cqhlcp|N{&6F+7bSCN{ujs=d@igSGea>5O<|s;Aujbdr`-qW
zGigL)U1B_D(~(SPMcOVTWAB0=5LugRPRZg*+gSCULi^@C6|bn`+@JE!0A_m;{rIDw
zi$mfr?n)%0uNtFNE!CqRHSet-GoW`mNi%h8<YAAm^Sw=qW3$*Diq%)UIsHPe9y}ML
zDE)n3$ij-bvz&~DDXKb<t{87G)+^mpzM^qEKN{F5q1{ZXf2?+$ocO_~tYF3znnNk@
zO+JktY0mb3KeP|Wqxw`F_Q|K=<VGU7AW9rxMy$7oM~&fxi$2KchCNAx^6cRgtgIIN
ztWGne;8LM=>Y?aPAj3y_iY$-J3-+`;nJ8^rSNWq)cEg?XHr7S!u3PyX>GQC<R^1*q
zQYKjyg(;U->yxbto_Y(iv7=lz4+#g6Owy7rm&K~ibH6%a8NXxpZC#r9|J-WPl6p9(
zX|bO5Tbd^v(kaDiRUe}4w|kZ!Z;a;*B20v^&#P;~rHsi<QjO>1-Bg4Ntgn@@@~I;a
zDu!jfIhPA4P#!;YhpBFT>5g&wB2BwE|7b%sEuacZ+uZ!{mrK>6<8J(?3!W2EG{UEa
znlb1*aM-o2Jvg;xy8U|A_|yFc3LdM)<HKmw<-x_Wwy9>*!Yr8>qyp_gd8vHSNc;(a
z1&>jq@w5D4INx37cL24;-r`e@u)p5l`$jhUOPG_?C!4#ocKjf*q+I)3iRZmgB3k9%
z2{>=&_lU$R1GIJ2@0|#8u;jzNohai9t~V-EAdkBdOs+E6lWS-%zbgHP%G5%6l2`+B
z-@$`9h_QaU;7>>OQsGzRla_F!%56UTd>XACQ#H3}!HK0nqRJ-8kCrmGWfqAri)^8h
zDKV~jy9mi-Oi?!b0cs$P5ne9aR{dn4XCFfn)JXXK!S#m8&n)IO5gJiRyTL^NNShV!
zoedYjuMaW|GcNaz^uiqm1~~cWpj{aQyz5>u$)_d2jena=h<mO*(<nhzT?)WuqBO>8
z+Sayy$Ld22NN$6=g(g(XMNod+585=I-B_hZZ`zw5GCTO&e6k_ak&S_2(yPF&5Tn23
zv?BWTW2@76JD$k$hF(WvE#UE*PYhG%`1)Z6$e#8QrVL3OJC81i3v41MO#AS4rK2pC
zknlot{#D<8c5+=X)I$e*X47M}*0_tJ2O3Nw-=5q==lojBCs;lm+fDz{ttf57ObPKJ
zp!@q<djSAV9PRG;V56e1A>kLk`ci7-)ZHS%$x^vKhv~(dOZENJ<ryR~U%<Y$03HH6
zpm}v{Nwo-9tOT(>Qx?@e7sHR38JvD*TXR4Cb9c=Aw?X4`Da2XmC#|R(L@rlL+tVo@
zVh<a#+iYTn&}_+EK^f^$Pp{LbKie2>^j>m9G~}71P>HSbunl05Y5|9+e^?3~?nrkx
ztIi`-oAf<sGjL=32vdg_&-zQj@T{OvXxcd@Eg@$;A1BSgR57>+T52>H^P;M*?rFOy
z^4qs?aHtubKo-)Uy%m?g{WF$IPsNQoY4ltCIPng#Zoj0Mv#Fiq9_^ft+JcDDm61}@
zaZOeayRtc_Pu^bZ&8BjF!{YB2)LShjPLzFPx41FYTXKj#8r&Xym7DirxY4Sj&YN3V
zk&(r~I#gPw6)3(EC=Zk|pQ*hV(6v;hZew<bWjj+IC?V|@ML|e!TbL6g+qMn~hoKcV
z%kDM3G*>&iXyl|Je^A=`?y>|g3LZJSlu|Amx^hHtEff;rJ4suK28=is?@x~bwJ2D%
z&Gw5lO&&6gR}M{`t8LR_+G$%HW6t5ZIj>?}d<}DWoKlgebz&Ck&y35344d$HEhTg~
za50$j4Q%M8Z?-GdTft#2?&fuYWhxm^Bo6oI1l(!XDv3g~>MPwB+f&i%F{4h`g7*!d
zPvs~d@GzAnG0|Ld6K8`SoMd+;9S{#DVNz^Lma8|(V-xZf&@S4HjtsaRw4>2hYIS)9
zQcyhlz&k7!Fpw%_C8f?Q1PBKQ+z7P>4b3m(O7Y8BKxwnx6;8gSnFn&8+O#Wr2B*(e
zB?aj`e;Z&vN4~%vqt@LZd6tq|{s%M{SJ{P_RHp5rMD6T+*&G^W`sB^gD8R{diQRJH
z)?zgPl0X#}`+_zD8sahECIkei@@+q8wz~HhrPoz-&(_tO#D(4JUe3KcX{|BsK0oHs
zIbM7MX*SqtaJ)?X>uBx;g85|?=PPGF?QSfRtV|(PgSwzJ1T512Ch{S)MZ4i-o4Sbf
zyM#7*{At2!026H(^<xp7qp@(c&#Y;Bd2yw&Qz}A<CVAXGC5}OE3{{D>QI$M?)6}JB
zhDt|r7*-3Pw7sqbaK&}qbo!f_bX0>iE3@L-H82_~`Rk9KvLFd?LUYsd96irImZjFa
zGTpd9wvTM4Ik_ze*M;Xj524D9*+Mzj6BLjPy*l9p1M(lNa<dH|OyB6oQG0T91Bdac
zz86|QC3XrRC=?NibpAXZfZ|1U7NU?aMSfZ|E{HNf7%?r&?CH5OS36X`?QCY}Q8hu1
z*^|R6-&e{H3Yctx;SA{sS}WZ5JJa-DsOoT%%@6NQNyHCYPKr(LVn$b%(0$ylVr^+B
zu##2yv<yG<b5*rud2$O_V^jmacY^2SVydulJ^ExASjW0whts>Cg}Sko=%Xq*5%ul2
z-oifth4p~KyT>s1T;_MK*vpcD_-W<6;(L!syX93**UGEY7;M0N2Bm8e`l$;#PXiXJ
z;?@SMiJ<+3VOM2$u=epRU*I?y*@?^Kmj=_CP_8SPgwsJMy;k*R>&JRx%4*Za6^{E7
z0U^_w0<)DaWgdpVeF0*c?v}YQK5?wLK!0VCO9*>EtPzI)(exgyXC#%x>~w~Zrt3sD
zB|hZ;HzxDd!#k^PBU_?G`opDL$-UA~=OrCVbwHKL65^H_wv!^X2v}<PvZeH{vzEpW
zRmV3|hjkj@>@?$<RUyI8a_*#xWYFgRsV=Rt&=zZ<v^;m;YIiixN|h+7VheH_Q<i$y
zeTN#7+23;|{2nV#{8PCEIve3`?8ZpSYxHOlHdZ+jw|RWl9ZSBlUl@fy&h+XK-~~^&
z?X3ImPpwdT4P5(FmoVs5-YEHrMcXtRgGDF|n)D^FV>L5w+K^utl2rb>{PC01!O8Ku
z#R+rLJw(a!A<=&REh|pV{ao%w2hfSSjN=dzecoFVG)nXNbd3EXTG~8WjE9{sBTNll
z%>ivtN{Kq~CTVmt!%SX}%*To#CcOn_hcXJw)ySbAP(!Y?;q?1hu?a_h-WIh<AOk71
z3n^R;!|-Ee>h2}#u6PRSf&Bqy%Q&+za&nuBQy1q$_4Ta`h4FzTy+-AAPv`+*s^^Tm
zF)XbAZvOR&173JAHUoM5ms)d~mfO}w&&5=QoWVDDU(2tsnp3t9qj}s)I6*@If+`B-
zd?u?__fFm?+bv+yFRSl>J5U_F=$h&?IS|$RGbL2ez=IVikXf4{F!rm82edMh3g`zU
zCkQUON=L<_AImzi7^4=WaqQa?`hh5<dS@+>v{1ev8Lhw%^i?7a%`~kU1870^Nw7_z
zn92l?A{v|N=4;=u0naAaN(HA-qA=K%hRGjiW<G&8&f8;M(J2<U71`<jmZT;4??zm6
z3Jd8e`&8JZ7tbjrTvX0rvswbeU{*fRuqJ^|=O-y3`kESG({)+?w8-dWNn^BG;DR}o
z=CT>Q#A?7fOHBkA740sLS)e1HoCryxQfFogov1X|CPSRN*Ni7FO261!<*F59IQYI|
z7x(K<tO8QmUF;$5X2-fd$)#j~oMzbO$^GYwEzRyRtz6!mb3^Xo^v_HF!{2tl&w>ye
z0~*I~ZI6hw{6Q&Sf}k++(V7nc%Dn-0-L3$0%pz~$-$-6-_4(W1?mCVpv1XayAc*23
zDVE(JI>Qj~;-u}`-eqWDBswOrnFd!?Nlrt;S2YBA822@b^TW%~60%4)CR;*#OEkdI
zbSxIL=og+Wt{J2vp`JsFrx3TB-z=I?;RmiOIBXlZG4g@iEMOTmpYko-m+3EhQ>$h%
z7?BZz6~3xcAT~d?2z?y`<yRDi6^;C`ja4qMx9H{)p$yT(WSvp%nju0~7_#5bt@0lV
zLY}=C%t~ToT=9^P2@CCMG)p7RUdVSPY()R+tqK0lYq!%^2-O<JmaI~uKOO$4caq{d
z5GZpvU#PuPCQ60RPj<|QeYLR=l}po(VmosmuGv`XLL)ZUoZ9KTz-R9U=JYeP;$f_=
zdWQ-u=FW{iq8#jf$}oN$^MF$By@|u7Z3Yg=c9)%;RA~yRQgFy>0@O7TIE%asKg2Pt
z7B^uZa}pN9(|RxTeQA4|yQ|w3@`LEHP@SZhV4ZTZZwubz+AhGxj&zv{DBvV}nwcWg
zS~9x5SwHhI$_?WMV<g{Bu3m>mnE$TG^<HMDcy>Op%~4Ns74&&|MUHVcL1XlY!(r!n
znH}`KHTv!H;6(ui-*%$c&-4d6{P61X{Z5&aDeXY<ViWC)qgXOt`~~Oy?c}pmfwsc+
zRBHJ?Q+rh*L6tJ~vlX#4a-52rs1ja+OGk+EdcbB}?Y0x<VD>nH1Rct@$YzBHIpg;X
zr;e4t$)<6i-9?MbR-2Y+IXXHLhhJwxn$qJ<dsIp{9e%PUSZZU01kNqVqN8h#Jhk2#
zj+PR#n#~R;Ou9f+WJr;Z<MAe|O#1o1Qx}*}jOqQ7!6b7WOi-?Cz&}%>-r)Vd9W_ol
zp!dk_cq>t_7dzzeaDHi~IW?!z_Pt4W?5M|5h3GhsP@>Sh;zpjv=F|lCNfsMMYTjAY
zd)r9^YtdtSWcY=$S-p)oN=&MA&Ui{GhCNZmW`ORJi>;wYMy^xV&trHN-jgq;b3UE)
zqECvY>A?e*A?l7wNN6eXt<kxrL}Xa7REk_hEm{sb>{)%bXw7${{wCfM^C~{4v!k&U
z+$Gln9zC-SmRsQd%uaQAT*e*9Sw6wkARbvhG?I8W`QGC~&0-uF^sM`d%s0coNQypB
zuH8F~8(r!T$J#^D8Z<NU$U8(151B3@R2I7vu=`y805WW~8lD6028VK*LR6iT;ZN32
z5cg=+LWjCEr=F$8oGFCqjn=l%8!XA#gs&phscoj;PB?H2GZ}8buWsFn2$B&g;M_hY
zfJ=4APl0g<l!W)8ab^hG^kDE1*6(RJ2y^(}kh5TBdEFA2;tl(3?}>ssfG(}RHB=mk
z)h-iGMNz+tyKo#|%PSMUzZy-jdgRVkN*Cv$P2enMGcP&w7}C)x%wOENFXxQhcZ&`2
zG#1vAOvJUwmAZBrOM<RD;mb6xype~5v8Q>Qk3(!FLV`X;Dn)1A@h6;o)42zdEw@*I
zBZxc7NegHJ;=d;(D9FuoQER?@wfv5FtIuX97F?uSio<Gq-P+=ISz1<~_C))jb8sp}
z3F3C&jX3EEX|x6%&*ImaFL1c;!uq2S1~lWU<$sQ}WCXeH89<H2rg5tOu_Z=$LXxN7
z1*V@qInbw7Qqv%UdRg;STD52m{P~W>sCU%W5I34)Mx!R*abC^Hn#t17xqQ1xGJ#Yg
zpR|$!*6A7h_AawYZv!qTLODIp3>2K7ftFh8=L{!$YZut`G9+WA4zzlMsS;=G5zn4z
zWp7nNUqFH3?&Drmvr<Q4dev@s;UNCC{+SDt@V+3#d2F+!e#4KFTsylsyjMaQG!Lih
zV{nyF-6Z&KmKP})XHk_H;Z}d`n@0)*5-Wz6r^jt;3dEVp9vOlm288-TyvR1-z7Tok
zzP9iAbWr?H#PhR16pd)E!eCHcDUZ7dX2j&$o05+?nMCumgbkTNLy%J%?1+B>TSWmu
zt;73vsz1ie?7$bS>6716AklgMG7`UdseuX?9%OMoExMd0=d?n*p1Q0O>jC7{u{g|%
z-l+vzqJHL86;tjanw#2bRWbkbC`lFsks2{JiU$1?k}4oSwH#ch-u;xPhZV%#Ck-Z_
zvcOb)5%22Ha_Y1*l}*I>2cE@&ie6of`7c1!pY9@PAhu*hznDL{Yya%~|DYLyW?ta^
z^UlAu`n$kc-g6CRc;}{1ITxSuo^W&R_;df$@ICWv1@^ELg+P>-RHqO#{3XHK^b$+w
zC0uXvzxDao%e-L`^<7RGuAb>+BVSEf-1BGHn!ND|*KUj)G3vYg&nI5mK@8{3M36tc
zr6BrO`hWZA(>@rgj<Y`Tz5mI6@xQ-~MEg001^TZu(EtAT|IaZj|1KSWy^#cxY3je+
z{zJ&$_2^RmFU$UO$voEo_Tj(p{r}8uZ@PjB+TSk^k9l@=4WD*TfMgB%muP0U@DsLi
zoAALKKEE*A4Z@MVM+_zb2#^!ho)8g$8Vo)1O6-e4wLZ%F|6nowyg#A;ot-3@ufiZ)
zMrfI!fb<>l62h{`m$EdHf)LvqT=vdxRcuyYy<xnMgALrjzxywV{_%{CyiLo1I7$-2
zXD==pMakc$edFXz`7hC46aEk{jY}J%`2Tdq_^Y=y$OJH|R~+#9cLM*7Ki-$md3HUL
zVGaMUJi6SLP>?NsTT$k;$Pv}cb4iB!;{O7VC;a)>1Xs4v#eX-IA*Kvc``6I^^H+Eh
ze*?1tf-9!ndKHmtrVe^B$>2sU>GrcW_|KMqT}Cjxf>i7&QYuu+nSiDgdVL9PGWSff
zK8`n;Kg!nVR<-p?@|!Bs-;qiG>>=C_GD^McEKK4M8C~UrA4*{5F_PIaq*s5;)8@eW
zYcYQNS>fyE1ewSCBbiEguBW2*z14uc9t&#l+P*fr)5C1*#QODV{+B1P$`O|nJ?rc6
zu$F1SekuZSNdfrgwmgXmg>bzu=O9t4FLc+xHv4xBcRS#@Xok)u$8&-#XYN=3f^~?(
z_n0OBnlhg~yj{2$s4jEUCWIbMue*PILqySOAToGU^!D2k>cLg2bj;gt`z3TNr0S7s
ziccG}$%o*@)G7SqNU-_4yDm^3VbvTXplZAK=w6ZApT1XUAJD43wtxXX{fz9s%d!x@
zY&-13QE9?lg!~F(<z&8#DU5Pcu^n-&Ti+FebtNCn_?;rz8y2!udq%u@j)?GnLt1Vz
zxcwX}wR>G$k@^?pV`9;vTAI(<i=x+yqcM`qJDnw&H_-|cjD2aY(ze}|)|;fx5YN>l
z5IW$;t!1W4&2BLuJbASy<X`QPX(RV_^@4B_^V}Mj>z4Ltq5koNZ5SWx;#^LZaIyMJ
zouk9+aedrB+}0=YUiws7>RdGgu_3n1FF9SDML_T@R^74r%7wbJXdtaqZLe7g?G;SV
zO3=sQhUPl6$qAzHaWp#pHfvCBY%Gvf!&{S@PhiDTMpl_Rg4GTW_SMhSo&wr6h>@J)
z;Egt1O95~2*04Op&E&>g93{H=-5)PlNTLNx!FVW^-#(JZ2+=gF_W}oKH9<|(m|JsO
z_(IqOw|0Q9i$OP(pk@uvwxhZv>^J$ArH-HICalIJ4md`VcsiFmvn+i@W8cg^G=!m|
zu34cx@`u)0&fD)zh-~B=NMeDG#%q=p3Ee<Pb*|HCR#zuUw5rFkC5w1&j9Sg<Ese`Z
zUhKdEjkYyNc$v=bT&sF$Vwxut4LOH1XaF;k-AbLA^KZwy_C%;FM@PT&E`UIxaBFg?
zq$>+PXta(toVM)B@UkTBi5DcSCR;~<9JK4faWZxlrCMb$tXWWgu)8xL+}op!*JwCo
zXV6>9NrZ!?Rv=fpCL1#pHQC|5ZDW(rs_u9>`Va?Vm(AdwhpnO0E{b1-fJAJBh^gas
zh2yqo$HAT0u*Jlhswsfh%Yer)+rhn4rLFriwkxI+Q*eSDq4TQdm+c`(B#C+mqGa`5
zS~+li($C*11-@obA8hWxNDMx_{V4U)n8JRR`k1X%!>`8QSLW4^S%z(urwgPi?E>|M
zLAB*V@1ITn)mLW9yukkrB|Sq=;cg6@h8v9RRQy(NslU1Z0iHB0qGjBkzM~&W<IY1T
zUNg+O2mpvZfjOGeI(4$x#M-SVwn{_v34n>#?3?uMLo;NUJ<aOU2-%wvRQU>sW&!u9
zszvKWya^=V0WqRQv8N`?W$8|5Hp~(?knZcnbz+7e1GDpIVpb{ad6>7eZv5GZkk~L2
z-^yreE`0~(!Lpp8E_9FeK~9-g1gs{V2_{J+G%dG=_J?`FP>*wN;x1jIN}&D8@&Il6
zz!3??Hy5bBzcP6>@XEKYr|~115TXGS9c^EaVLjnbAoy1g%T(u-v=KndNrKoL!`=>W
zu1gGca|f_gdc?~2um}OeMlz6w#Ktd0>3A#6ffOxxpu+2NX?TxBQdnv2z)e@A=81gc
zHc=62|9F&aT;v2N>w~}u_tN>sSq6R6s9h6Q;%G>W8Dz_&#)70}*X2ZhHqWmEOXvYr
zu`3ySWpk_e@|ew9vakH`85U)<J#?o;H(Z8FIKYpRp!+;*TGPAhY0BgGJK2@G|HOun
z&<L;oU%`fmUsC!HrI<NCT#e4Z@*`~3_LM^Hp(vY%gAZ5XEc9s`uc%0@UH_rzsyuKU
zadVV#2TZQ8(hYASZZRuM(RxojdZ-gieYCfJz1UM_TD8{FC>uL?2T}av%0x`F7K(W>
zvh(YF3QvX>fDNJo9-aUiDsFDhR=W#-sB}UaY@C@DRyxvL@TOK(ZK|qXcch#2obnXU
zo$NC0Zo~RABr_sHE9x`)cJpv@GX?CNuMm6}rwj`n`r<N75h0|9?bK<OMJZj+co9uG
zXnO)^>p^*<eeQ~c_|fMi%^I!6qm_KM|J)@HRC>4(DI|XwD&~`SS(x0tA`?UUQ|4Rj
zZ={D6v;XK1(&JVklku#A(JYGaRJJWv)<-jF1-palc%YMRX=dGK_r~7Yq0m@r^bB?r
zoHoT!Vz_GGSrR^AF6jLlaVb+#twW%|w@8e+np(izm_g*%cs1P|l9%dUb2tY{qzEy5
zNhmAFK(Gj2<p!@>N>18~HO=Hos^g_R0n`?A-gqZDfo~ov-&RP*cOVL4$QOcVv>x*q
z=ya9HTTPY9o`+Rbd=L0BWyeID`;DM<Z!Zd-b&N`fj)&QK<Yo65&^0rjmszcHXFb_-
z8jY}fF28LN)X{&*tNbg=vV{-qRj~Dt#~LUz=l6Uxh@kUkdF+v{+?LRT?4Beo@NZlv
ztol<Wi5WSvlL;RT%E0oslFKaO-6^5O7EGzTN8=@n_`_|)iG{(pZXg=W-rcc^D2gmd
znWODNoz=R)wp4DLrRJ9PK{04#+L{}6<NPzlR^1#SSg@Gbasfs`Pm2!WS58Qf0-u}P
zomDFyF4k52bXc`;AlqL%mD0;+13X`7NJAb&xq`GZp5U37$H5?+0N&t<`k+P!uiumF
zG-KwM{hEO9?Cy$sSqk4LqNYnGWFF49rrrXG;FM5qHH@{|V{&sg^ioje>uf(63?Hn2
z8K$hOR6{?dv0Tg*Y!$SW2_l(2cTl7$!n?PlyEcb-1?5Sa21xkXQQszaiJPeO*i9b^
zfaF3~)w^wX?1z}m7F{Up>x!avZW^GIu4&R1&J$<BvK)ac81l+8P7rwN6TwHsNeDVM
z{So8+vC{HjzzwhQc2FU$oBH(tL)k{$&gzYDkUSMZ8Gi}Xq`IGN8m4q=^O}?oGCKj1
z$}3IrE(t+Zj>pTGCO~nafkWC-V$UsEhifV6!honMod)~@WMa5wHI$)MLwr<nWRYVJ
zTlMYl#?(wmTG&`<m0QN5k#z$2bWl8msiHnHMEO_w`kZs>NSuFOe;ZSpip$rci%^4o
zF~pQD4c|TK@H&d4t6DN|^`ui3qjL5Q#P8#>P_?W2;BnGa-2abht6bRY&0qepaO4bf
zZNjN5Q4^qt-krZuBB$1a#B1iE+DGmiu=X<NY>9fS^j)4dz|ESe4Q-*|MfD@$?PJp|
z)5+TTmZUaJODKJ7>zN5hkC2!Llj~uG6HvWI*9Dx)2tImpEnR9DM%nzGg7jHU5PCVy
zFjmaGINxp9cxONlBYP*cvTS)6OXPr9R~n(}fD@9CL?evdtVN@~wyGd=#>yZSzLzvQ
zyx=GU!8YN@N|!S=S7Pp<)5_$ndke-i>X@mqimwXOP9K+iX;EIaE~S5txfAS%c!Bj4
zbL8%p3q}V;&~O$Ag~9%y{aON7e-nV>y3$;|)0ZQrq#$JXc<}Y>$qx}ru(jSnV3D$a
z2`iz)nyG&7FO>a_)T2LAK*~;7taOZd$H<OfQz0pRf^CYaM8F+*R;gb*xPzBQQz}+V
zca^IloJed-y8DB)JeR)EquKmq>y?Kn&HlrQ+GM}ttEFad<}v&jd)4)-^$|$XdU@MM
z-K~NAu^U&Hb<4?yj}&Hn_9_y&Drav!8q+6;_q+C1pa|i&4R4iEcd$*dl)8ViVP1d>
zRljr`z}8GTrbzhp1@E*}S$lANi~cnkMIOfNxc9|iC}}KO(voxYaq@O-#rU@#_%(xH
z;i<E#9Pu|=$40xlAI<vMB9SYl-H<YaRGLL;hN9zg7Dwos$&UXrjeQ)Q;+67^vvlIy
z<!0Op^RvvjJCLmIWnZ6L;YZa{b&HL#7RC4X=gaYBSd7Vh$Gz~7&`x$_fZ13?qQico
z)7G&kxQ7=x%xQ%L7fC5MOZ*~sqbCIK>0u6cGIvO;`B&cDGMoe2#kao`k!HuVj}NkA
zWGa6@b0oPP5sK_Eu$oG4dT2JK&TsDyU#7v~!a!zA#Q`4Nvj1|~p;88@#B81|56}Ws
z-nHfGEEh=5RBEoAJaJ}lR3fm<f=BhDo8>$$k$_9+?8(Px2O}#;LHVv_4PFQaRGJ)3
z5V*<l8E(>xt296lG4}lIvvXr-K&#a*lChK6y)>fLGT--fMf|}gK`B6}yFfa0*;ZdV
z6TMqm+6_J7)Yt7JV`MS8@icHOEf`qJ&89clfa_6&GyNHja5mGG1S{HMvQXJlLv5%~
z&F08Zs$0+rdcCJUXb&aTga6z7v_Di*Y)~(g>w`|+xx@_H!mjc+ZkOF+QF^}GJ?B%f
z)&MQYZRF}=L#2C%>C3ruS&U9^AxzJMLneqlsi#G*)zPL7me8Ohlh}SYB_~1m^tQfx
ziY0RLw%zi#dPfq${Zhi3d^C6lvfg?%w0Dms9gmz9u)8W4b#YS6?v_N3ueRTqIfxZc
z$_AI6G;dV$E>}_nL#ha_tnC>M`#V}&2ZRN&Su{AW3Hk&Y3~o;qofI9^9Z@Sc4wa+4
zHnZwjG#QbZubM4X9KG*l(og_vk0vn!%SYQZZ@{^y_-jDVha6Dc=-(-AzczTGnPZ}{
z?mxZfkl4!^Rc6e;yWZn<qv0|<R6Z^_+w9B1M_6~+YNWhTf*&btE<Q&dXi;|2QS>id
zDDG0u>D^~@EyVt|P)dVt#m0Cg?*Fq9KJ{j|aF)ROtPv8E5714ytt<L<EJFh*=C5_p
zqqtac<u|WX!$pzS-k>2VZJOSrA|53exKM6izKlvI`7xkTlrZ5O`Yzhef>*@{p0Aqy
zLJx$=IjsW8EM*{+WF^~S7fK75^cG`W{vf-@T3ht<$9v${&DS2}r_wu>@RryGY>l#d
z_EO2VL&|9jpFe<A)WYblI%cz^I0o43tX&H$mm#pz#z<)Hg~3_{O>l<KIL#81$KWTz
zO!Pv)2CX~rPHv(l7u$MI#s&owC|6jctsWb)9z&a?9hKWuo7`MS((kM7AA2eF+k4HM
z9Ac25^zLMMR>j{zEz0^8Qf1&#gLm$ylT<rTS`ii0BUZ5YC_fxpW^DS~gY%vK4SNFq
z!Jdq76}9WASdN&V?pEgKb4)>rjr18;SRi_psb1B<A^FI&y_KGg*jDyCFMk(4ycW60
zOi?}*;}OHZ^=<r@6fHEI%@A+N1dS1gYs=tFD-XPtD34+jY8sEt2?xKtn3+PBFN!_K
z-yQNCX1PSTm5GJ?lBCl*@M+~IDxk7xq%!m%ex0(&#Xr-P->;jW4!e4~Onq@0mwTsY
zAbwDmyPPK^9m5mii2*Z%Jrd1O0xz{}e>K(y<A?bXWbfz>7!mN3j+wig?Rctk!u~3s
zV?o@Gq#)QR@b(o3hJd_Wd3lrdbd8>tL+G@FgBDl$OxUzmQ&SUHIrK}!t{1}mO2UHf
zPa8Jj8z0{IG9vr}@G`WmeHwLHciMJ!s^3Yy`)pa@&y1Qs>rG)$tm56yY1!d)teq_9
zfR_R|t#-d9g`bDU`MBFpyF`eJHxc*J##C5KH94?-K~B&WI2<k#vBkhKIQ~5{5-04M
z?pQO_U?VpSD^2Vu$4K@3({>ASQ~<u9Ze%@EzqiIHr!#;q{C(I90zHcwgXQJCYRCTg
z#}LcUrlQOof=`7sB68UH^z~y@Xv_{k9(Nh9a02TjbZ&WD@p=SoqOJ`FfYC|!Q9WtW
zZp1u^GpcS1)trwk%xR@SJPr>N2Ja$&zhN_5wrrP=e7C{2_g!6TbJzL%V+4^#mH|^E
zwt9OmUPJzh$a(+c4F}u1y&^!EKcd){wu-@PePRSTFDMK-Q7;OPXnEb=SLZONVuRFQ
zp+^4p1sDewt@AKFS_{5VZ+!a>jV)r1H2Ft%$eRNEbJ(Gd8SJyO-Y^0JUf1TKcn}^d
z5v%#<lj9V3v#CZ;&_Kb4m`x{t#wa9bU7i%dfodJEr3elxQLW{4&~0eas@&QyzuwnU
zM-wY;0`x#p=_KsQ2?XTEnAlj(C*YPXcC+=$A^vQsvnptMW~KqhnRj;^bll=Pc+@ZY
zoAC4(Ft+k91lXs@L^(zUWeIK8R#=bhS@oX;-?-kI&Sc#635&`cgb-_jf(j6FGP#s0
zh$>idP5?CXd$PuA>W0{lnDlP}=1lBwUmh?GCyy&0dIcI1yLtuWMc9PU&8Ey|o~9zO
zXLRyxy{}^+<H1-DM_1>RopUgno)_zjCt4U=yCv(V53AVT;^BsJ1n$*d(%jk?nEDF#
zu%?7UUQ!c}{iSo>`Z#<myO;XgmmxtN=(-K`xFE)g47}H({FNo9k-uV&kPxtMi#eEO
z(hhYDm%_$ge;kdenh^00*t<K)kU#c`!A063-6bgBVfa=2W1%nrLvNVba{dAHqI7qS
z$<VFu5*qxrI%P&wCIB~$c9oPZ$xZ-=z=@84M%h`|xOm5u`|DB3Oe&Uc&92VD0@<6;
zBR;p7H!bf#gwdM#GWQljawP>uHj{nSj|`o4ODfyK*^H|OKk&&5i!eYAEQbe_Hzcpp
zcrFV}*iGHw5X7_QQX<~chy19v)O6DH*mU<o-Aal{5ZU#`-t4pJcm(Ju(W~QNkk$Q2
z*E%*(_LREHegQ+p|FRp(FAf_)EPUidlIplO3j@Nr^NRL8u8L5jw5LiW6+32v`L2fK
z8U`6L<nevG@Cb$Rp=AQVn*eAPJSV~HpQ{s=$MwshQbZBw7e8KIQv+S5E4w>iqtp}F
zV~^|aRVgScybmRAvAF2DzUCN}&{i}WHUk!#<XQ5#f$?!LF+bhcc|%f$LQ*5KGcj4r
zWzUbHX4O>luK3;0t@%#oNi{oMynYm<+S*;p1GdLnEa*b=D~k>#vGSaE=UL6ZPUYjW
z8R{F0SnRiovM{&caypnlqI{hm(`J7t{_?jd_Dw>;@w<h5YR$2t5XNaU&zOFnCi<eH
zq3I?rWuz(^oBw6hh-B$1y|IZMp}XFR?RBtBa9J|Wc9y$1($)@*7f+<<(Z##SG?eGw
zU=&v&QLk#2_doozbNQgh)C4P_VW=XWU>?(6T-HtXtGu|?U<k33hs<5bKvKzBzxw{-
za=SJ4^Or{-Ei%JdThG<KwN~7!lD4lbshMBC?iB<~I_aT$VKruCJ9Jl2hP^4EQQQ|k
zBjHX=cmX|@&|jVcg+WCEH2|Bg2Hoh@OkOYj_xytJ?)hf}_36Hay8f@lwku$#^gfQq
zBb#bwwhfaKr)Y}V+7Ak<0{I?6|M49w-%+*SkMLtel$?s-{jY8?()q&>>3DD6)(sZP
z30i%IHb6w!xyD0S@XD_V%^Yn})#?q!MXH%vlEly%8!t(JXWjPu3nLDo-th0-QmjJ#
zMbGcM5YpV)p}MDnJk``bETtmz0f%`n1_j-w%e!Sg=aIkyzexw?ypXhZkBbWp&iyTl
z|3MPuZUh(x$7|$nHh}hzxc;{`r&<UfUOZ@NvoR$88TLOT^EV~W3u!w43ij6*oF_VD
zr4djV*H}<9uM>f~iBEcA&27J)^z67}{_{!id+PQV_K(e_OPCNkw7l0s2`_BFW1Dp%
zR5ejw<^4C38)(yiHci?&K2zx;+^(*3aS~?fqR*5-zoBifYv?~G^G7D1W#eB&o~J`t
z?Q)uFEsl}iUWavR!*V~PXv_QGK2`3;t1muTFEsTnBma}&zxw94g!}L!1%E#|>i=%?
z^6l3bjsIUa|Hg#>`N{wCtsM0Ww@oZ+2#56FS>MW-WAQl0|8p$ccc6H~evoH8^U<5`
zSww#Z5JG-Jy*s7irTz*|5wj6@v8#hfStmZ%j6K^x(%?qn|GWb7l-$^>V-ZTMYI?ih
z^Qct{veCB=g&ILtjvHwbMzOSSp?w@G@xZZ$KPQ3zB{5A9iMe?|umfPEd)Y#{uz}Sy
zJy&!xY$pyy{!_yEU!py8Tg%+?zexFC&D-lRzCzY6Q#*$LCU$>h73Q<o%Uvk@iU#HX
zyA4nQ(#EP_xZ&SF_Ftm@d>4b{<?D3BvF>e^=MnxrJO42qp4+%fLfW+Du<d02$6tRx
zAm{Z8$BTg<J4qww1q?!Q`|{XZJD%Z`#afInFD;Y*$*$jQ(nN)<0IGAJsGoUeMN@7t
z>1tt-(ujoTIjQyu_wNbmBDLz=X9s5Ly_m~9U$j*K=72TqvhH^`Alrr~i0#O2NxSIA
zTT)iUJtu~d8%x{dJ}^j6Ho1wIQs(UaR?5XG8RV2VG%r4z?6%~5<??Na+U?}AdEIp+
zY;^qhnDC23J}u_EF8lMR11s9EhVk)PEDJL-ZU|4jCI4DhFg|!wo>`&(?3CT(3wM_0
zn70}pUX;}de7zi}rRBM8<_Fi7Y9HL-&G;1D|C%?TjQ57+SB;KUBLT4*?iE>GT3Q=%
zTSNHH01*)<9*s`z>sR_kuag^ZIQ*e2=e49_2jd~x`qvhj22k+tI1R4W?(~wltWI?L
zmvigSDJv;|kA?dzWMv1;#)Stz(-cwDp3{zq(%Gqg`$S?7qC1$%Qsg?TuAlp&v~%rt
zOqa1G-_?0cxY#(S5mU)rpt0<Bvo4}LN~pm;ds_HaPodeg+ty5#9($2840pV^6?hRJ
zPyCRyh;uNKa)XVW!sAhC(vpZA+k-REX5tGe#9+`OclEc-llZp(EIoF6?J9l67?l{i
z;<%QBh_dd-P&0_rw76@qo0^AD)YA$dc8?)c$2MlJJT6$X3%+D8U_Ok5x2j-;RixL*
z($#V2VNnXMKK)QPHG92|YP%`iJ=pFKE9RSKWR|%b*M9=UF5EWO&nYX&P-oHDsr>k7
z5Za)0u3ZknP2WnNMT&m}A-ZA=cfPAYf*RT(h7_De5jKx%OGTBN&~y_-M6@nEysbGm
z-d1_pJgQB>h0K*)McZ#)ZIQ%|gNuJRlOLl7yLZKKbRYF|<;{&AIUeKd)bOw{w6J4f
zRgn`|W?16}e7Fprixl#`1I<iMTFqrAShH}_pot-3Gb{m4Pg<wVL`8UyR)Lv6<G|kw
zCO0<L!w7lf@2^UjtEy1`7GY+nZP$H@(3(@l&i;Jxz=59A_v43YL=QF{*M)q|#-tj{
zg(fh%qd!qSh>n7OxnIi7J$T~ky?Q>|DI4p9#eNf62U8<nA>VAZh1R&B;pUMlnQE%b
zCCPTEC)4x@?~GRALUIfCtXVh6j?BGgngT${>y{8gisp=xRaC%is?oP~iXDLC8coGp
zl~QCsb$wG5E$(*miq|<ZK6%?v%iUels0+)+RbikBayu2yB`n&g*v^@(7x_tBv<dt@
z%9KW=G^_v>59B((7w}jk$(HQ00-Ve&3J)#+)mmhQV_Fbuwnl&&$KtBd7vs-Z{DuW~
zx&}<EM_1*it~h#GYT|D<9`@a)&BO?DoC->(7i`DHrgLK9FDSz5@O<LMnpqh%wdV0>
z-63Y=0lf`ujJM}M`stu4l}(8`ABlI!w0)g?Wne_?`8Flu&^VX1z##$cNB83b!0PCx
zmt&uK-8fC%(Zg*1+lmdBAmfj2GqZe>)i9=DENZ%{NEfkRwVJL$tLB`URelH#VEXad
zQOmP_f6!neNdle~<LHB$GzTK;ee4BPI0}eqTG^in!GJukrRZ3nrLX|KvgD&i%%y$&
z%V2Jd%QseH7H@))%)S%``FanzcIlkapv8Vm&-oDo>UTR?KPvUERWCx=p3|C~$0q8g
z0O{COS+5D2xhZ!k#}dH~YPejXl55dBJenVF>K0V(h_bYg!%}c?A6>>eJzZL=ahyQ_
zRe&XY4=kp$FTHan&juo9DAoIqJEy+yw}xZW!rEzvXUDB|izWnx@6?5Veb;h2=8^1j
zrCAtwiV!^x7BKW}yN($O@jLo+64ZjMYgM#8kIz@U@T;TE(7r{h9yb9N9X5f~TP4B%
zJODC+R*c8Y$IGf;7uA<w(TA(`n>MZG@z&ih@tan`R_D%;I`JbGNl7)AjOr{01W|E}
z=$5d{Z{pdiB*V48q@0$O4+ZLp%@itHb*y7vgL+4n?+aBDnJD<*@RM~e6a|eI!#u&I
zfKQhFsIKP36;qN2({r5Kyn*^<$>0C%2oa+&u1d6L8+>uZUF4)h^p*~bF@04|8!DjU
zbcO5>J~3FX#CC?Wu)L}3CqDU0Tc_VGCCf<hRo~<Ilbp0SUgbztm-4xOGJc>ZhV2}n
z0HK=kqM|MK4P$JO^%&`;2Rd;HvAup*?Js<I&0YZKHLyvyfzg!$DE$`9OI8O%R{yC;
zOD&n#(uhj8_ls9X?ZQTVU6|p5WK%<3D&TA>z_c+9J2(Hp)P2)2<gJ%z*Tv9sy$j(0
zsmuakI5epCHo#a<2YP0CiM4%DrXhJ97xs9N?n{U9ofU8A0+y2ltd_93Li;gSA7>rY
zR5R$BV!bLzM*%V1pYi0lR8`8MeL*7%y!6l%wP*z*d|R|^M`kJsl;BW}uZu2VTfc_u
zMqakZU-M*|Vt5lqzV3icWc84P_G^NE8-}!ev9(fJVV`Tw7|AGWb9fKCQ`>p|APWY>
zGoXekc8QC+Ns&i1Vy-bGrvVBd?m&0+Ten5b)7Ol-WOz%*V4`52SQH#sdb?j0Zeuh0
z2CUpHy|#Oj<nuO5EU~+D$7&_Jl~$qtv{hh*iki116cMe{K(zh*kr$6GCp6eM5G(VF
zucY4bx{fAvAR+d{RF~Q6dj5X*)MhiQ$dIf1;6x9nX=mLl#8ezMh!oFn8TU$#&ugBm
z5Tv<ZGuGE1|3YtH7s7V;dRdKoq$!lzdTVD^Zert*P-AeV8!?~G{Qgkr_fbRw!Ch9z
zNx@d~P!w{#ngsvGY%@S9tb$80;tg6_yer+N%QfJoaq&wVqct)2$H#}eOO())i8gt-
z+sz6xs<82iwi4#|jg8&IL-Z<)I(S4^{Ed9;gW%)uq%}7Nf<C7k+sCMA1ks5<NgWSB
zl7O=YUthgQQW3)^)~)FxO$N>Uq0)K(Kcaft0!LDVD=AV~cIks^L#vQo?qY-VJ$_N8
zcIuw7)Zct5cWd}9g>Yd(UCU#K#;AU6VD`9a*pF>jyw6pv<I0Gko}mPbjSTN$eR;3C
z@bTY0VJoI%Kts9oNm?iiutnkR4W$%*A?pchL=Rma5+u{nBPGu{ZpLEG7NAa3_>nX0
zuwUQznkom|SG-J=e6<7vFVe3>rMg^I9NOKG_>mj_rlBuS^p?%hX*Kr{i@C`f7rXdt
zHMW&P-fdGl5mRO(+#M-r;0r3BaR)8wx9+3n2pKKG;h_~_oTTS)B@(LGsH2S-MBz$H
zk<uyUj|jD{pG9;cGi<>LZWX*aZ$5C5{#v<ueeLy<N%zc~-(p(fN1r~ndf4k;67BGv
zqEVjXRRc&ZF<G+4n}x%s8>zn3o(wuwzu<t;H>Zg=8I=^j*89GxLWIm%L837=mu5z-
zAe;C63^T2Ae@PD@JD4~k>a6^xST7tKe&r)AFN|2zO>BEFx$|D_Sv3aF$5uH%8*-b?
zg)3)+b#!E6vCdT#%n8&2+0PQ)gRj$4RuR@IH?k92a4Ks$LOLt`elrXM?gO;?OJtO1
z<-boby)o)r8Rl%|Zgi1<ow>S|nd(GVX5P=DFU_`EkP2KLJj;o-#-M`;J_3RiYf`AO
zYp0<!p))d`kt(C{Sd|$;NRAxpv$rFOoOZ_n8Eu50oYN)4(_F!K%Cb5?t2$x--s_*j
zUm(z}+9yCE)6;$-(bsgkoex`?AuRj?KmBn`y3zeZp*Z&=w|OWs6=i56I!YSlyCvKU
z8W>FOvAObO>YvI{eB69ad_*r5xdrHb(p0src-i0Pyi1H`7m>pcU5BnP#1P_epuBRh
z#gm!3mzx8BGe_gK6x&s6G%_4TofT~dJMY>l@rY*E7@Cm9WcqdLqE(Qe1XB7{m4ox(
z2UIQx>c7Hdy$i+?kotxtoXq8{QIkkKH?`bsRD%YWYFKNSp>^oRNfg*mY!{m&3m@#_
z8&DE|rZu2MOY;twr)G+8>*;-7ZdO==HP$0weAHz;EZ`zp2nDjG1x%3Eqiz*n{d{FN
zB_puU`7`~DpdYDRkV@@9=qQ>_wdV0xlyqDw$uXT2g{EaUSGT;<4Zk3h<)>>!q{Sf#
zjR4=T8}vLw-O}^;X79Af2B{_R08*d)!*{8{enA<hq)c~=O=?0paJAt*y=UStuumQW
zqHhku(e$^654$5ukPI8J9se9qO(6T;jqCI8(=DiOR%J3B@(p)Mk6}f?^=g0M*jy>Z
zx&(hNaV%9DO34^CK@-OFxMg=wY}D$JR1E-^rrlmCeh{@iHv$YQpBCF+4Gb#}#ttQc
zW+7>+cb=+>ZK|+-?X@A{uN_^?v$KST@EUw9C;(i6M5FiewaV7+)h4m&<D0%66_zxi
z#M)nDWT=!A5&f+;k$il)Ik6rwRC4sTQ0M`v89Kr4`te6QCBCbwFe!aw23s`;GE_9P
zymT~vkN+<8{+!dUuHUPbM8y%f6xul~u~TG|J~+Fq+Si3V>4e|rAAFnZv^|5)@wm!F
z9w!@`?cciJdf)93chT?e{;0&%VBkvu2%k5A-0pQU1aSom5{`=BDr844E-oz-IPmqb
zIX!+5d`CuD<IqAAwDTF(;v+KoOmRdLL_|#T-Bl2Eo%O^pVp0Jt#r=mD7hLtq^f4wL
z`cm2IO0|hqL%%jXx1`%q-CVhF(wBsXiu8rA<jwU32Pc?)r)Vs=b<I9V7-qd;|FzY3
z^ssu-s$<b~Tl!O%`WJK#-*>snb>$3>*Akx?_YZ#@n&?l?-W=%lb0mm=d<^<UM+IGZ
zFC`4lQH2<&L<%B8Ji4$FcxZO1J>YEI6H*ge<i@3sk7y&Yv~ZrlKr+1s3xfXNGC<Qn
z=9u+cK^5S?0s!{}fA1j!h{6=j-D#q`;gq~D^Q<*6?+e~1d*1Cy0=*QkO+E<C*MSB`
zi}Xhy+#D(2w_48M!tOnqnwl0+|17IV2+!~PoG{M9!s2%IxOJI>Z=k8!8+s2dR>GV8
z$qb8Dr8_V2GQ9CeCRbHbVnS#V_t9zpg%uibD1k}Z5bIImFMXQ7_Lbb%Z)+7FR3)`4
z2C6Riu2p7wR#N*mF%gZ^>2Q2(er;%9n$bRtJ{E-vt1Bh7hr*(E3w0nYh0E*);uw3V
zM(K5o+FZ1A8iaJiF<aIyl~zvY@}^Ra(M1ge363HSCX(KUphjHNh4_+dzVVAMxFq#6
zCZYLhu;k36+P{2d$?Fm*Wu$b(533Z*FGK72UCD9{HYe6VhVBRVd^Af2s!7R&m;qMt
zkn#E+6{QdJ3>9T1@2PlCj$skZ1?l&o#SaKZ%b_yD{m4v`TE^drEXPy<Jq=+`+IyPQ
zcyS7b2;_2E@8LHi4a00He#viQ@Ohl6bakLNbj*YlwVZ#*XbxrA_t=2S*mmeaMo^bK
zgaVrgCv0OH5y3CZxo954K*DB)0nNAdt6)8}m|`IPM>j*psUfUDeL!=(-w8r`xV;Vc
z83qjFj}ZJJbJAMH-xkDLh`nJ13!Cft>RM{`yz`ZksxW%1eo)&>IUzaj5Wf9W@N3W0
zl$j-k#aa^~wYqabTqGN$ZLC-)LEmmZOzU95vxrL|3MXe{YD|lbh9E&rl~XybNx1NK
z^kz69C6kFq>wHVI0cFqTLsMu;%7?I}5%a&Tp8Vb~TFv}EFjz*<TCU}+_RVG`i5KdL
z^F@pWz5QVM!~Nn+a*2FQ@I-GqV5dxRo5<yqiUHnaJik1|tyetF@3zeu>_an}565IE
zmTx~ocg`<=xhnXjS?&d%(YNnS<7KGGqPZXUiQsT&){Wr;viQ)PBiUOv26|CyQS~h3
zX7m?Y-FA+9GvXPKqXQmy0|T!5$G$WR{G5kTD2ZHczPEohpnwR&B)8eoEeKoJ*Mt@6
zHP7S|@q)o4vnpZaiZ&81K<}jfBGs8{;~6%|13KTM)x8q7KzPL<A3T5F#>F{Mta78n
z#EA9DQjF?#mw~!HcXL)<%+Ox=dQ`+hNE6A3<q1u5#SjN?p*25RcX0O$mH`T@hD&?B
zRrK=oQ>IjXZb?hTLQgW}uw?;E)-Rh^{c`~b%SjBpB0Vgn%b<W)743+n)DktTHQwP&
z*`tDl`@`62Q0S~ohQzJmob;hf<R=MLcXFqKF<ck}DI2~B<bJC$;pVq3=LoWc9!&bR
z0u5E=e~hk`wC!jF^O$;oXA4f+tJCAF-4o?AQG$~`RIeU(;%>d`<FqfbZ*}~m;|?wy
zD0I4diMed8uXoRwC#TG&oTtj)wKO@Mm&hO7PSZk4&2%F{`|-vxB&RXk6zeSC)?<DX
zcAjfgrrl?^^byLJ<Y4=18h7=GWO~D9y3iaSt71J?Qe8cD^TZI><nMQ32&{MPZYnIR
ztsUuZzYt(Ab2^#Uu#{y}c$Qhn+LZn!{jRd8Pl<I*MFiQLzliyl2V9P<z}Tm+qgq{3
zNHxlkJ$aVq;q2IYIwj<-uO%-SYTYJ(--~l_!YJb>bRpG!D-+zyt<-7BX28>)wgna0
zkGadDSre*pl4P{+jh+6-S??Jql8x?HX`%w}&9v@-Y_FyhU9n7>74NlvST)cmvzChN
zK@^pT)-yI!A-9G7jMk5)aiBl2)xI!d&0rVByAN7TA^i&%;dwPSsCeV&PLy?C%TBIk
zjgRkd2w(R~-|H8@o~|Npq=utNlD~3NQru}RDx>{k9h<eL=?=;6F51;9uSy-{1_Xf=
zl?((8nQQ^w3|Nk~_$_4F^T~)*V@oT8g>E%y%skUUSRFjKr!RfS!Yml}_8BJg9C0^n
zxP)x@L}3;CL#fXAGg%mDe;sc)EsxJCSm>y+mC`%$7+;nddxs;a4<U8I!s{h|%BmML
z<jGl#)DCTuSTA8bo(N#M?=KmI6N8<p>4no^6oVjuYlbDXsXmJ+neqMCS{cp;jq3Zw
z`+FJnJ`#pz&tm3=zzl&+7KQMJxcx^_<S1VmeA9Ow@Gvp>hos3lyJT1=Pu{c~0${4R
z-roIQd^}-ffPog=clU86ZHZB9eeXxMc$?RHW^q*0+*t0$Jjij^wCXv&=GahvXMD$S
zv>k?lxfLa?AB%yuns-mCO0U6fe(E(S;Djn2%S+2jVK8w$4he`12@k(0-eh%{X}&5+
zbljh*f@se2@{yeYeCL~Wzw2vfbo9v|(uqifOzM&c8xO#6LS7D!fi4Ypt5vHig|HEi
zTO{-OTzb(|4#TcywMjA^_ge&`)tf5x-jFv)4Jr3*^F1@Qc6F)Cp1Lp8Z~h<l{wk`D
zZd=2J69^$daCZ+5!Cis}g1ZNIcXzkoAq0ou9^BnExNC5CKQ&46$=+-2|LVUut(`k)
zvu4ezF?v;v-k<mFCElI#6rX(Fk4n$H+e$Yr5rS{ay%D4p<tW0OE`PJRFZ`K_o1VuN
zraKk^tDT~zM_N|LmoMQYc-*=pBDrX-=r~5ZWvcYV@U$2cM1Y4M0VG7RX5*I)BUUaF
zM>(M0D^3ntrJXdlJR*BN#B<C*^Lh6BTmMz$K8f`rd4_vxpuI^4#YcQ!dlUO3h$j<E
zIAvD8NqwM*jBbv$!Om8lrflA!-`N|tK$%#ZOY49&)jZ_+mYc)7T3p~K>wnQXj{2%S
zso&4vr!@ia5k7QU7+uKqYJn;irBDHf=t<nw)ht-NOLRT+K|N;j#eqA&>`wU)L~_kN
z{gTJZ&5f(yV`53sf;F-voAeh+{9P&U$pj-unKYb$H3c8sM&>nL{i6ji*N{PCjVxyH
zq=DH;GOVWKJY9Al9}<o-f<&f4k!(%AJei`c#eS-`lWzfqUGy`hXP5sz+;v9pbXals
z)(ES)#-ue<kJezWjYq_m`<tWF$FLUL-^F@ob%0cyTtTd!{PzmKTM4LiT%r`Q`+tDF
zZV)wDLl5fzwSxLjAmFGG1oj#=*^85aluG6Kyd{|-<iPRh$pf^lTR#p!@_wzr|NgG`
zp$5Po4)39D?m^YsSFbJiJ|_@2C}S&rW>niC|6kh!^R=u7mFrdz%myl-dUMfyEGoHn
z6shKF?BMqY2+hx9R2%32^ff+JujfWhcuzp%#F{A!>`zAauZ;nyTKYmHBF2XA?_>OT
zi~zUkPXMnQoC1ti{~d>*f^Y~l6(oQ<{_9pi7J~IZ$KxNr<y}J5^6X4Wdn4^%NBHj@
zwmf6f0{=fgKT-e|K@XILII;hG?Em^L46mQ2zn?z;@r;^60D7h6ALsk$8TFsG0v~aM
z{eyb`!{;qZh|<@TnKsg(ab1c72^N+nTxym7HOvH;5N<fIww{RUpuzR#q62ttO0%Fk
z0g$Rmyuj-ugV<|2C8ym^8i?P2UkJ+-$m&qIZ5F%F==|^5JVFJ*IuCytb`sEj+{l6F
z|MgLZjX1z-(O<1^Y%x~(0<`W5;&zqdKMfuMIw;nK+$1HQL$4Ehb0ytUV{P1{{!H)h
z&HfMP_=y#?(!`$fF8J@$`RNd}jblPA_McSme~<Y8zxK27Vknti;ak=Q;PBaSfOoZ8
zQkSyb81vk~8#D|D0NlZNl>*NkO7*Xj+CK*5`U7xr{=RK`f!Vw`2nZmcuD6{-WAC=f
zq~PXmY^Yc$Z3XY>z1&|^DG1pdUf?jO{mR58`(v?DyuW<&N~XO)k-FMrP^^|4(2VFA
zr=jAal3p4unyHtqrzSu_t<FYAFFqr-q>U^1-^20>xG9~+fntf^5youhyQZ32j)iZ4
zvtB`t6rRX>b@n5Cn@b9p$9RD$q&v7ToJO5tE&tLEvjA~ML;jWCOoeqtd_=^MugCTE
z&vR2uPRoUc^n6QuImU{xz!L)){$b((I7v|_LRw2el55I(*ppPS@h|54D~x@B;CCYh
zO?%HH*c_{+*+@-ZK!5?>%ubaAc44787nLi_Zms>Pi;2mOrDxbto}xe^DjKc2a-zin
zDrE!?{t-}hq)GtOzv1;jvEFXG21GHGjFNcU6{g*aKRGv}Ok4GT2UR)Mh>6GYm>l8^
zcj*1^`}ef~Fb8+mxV12#OC=Fn9lGJ@E!T$+tQWtSUYVo18Fjwx9k*lr$O-wX_GN^*
z#$J(_O5%9YK{yBMKad`dJ<VjXDs7b%4r7Ljd-EneJ?{-`HT`5V=P4ZyhwF{r4;N-!
z>Tvp4&mS*yByo^$b4bVz7b-J_c3E_A*qKRDMJC3_{ds^_&$LDJ`}lUq1;AfVEVhYW
zode1rwvgk_%+I5Z-?=&L?$Sx)39HtEzkMV5nGzjMv=FqZ#%eCDAZH5jv5|*^g?g1A
zZ(QT(d>0g~DEx7Q_bVR15PerFl6L6LfLLYgwOrD{bak-6=f1lv&o;v;lJGQIe3dQf
z2Nx0v?apx8F`Aad>J=>RmD**WzXVsu&irxy({p$0Tv>L*V;AOpjUxTby4C2_wN;PZ
zrS6H=I=?(TxMVI5c`lMPZReUAFUn2j)v2b&tODmWlPb&XlPZH7JbfJLR}gd<$Lc&!
z8UcWMGkI$#S#rYj`lQ-qMlh$iKcphB7#}Xeyz+)$Es)|#zM<uA{(=MVe!#H0bsIT%
z&*LzoW3k*{jUO6K!-2QxcpiSJyP!@Ax&ir+q{)6_>2CzxKYN_L8PGV0lh_m}^wWxE
z*B>f6=sEe}AUc_BS+z#n1-=#n3t-M0rTCQFnF76T?Lb=(<`d!hDreuQvNFqXRY2ie
zWpBJ0+1DoUfDsIi4n8a*;z=FV;5l5pxWLJ5xv^B?xTGrr2YWE3CMBiydRbURXq6nS
z?;i3o0tr(lN{aKUI(L18TYJY&Pzdo}kWcaJ_K3GToz|Q0S0xVtd(h?Ax4bYvUxwiZ
z-yMAMurF4x3zEg_d+mj?$8nCewS$Jv@pwGfqR@{v1>jEIDZE_Bj69VOMk2j1u^I>S
z_heJ$8?;)lW93_%j&(*xR#s7(A8*7-ODIntH6ma$vg`v{XofUv6}}tEr2G10LURG{
zL=N<7iinU*z~eRE-Adtgot>WkuF^jlT%x60@mQ>Es$*gz*QRKYBuaQ`IeBE=(Vlv9
z#>m7l+o(GiS(H>XS0~Pq*C3S1!RxSdW4rYH)xjgXoz-mp_ga{Qk2ur@TWJp(E@za7
zGS5@_aOSH;L`0M@g)e?j^SY8ZmZUHs`siwY--var(>hujs!fMx?*Pz^(n@cGf)KQP
zp;L3B1P}Vk)i3#d?laU<>UV)<mOjK<!Q$2xv=*v&x{?AZ%J}HNL{j*`ef}qmH}JS^
zNq}KXG{(nJ*9UkaaTP>2>9^QwTD*(9@VE2XN9gA{si-MA+0Cpw)#$^I`#TXALfvgm
zDymR6u8tOS^M%>X7^n)RY90PjX4r4d-{?eby}6@0OJ#G=13D6+QEPf@dG5^*mY8H?
z%7Jw}V?r{JiFKaz@$?%48l3Q>xb9`;Ne=0cjMXpkZNINJQ&*}Bqw?tJVzop%R@dO3
z^Q8Ic2)w{s;FVKv{`o6UVz;|FuO?GPYE%(L1%>ug*5K&lPRNU(S9_mUq6s+hR<z*(
zJTjK2HcY|zQ`Au)5pEsg5}!$Lx~I&jyLf_`$zb^NY~|)Kxf0EpywVg<G*A9`d)BMl
zktQHukzh@cv>^kL($gvVUSh`m$}c;PxeN2{mE)bMnT~ARB%IXzJa?hFm}rTdQ<HB0
zx3r|GDa$#H#&4;mvn~?_%Pe7#5uR>{8D*;Bs-9t3fn+I~i{$O@M$PNY!H{FUu&-gs
z?$7CA9;&tRkz4#T?-G8kb)=s`gyf-D(vNpU0tj75jr$P-{c^!=GWV;o(fF=@4)M(t
zEflhzfYhQZ`ZeUsS(75l&yTB0ClY;}k@Ve$l~kOUJ-(lndhu9Xkk#T?#^W2X5%Gt$
zvOmnak{z{%cC0fAig#DrRgF!VRUgR;aW=M|<M>%*R{3`{zfZi?t^LKT-(J{<#CiYp
znkC(>`78>rV7ikCNNex7X-2L{9*UN}Gl~SrSB_5weQ*jzqz!Byk*3*^$+#MDC=U88
z(m@)&h-R~~0`r<Vx42OYQ}-*g{-K8b1kvmcr6)d&>7l+q#1^{T1l6|?0nwY3QqHrM
zB0~z}ZKrO|CLv>2WSZ@n7}-UMS=UR!9$P(p0b><bc)ud4rSN;x$Hv>?MddByvjX#}
zX$hMOSZ{sF+wux{-XKX)2c{oi#_K*n3G{B>=YANQU$_&s8VDDm3%4JCG*X97_tZvX
z%QSj#Gh4qSDV+I*W7|kn2YtHJFFAb*j}(Pg{wlC9USj@(=iMf7jgozpm!q(;{}7Ix
zKHRRe`0+#fX$@{Vdi!c6v;0xn^Jk%GQL)zjW@BOK@-EG8zw~yGk$g?}>lcsjR%$`3
zkysRr$sX(B@GSuA9aW3C>Fkt!+FW^rNTUZ^9cqib!Z{E6!OPSn{wPei71JG&Mkyrj
znH_>lOgud>uXBEq9n>oZL(t@QC`m4xB=h~<)jJFn`g!@hF|<aHZMu}z<z?k8QACsy
zr}LfcFcO`45jb3gP`XS3AQgV3{v7zRz&A59dQYd?)ls0VzH3k|XoBktlPMwhE7@j^
z{@Nn7MlgCs5;~Z`PY+?qlf`OUSLfr_Zo_BXvcCETyw+z{E-o%V;)^;RVqxFie_9ja
z%`PV1R}I^nn-PC73Uj{ru$MX`)0sjRfeSP$twL~*SBdt~io|8l%_)gQs2C9u63PZV
zK&-_Yor8Ft6?Z#s^9-t`s$K+^Si{L*#WRs$#tO=`Amok^eq|bIAE9ehcU<C_*lcbq
z7_`!^+~uV2%ilnH7BFPnV=5I$Y2op&+bKvz#<aW1D?r09T8Y1uP?CeN-ppR;Tidlh
zglQD1LBqwWO<bk2(~%OCK{SmBl7OCeH`M88aP>StI8++@DbS&q*c}FbiRiM(IAUr&
zb;2x;O?VR)jdedY&-cQ4xI|OK-RxyyJ;l!td(GE-U26%U^>vO%@opzYCE2R2iYKUL
z=1N4vi{WY$6>afNabMzDMfg+<c7VbT-F&2gpSyVpG_Q*a@eR&B!*#+0>yc24yKe)6
zJ0Lp0nv9XMgh0oG*IHb-pMRy*sAB>ka#WEd*Q?eNdtBPcVsFu#Qi*DR6S6>`6dLw(
zD`B;%b6zFCc0Y~ut;ow^?gR}1yqji?zQ=_;b$gL^*>516zcx~fH~|d4W_qc<8RSrq
z`(Yzq<H;UzXN-ZvJAIZRt*7PKG7Ko40%J-6k%Q$-K6|ounuL^f{Ro<*$+_9Mv)rw`
zb)u+YY<&F9-R;S0L-ZHP{uO>9ExHdlJMwKGuHK2F&vXx`2!*!K&LtqFa<XwqB(pm%
z9cZ9x;E;u5pA+$Da`}xRyiy~Mrut5;QuA!%4Z@p6*Y$Dqd187>2BbA*W#!;C?4&P!
zdv?I9|8l8E^R2l_aMuuY27!W*+4%R`Sx=}bsT3|@PKyw7+to}FL<V0qWwAFQpYkKa
z;zA7xe}-;uA1(&dB;qP82hY9c35^)4!2q!O9clqHYjtcBccy<_d4c&{x@{osg3Lf&
zNFY^ot8+nnScBOw@gx|n^jOw(%oPcyUskLgw}gV6#<>{jd1r&h*|vP=ET1?m;d07^
z`S4PtXJYIdcOoSF(dSWe@~3=0Rz~ZlI7NphA#ZmZjd~rcEO^~flRnF~&yZ7`<7VUn
zihx%SllIK-u*##AR?K%eVJC=k1--?rizr1;GLK;!jyB)7W5x4V+3$v+RS9>(&EH)`
zU5B#f$=z$rn}_HUZv_kLl5nm;y`=bs-t8>ZW@P2|b^YnJVMRR`ooP%&ePsbuEuOSH
zZXMM?JZpDMapC`r)u459r|xqh*D1x%xz6sF>_b5T#8K*XMlY)ZUYK;0B-JKq(@P<f
z*v~1Zy3V)u&;F1s$tqK1)xyq7&1v@ZJn)!byUOyK%tmazBu`grRg`+(lYMmMI*cU3
zV&8T%db;_gifTx7aTW@`78FdV18o9NIaXR0Ag3mW>a+m;xBe<kSaUs852ti|it9WO
zKIQAH@cp`V=#=H;<K*7T;}@Rx@;I*QL%mwf+xv4__w|nV<JGA?dC@Vv3Wmbf&?#}i
zqN>(pCfd2;VYbos_Rce&`GGD6BM!5{-7Pzif#C+l19h#I9}=bTZweWj1Z}b4UYg}g
z!XLh;D?fnn!!@bOC_6omeYd1H^Wn;TWlSNlNUqM$u8XIq3JqI9fkX={&f^0NhUdq_
zlyuLCV!39**(j@U%3&Sos%bfi`-+n8ko{N6{qD3(tC9h!!xuA_A(4IODBtAd*vt$V
z#pqDo^*n^c4R+rlU4B<N<*?uPE~gZD`A}}Xup_~Fk-jKufLsPh=s}4zAh}&6X-3Xx
z6}7~%Cw!R4a=UUEkYYBI`6j^SM}*O4TL3SGz(|vsM~o-5<uJ4YnRC$5Bq=E_DLy41
z_rf9EZXCgk+wL~eHxIW-CeY7R0~S?-aUX6`F&BOGH_=w6>W$DL;4NubbhG&AxP&Cp
zmqet`M*Rjcj;Vnx1x1)o;x*w=s8;e|C1TMKn@vA78l-Q^M6yR!X0?4Fr6Tzc!i7zM
zu%ARBy2M+&c1_tLQ25r~Di5<gp#y1sPks~i`EDEBHO~PGf-+`#36kCt&>{ts7;$ww
zLY6s=6TTzPSbue3sBYechO)|M_!c@)EYU=WltfpP#=e)@hHP-p#{lOm&C_Un`nOyQ
zge>u2U*Sr*fk`q`SO&O3uN>{?(9KcT1a0<A_0W|6gH}Qi)Fgf(qG%xC@*~mNhU*bL
zn7K`;!sVzmp0t|p;RW8|aw8q4T%lY>$ukkV6q=VfQ`7r{!+v*kq-6Fh<_~E?4oXU-
z?6)1N?HJH9+o_(IUeXkAumGQul_ht&)u~}<ShOC8q1#7jrqz_dRl@BoGbSRNM!iuV
zJl;!OHoeayhW%aV1_nRJu<2PJrP+^<iPLo|*<wpEzK5cw5~qrlFEkTys~BvAa7VF*
zzt@*+Eg72`#EjIb420hkfQ6;U!M|Q_H!;^^tY=K2`W|af)oiveoE3PvJ?h+DHE2F-
z-&067_d8vNka*TPsYgj5@XVgEVedR4HF&G(%%lXX%H8Ds!K4=?Qi4Aje=l<)_KgIu
z)#IIS4Fv9j^hcNejhxd+Kd5Bvc*X^Us~614G76aQ`}m11{DRt0P9p=D6Wu*LAglAU
z0iz2)8|6LSSazpY6jh_=r_0HHDVZhR&B`86j)ZQXqj-Cbk`NtyLby;ZW_ccQ^Y{a=
z8*I^{&$d@QXjSQsLNV|ZV{PD_0!M-un*PvBr}=1c<61*kpIk*m!Xk<AL|>!d5+8(J
zj+ZkU;2bog)tVy4htvKF1s<r#r$T{OIhYO4j{JrE1*jA&y$nIi`@u+66A8Q%A45v3
zp>yh`5YpYgH^0+Wuyb6rnxrVJusk9JeHQvh3vFjICgl&2oixy$nPcn~ztE;kIi`pV
z-E?slH&UX^bCtcqG|kd8w$BS)lad&atbGFI<}p8u^!WVhchbL9j96$J2b1N})7)X*
z-d!ikk?BbydeCfanHlMQx4e`*-fDGs&2r87`f8FQAWQ~O2u2hQ0`!1PBD0EFrylU2
z#V7LTE;rc!a4B=YjhD!+SdnY|Hs49UlsjFaD$$HA5-B=mfhH`R&z6$*vU)z)WXjy@
z%a8~>E<!{GA9Q{)8%ILdM*N&soy?8P^+Zw5$9U>M9mrp0M7{@PHd|IWh3MV5`@NT5
zZ7kNl@8)YP0l67fmWc!bqB5HcD+l6pIq}9}h6HQumH>STM0a8Qb;MA0a%F3>8)g%^
z7u@co^MulDei>*r1%#BUh48U7w*j1_L}e;l0XT-n&VY(|pHj_yXDzss*d>A=t%m>r
zvE>#1_$!jWDw@=>NpsV4$Yey=s&$MEK~c)#Y7Anm@l2y_@ttV$C}oU_RTh;4Vtatt
zcT!cICWQdJ(J$)FqAD4QyGwI;h2OwgnATle{3s@?D2i}boAfimH<6rc7aN)*VGGm0
z<O(yWA79!zbWW#&QcSYv^Bi{|nt6c6e0W5wazo|abBxeD9CWDUam!>Ruh|v8{YjD9
zwsnWugv(_56Hp?!p3Jqs-$9-CkqYb5th4gy>nQWE-(6Gm%e8Cx?IyJAF#O9*s3k8&
z`z;$4$Bv2ykft{GZ!}?{4JEm+&7vOWH_gs+00juhg@(mOCCjt<a%&CPW)2<xvVq!F
zEjaR-u<@VAnE|>mukcGW%f`pXD0RQFNQ$u4J2q>Pg*{X#O~D1t1<b>>p^UZn-7$lG
zx~gGIRAV55xedI)MIT7SJbv5IAkt|#D)Z`O=xg(<^f^uU+edCkMI9X-_UaQQIxW=-
z8<nN!zJA|LYq6EeWy&^NS_LlmXJ<x+r<xZcv39VgN;I~Acz!a}r$agE3XbWD6c*#u
zxk05;h);p5#!)Xf@<_$gC^gVUMixx<wOmqda)@CN=kKd%@+O>4Z*)HumY2)Z{2`Ty
z{72;XNee>S7F;Ot7`3{k^vY9;%S?JwzOIkaA-rBH^GX;M5*$!fm57i8>9blH&E&lj
zku&e$FvM+$tgxDTXH1G>*K|aH=REi-_@D-fLh+(y|3unZw{`SwtgbKyN)Ex!{hfjs
zJCz2?t`kCx@{pK~CEs@7FCyQR{aQvAy!r|mo=|%xQ_#ABPAH!_K5#%^uuOy6F2L;d
zj#fR1O{yigv%;j9Qk{ChK+hFw_45t}X+BK2V@p{Y9{5aMN7%kEALbn4Egcd2;ey>3
z+S>0RrTRO`@K^D|UVYPYjkQ{ytN=Wi3=xGN#95b+z$X{27$z=CC%~E8cFieO6z$)>
z9hG^s6@Pm&c)ZAQVQ*42CVV6q`>1C`O=%6IU+8}<g95>`=HU0RYKWfjxqQpXNyM^u
zpPs>$ye2I%x$Vhng(9s9z?hAqX^`W|tB`LbCgA}FOoYW6Pk#7$_t8uD^V-NxWUK0!
zToqV9WXf<(?^v{%nC6qi`YOwJSZ1e+4-BVv+ZV_ojA>(S4~_NQRL(^U<rVG)-}v!O
z)zlVNJJE-dQ1S6Cb#!KnbvM(Ag<%4v`JB(Y%mIVqS4LZ`j5<;7gCCY34LJD-w}B@m
zL>PA56Yq3b9mm|~u=B7wJQ&=aLZBPkqb|c`=8G?049Xvg>5d$onAjh^MMoLDx>vf6
zE4)2>M0K8_ihrmuy;YpIu$~Ao$DL&Yq?1{G#PjOK4eJ)$W083kKND4y%~Y#@wk$4m
zz4@l$`aq3?OYcDBp#fCE?F-_G!(GO&-jicQ&n(ZFC@rh>^<uJ0zQ*7@S%Nq{n(-2!
zvElE*M&*CNU_LmkWdyq4^0?fQBtB!(IW}cEe1*YjGPCLryt|WfZMDwk9?dO2Z6N>C
zkMLTSLKXjaVxDY>rqVwJ|55K+OCLV=-J(P?4rH=2IwZxe7hJ}0ToIrJvq0H0$>XfG
z$BfDlK;1=D^Nso<-7D$IFWw7#pM~E%S^4<O<ElYz|Lv;&^^%PmR|q8zAd`MvTwV)L
zK8`R2jKYXzmg5Q`Hyl_O=eNqM0(-o<Dfc51@5qtDTXu854Y@06p~DddVv%Jm(w`K9
zR0t%Tj|;stfCX!@pqRKSA`f+`6@HE2$)-!R4A^vW8;THj;%0hk(6SA2YA$cP=7J&t
zRRZC&a7uhC7pJfpJcj!gZgK8#V{?*AmRNT2Uacr+SPsF7?!!9Y5x3huB+v0dK0)mI
zEx=UlGX$6+J}T4@i>H2Z$gB!X`%+~kf~E~^r##(jeire`z?Rl1uV5M4p+u3tbq|_0
z*QdfM=xI3`i$dPeAk9|i;8C*W85)NZx&Q)uZaH8%haD^_?mUNdJR}63KeO>>o2%vK
z6z48+i}y5`4NLf)rok;86Y>~09rk944Mlz$JuT-zY=KYsSz-^KZiMBw8WiFpU5hiu
z?YG4<+baj$a+l_1yOfiC2x)_k?$M*U;eJfe`eq%`8+fs>L2WcPUNkmF=}WtK={?Yn
zyuh@ST57{!Ld4A$OKE9YSRf7gSB%Gty1Z!h7i_GQ;r=$6p}Y!mtdkoNIY|HExF&7o
zJ8D?V_Di(neFzZJt;3rW>toOnp7=hq;Ab;ipFS^8dVN4fftoBA*$nn(Ad%-hhv#0J
zn?0v%o$aqvA?SvX_QGI26FA<g!Z(pP`c(@>=`jQ=e4ac^Oa8=`mg`Zrc#TAFBQ%gS
zJ2sbhT+a^X3|mTS(ske>dei^nqyU4xEB`4hx?a#_VKB%&VB=;5C;D`jC_VN7SGB!I
zvU>jX%LIsT8Cbfc;8dq$O9xv=*-(C!K!7T{G_~}HqOF7l;I+w8s3?&GPd;g&5)Ygs
z;M?2n@9uoki2WO;{u)Y@o_YX0Z7!I$$NjMd|Na1!l>Gklsu&=I55;u&=>KN&zd_E^
zW(0=-4NrC~fmH&u>3~5FkN{Y+FQ5;^T`FBcXz!4<{m}v>{YMJ9ZV8<0>E-#x0kAiH
zhyYfHfqq2ILRcz!2gW^+b^<ufe;g5L$^yK^7L{Krfd-!-0iy7n`SD;YzCX0b<i>S0
zSjB$D`agV${8J!^ObVd;iUSG0jd)A<=-cXVKO6qXzJHw&K8TL<G}X*w{WTK*J_KNh
z=K*6P2kSXI>wn+GjT!*E|KD!@_Y8tyHFa8a<YiY8DE6dfm(P-wNnOja|HoLq17_(H
z%F`5m$_DtP3KGcHE=}+^Bd4%Dn4IOab<*tyl=IHE&gy_C`tLA?{?gL8)!|d6e*mhL
zw<JK7zUWS<J*EcYrWp#v#|sfLyP;39IWGSf69!}&9w2LWvzGQjByfn51j9dhLi>kr
zspKWUH2&i^{`^VK2a>O(g$@?|clp3oJV<~dZa(z)jq1<W|HN0?GpM)EG`wh8s{e>)
z|GpakY_qHe(x1>&vZMd=WdF4%Z!i)d_MX>G&r?2avmV>hp8$obf%}-kNtN^RAGfqW
zmzTF2$X4FeP&f~|y?76UDEQ}H<AeDs(#V>uoSX#5Dr^=fK0K93hJLS=2k!cgl*1oO
z&F)FD@$ugVYJVG5{&_i(mx573IBd?df%fM^{I{|7XB15;k24nsWj?^Ro%Oi;sC5VX
z^pCBr&#{>iInbwm)H}0gSgo}6eeLJ@=MJCF-y4jo<@FYr>vk=0nFFI`w$xDeZtWWu
z))!~J;W-xb((<a~!o6gX$(Rj>PkU}wOL&PEVLXQ0U2wnRDD}l+R)Z~`$NFSU!nLv7
ze1A3iRX$zTxa0Qy<UBd=jZ<ZBj#lH~O_GUYrq-GQZtCZoeOxwT&^dsS0wd&IH$P7e
z1R(+hErg~M2Hu-**sk&RJEM8YuMp9(Lw9g=Xx2m!;p-jEc6BTj`uegg><>3W(Sx}i
z%@)+#3w*-gALpa?7im<g1MeU=5UjZI7}nMCIJ30SE#!3ksl{e@an}3o+=N3JOPBod
z8?0n9+nWoi_mYeCrXrz}<{i&0Mh3Cj&>2^Atdn=DeJ!Aqk6-L#yx7<9G(!elJuYJa
z8CK`=ESA|f0eElRf|%~&<>3+xF5t%ul1Mjtd7)#eEk9J&QR42}_(2pwD$@O-VQF|F
z*=*pg6X5^IBuWhlTx@h@HJ#NfIngiu0Zp4-THhT><VIQN&t21Oy<qY>^!X_J^}ZU{
zqv^?uV?l_5PNMDzj4Ff9F-p8*2ZNWD?v(hm%}QJ{-nG+#Qoo~e1~r%Y{56s3)iH)`
zLpyH*{JhJXh*DtHyfndD&Pi~)S;)sPYXUf!S3fU+ti*4K40EL4sxJFp?ZikCs~4mV
zv$Dl*FaSzNw>&`{74@B{xnZF8x-{Qys}B#48!n}FHDr@vS*juldMcz5fNtRLnr`Mf
z0gEs=m_D_gFpG7*Y#*OScF(<Gu&#q24s?j|Pm89Ez(6*a3U+jdvl43VnF^)eh<3Qm
zmNT)}W#*?ZiFI|CuqtD>)N;i+AG5MpK_q(UiA0M)8K&P^18r-*RG%Eq)E|}+2fn=A
zEy~GRDt*tmVq_;z5<!&q+ZjugGS}KHL`ruEC6|+F2GQ2~YAU1xpQ9As@yPU8>pmRv
z@{rJ@C^Pd%cDK|lN8RRd3JVL1kfC2v(o~7LwlT9^hf%DmX6@OM!MQ0eyE~#QVgNK$
z)4f~*J|z6@kJ_-^h@vF0u859w2V9O&<Vqv?&2C8z&jU^Z61J`3bl)F~*@GH2FGLV^
z9!8rn(b$c)tU3xehrR|(;Bh$@iz4<0mV4f@SOMKp&aqjxrz^XG<v$a1==Sz5opM8i
zZc;odl`Aa9oh#r5>!j!)Qz=GkH6_-KiCP1D9Uk@#BJ6N-B@lVDB-W1HACZA^m<>kl
z&y*u=Y1QlLvR35KE#kpD^8nt&yV-&O8euCCO;+bt6DYHdfWc`%J*B;0Gu*^z02Hqb
zXm#v7;s)TV*hW?PMu6ivfpH9lZcTeHX}L!!(fpl-t6rO0*!IVKQd{|BL7PAw&~*tc
z7(tyX*n>ceD{nBeWxa3iAFbkmY%gLO4JYBV>|&kM^eL-P+rMZuS+CQ5bphurIxfuZ
z*;JPji$JOUX4T-J>J2&#C7Br|Bl~Kb=o;)Vk0%=mz@!uZ8<S=zY|OtJP(6wqaeiFX
z2-1m6W}4`&eXZ(piA~Nu8XvwZmSEi(ITB>I7CRoh5GbXrs*(wTsG06Qbe5-l7jZ8l
zZH`IP^SM}l$oXM!JCp1K8V5lP*61c6^;uJj3`qf{gQ{hA&+2}I;Y<Jw=W@`z!9AR9
zItRqsw-G6{0QMIVpPnVe34_MYJq%+z+1U^WYMbo(T{zlkD@$UU3L*I@%nS@&$lDIb
z&hZ68->!%5MfSznS5aOm73_JO9ld*zhWfcbIVk-1Eq4Rr_4jeJ*UZOj`X!M;r&_m%
z%=WB|bj8+0XU@t4Nk0#MVwenGcZ*ALhq))~=%=x#IrMVSz6nwsX1_~&?_7auNF=+|
zXemE*cKI?}KE%Ue&KK}08Q?W|-u4z`2*FHQF<?!#v6Jq*#|4vZ+LLeY8j%;40*L{T
z3C${0eJSNcxt;=1-Zdr=<&BYQZ3TJ{+<!}EXRCom3$Ccr2>uGdFi^KCc3DNT!^Tjl
zOW5xdstRu(J4;BghUdeRfNlb7SJnDOc3n)iXaW3q){nCnoW;UKP#@oQ+W<B`XoC&{
zMC<p+4gs33vC=itEBKUZaQUW@T>v##OmTk!sU)7vi_KZ9yptxArR>2$M6rQe#ZsnV
z3_FoQPUPKi!oJ@>#B)c$K{zw|!Blpaf%J7K6n3{X(1zhJ?{v(kKq^M#_nA69s=!OY
z^*dxzWnYGJBrLgY8)w>VTTDh{FmXiAA-d30YpMxAXzQpaWC%f1eU>kdE5*3G<zP2I
zyZBUbx!S>x{24B_RX6$S16Y5Mn5gD-uf$gK>Of}YCO$sK-aX6t0$_x`SP1L7nR8No
zQ2$XSy3&^D9b~)Gd#XecbFm2J2AId#Ve#$5EVs?FQ;kt;Mslax7_2e|#78G{rz0QL
z|6y_`<c5hyFTFi@P#bj$UPXOn=uV^1&{pQe_pVZkroO3iuR|`2tPT2j61Tyiletd5
z67iPYAT}j=_^CV%NRMmpybT=^`kzeKC$TN1!V#_(f{_b|KFtwFDG$m$r$>)qBg$mI
zxc1>Wz_rE58r&vulervTbkeKdR4W*uX)LT7{6s5Apo^n*@J2?|YH}n)$s5eoA-t=p
zbtNcbV<r{CshXm@@7#ogi|Bciaz7QTRHD}}NVMp(KH?p3&QrA6QP$3EGJ%#cJQgar
zXm_sa!GDIiuZ*EH51CD=lr~yo;l6_M!BE%qlI!P>giunET{o_fO@|9OC_2roZ(`7Q
zxa{BYjeAJ<as3+E;^GB+OSI~JJf(1XLrnb|jJ1_F9tUkIs~kxEw<>_iqAFxzwB5)t
zkouK=crkzhY?pB1Tu`*oZZl{)3$PBnsiLm9R62a{AT@u0NhjJz>CFj(0p-Q?-JX(u
z{U5y3^Z@vh<eB%qCiFJ1z6|h*Ovuuy4)$)1>|>;pNp?$_qw99W{vyg?0Vb-8^ZZf*
zi4z&afM<CpftmeEEsmn7zee?aTlui&n@k(gNE1>A_`<Le+rzl2PG}^6AyXKun*rPz
zkMs;>IOy^th!azvFVSv19>^Ep1X^9Erx|+U!wMkS4)f7Tao(pYsteSpD3g&(zrlcl
zynX4c6)vjmxDs6R;NRVz;ONN9+NM<Ud3K%K(cj^9<@$I#rn$z{qdH;(V6_Ik`&mF{
z3pr(L#WDr=MH*)1qcO5P%5L+|mu-1h4>&sWt|cPG48=}kVTxnmL!3AP)p=wAH`IVN
zV2;f4P^q@=M>jmwNKtWUZ>_8Ksz>CD?r~e@celX3Xw7^daE|?$t<iZdjoKyujL2?e
zLjK*nvvKu_^5ZT4AtFk=<_Cje#wHZ;L=)ZCEl&$U=0sqcxZI$9;F4~fh{o=_<L8X-
zikiTAa)E{$(s2<y{U1WMYyktGdYYG_zT($=`3pgMT>~mZU=aa4WXOqIo_%K!ds^u7
zH9cEw0&G6phX~inHkJ1M-_BpT6TMUJRiM_arRCunn)*>>IZXSC1I7?2;E?^{;wsfH
z5Mwc^+@WZJmDLIIF$j2Y5t4F-LkrceN<!$}@7IJIgCf!4_ZQ1xwN0}aVQ6xTj;T4Y
zSV>SggZ2T>LvAzSLWCAR_v-|UcVgvN1!6L&)Y}!AkEpwRnIR$T*u2~L93MGzpVJ&<
zoA{R-g}G2tfZwn8>fR+;bC0zfxJ78_)vA`+1l3?zSK16R4z;2E3e}cJVlNz7c|xZX
zqW3PJNU|cE==2IR18S@^l#unvVMIoQu5cyksfriBMQ^mG4fCuDrABwDO7thqU>Ffi
zD|IeD+s-yJQyyCH+5db7U#-W6b=OcBM_XPLm8Y5|s?GI|-*m1o{)>r<C#kryz?1Vi
zKd;y&JNib{T4?PX@CXq@5!ph+tOPfiBbK=OxfY3UPwb5qB{C4iR<nvZyb$S%lZrA@
z$K;b0q^MLH=Qe6GQQQ5H5)X9E<6|m~;AV+<4ITxyJ%N=k^ty5a5Lf%AdgQ+v?d<MS
z7QxkaCkYOXBl-(#!wW9BnO`ipy+o*ufnGDbyOedhYcvcdPU3j?x?f<2UUsz80w7UF
zq}+RnuGZo6AIkD5;a)0R3GQ{5>_WLyCX9CrvAeUvHD^$t11&}D)x)BSo3>YD-kt9u
zZgp#xwsKEZyhME2AqeuZyS@G(?*$be+rU!prgtG5>q^AqG)=CO;#-hi>>E58^iA^W
z^NSM5+GKsK;}bSaEY7qDZp9$C)07FbPPh=vILxo^PwOebF&n?!^C94=sYN*&d2t@r
zH4)}L^*OWD{faLc8NY5lZ4}_CE&0M3W4hMcpY=UNH`0)MQfce>!hGyuq26O>PO5df
zw>LGPF;fj<Sj@0wUcJ(+w?V~of3ep6fwv!v)s*n-!(1uiB2Uwp!252`iE&;k(qIPM
z%3bEKyrwr95Vov^8kP3dS@SQ37OITF^Ob|HhuX}+0lDmYv2;UTniWcO-}hVtn~V{y
zRvFVIB%M}-^oro%tfTKo(sBvSc(tJ@*r+9n3d}#~Q9o0qM2Y-{nKMXEG0_2HaAP?H
zt6`Lw<l4Wvbr1%$2%>;smaJ2R(cxOn@FGpxy^Q);q3<Q)qtFX%8Sxh-qe0IOj%Zqy
z@ZS)ag?JIHel`-!U|OBB&q>|iGG9m!iL0tB_w**hzaB1X4YcgOlW(tD4Saj-`?&*<
zKXP>^BUBSOV=MBXU@tlbhld!tA)LN^XO2RKc)JD#9sT|66ADQyID6Ygm+F;G(h-$O
zBmp!X*OWAc4;JofFi}FCNmR#rWU7zu-EO2N5fs+KQ8uffjdjTU`%Y`Ul#lev=?9*y
zBUJkN{z#Y@_%Q7P2U(a!S=}GH44<|2PHUv|Uvcr>kZU4UieVETV@~Zli53PIbF5zV
zxC4Cu(fHbag^LSaZVJ`wRXb547OA@ALa@*_{MX#P{BaSu#72}2%5)o;kA%cHosfiW
zjmk%Y7M|O}Uqd5bAXK4Y?T7KA0gO2WvjQg(=m7?#MSR{~<&W1&Z(lt10szu;87Rwe
zI}*>9<zT563VCsqhi3x)zv(&|Kb~|k!v0bPC;hQ~|0J*IaD<ViNk|rw|4~rL-Ic#s
znUH`$h2f#rti#s$H<fm4;zwY4vm;<{FsRd+e<d&HLHy0YVC{|6?s$=iK(mRh!3TjB
zbmKNdsnoA$Q`FW73JMBYFV{3Z8QO`oXXe{ZdNYS-iBoxcEiB6CCv-Slt1Z&g0s)w`
z&GYjo+7(cz&sP%1Z=*rmhzRI<^sK}jWK0VE)!~KDn+};zTfKwc{E@1h5RRdtEVDVM
z^Da|c!XPzuskO+20vw0G_tiQ*%;R?ZY1kvIAjNCHBbLh|KNlDQRtTufbT%6rLt?)$
z+`;d3yl(VWwT!b-(P1~(SAHHtE4SESsb*Umh=fA}RRm~0e2^sj8FuF<jED;fnw^cv
zGGo;vxBSds!vmP_&a$b%X%wtYtUq)zhTKMLf>R3VRgpkcZ_C{`&{n+#3)oSbD{k7&
z0nDp=@tnp6jC~r=0YaT7Ux^%L*%f6oT{$uKn(+Lo4aN(du2}{be#(_<ZuwW2c$zhZ
zn|e@_e3QiN?S9#Yh34QOuv0f8LJd~@OmK_+zUBTDeihBmPC)f0zF%q+KgumiGBI#I
zA!8nS1F3gEu}p?d$xTT~ey6kOGyR(MFNM?d4G3i)0cWbGewzeTR@d5KO`ai&cjf_V
z1I<pS6s4hlX+ZxefUTcX$O&KEmE3WTh4<IRiM)Hg?Tj$ph>S)3ZFd#Te^q81M-vxU
zW4Lb-AfcJ$X<^V^qIzBKj~zqX+uMmWS}r&P5jz8IY@AhQZH)*?OqQhXI+b5M$RhB9
zBSNAviyRtX0;0foMX%FwTX#<lrKXMwVrH`Xsxw*6cBe|JEY#`TLrQVSYlYLC*JdX$
zMFheym@^rxU}&@&W(NislY;(^0%a#^oHFrwG`h9zT%or>OB;D{W&EqMQjEoE!47xo
zajVN2)5N46LhMV)@!bne#ULKt?}25hV)#tth9RriHA}dCBFiFQVHEnMB{2M{_41uj
zZl$BZ^UC?9^q|G*;1%ek$(;erUc-ntEB?iZka0>@OW;mMdW5(FQyjy1bsw|5Dw~YI
z?=*QUGL8s=x(PqVh^+D|Ob1%^Ey^OY7#$KtmkpVaYh8mVrHSK5{~#2Yih00K&f*fE
zxW=G3MkPoJ+cNpt<|V8B*M%l(m%hU0eBXB_v##qEnX1*F#I?iAaVUjWHFJWn-^o__
zXo%z2og4|Zmw#*1AkEgo?)yr6DvN@2q2HtzU|o2|T*`GEoqqLFwkWPaFWv>K2NK;9
z8}GsS9TG%XUt#KB&lLkc!#C|uz)}U~!;C9Bt4TLLRLv#a!}O;I4l*RFBc=GaFBXwK
z$pfz>@N*m7_Ig@ZGQ0Z+R7+&mWZDDH4i<Z>g^PBTN|vi!b%>6BweAh&yj_X#L|oC{
zRV>O~s)3Re`QTvIGETdHk3D{3KK|XAo~CFyP0iRi4-m}LI*P+=4mMfuhd3%|0nP71
zy*GU=G!GXGSY0e;YTyv{+`-?Q#9d*qIc+s*aAMzF-&Ehq2xx$_g6}<1?-K83*o8`W
z@za1xPKWIXUM@x2dnIwT`o}av8^Zxb-3rBr{siiq^90QxBTkM4;X%`ReyhH)+L{WY
z9lyJgrZpdSMq<2xgv;D3Y7Xdkn~A6B+IJywl=$=2j(}GK>&usYPKT((<4~ofMCU4p
zj-lTvaxIv3F!{r$EAoT=MQj<M`9!$cs-N22`^$#os|_IS+9<R`1QQ;%QN*{^MZ9X)
zI1ga5a=Kv9zxO8-<%{Qmk<pbW<V3u|A#A>{PVpCPLem|bz=4et4|P+UpOs{TVBHXq
zhR3x^s0Erfp}C}@zHf0sm=O%u9ajOMcIBY~lL^JL;5-w2;&`q~SjXHhBGfD2jAMXw
zXXoIpE+{cN+WPej&xdxxLUpbptwN&?2YoCEj<`ux^C_cf;0<+84gtEj7IN9?N(-sE
zi!c@qCZrG{)<-3gv@gTpEx3ulR(5Ugm7i-@gs*=U`d$#xyf!8y7lJZzK2-9BkDWBe
zx$xIPyRQ9L_npIVN>-!CM-hvu3#bAH3N}Sqx68!Ob<LSOj-&QXZ?xDEx8Z>9)h6s2
zccAXo`q+Uj5z!QKmkV-oG(I1hh#Evu&?v19jeXoToDd?vyZ8+`st3pB-9*o9+h~Pg
zK%ZvlG46PYi?oz|oR_x+dR7b1nvfsU+b?P89f*4_N6k<hbqAu6voHWQ<A&F=i`kF1
zT<Tk2Ni%)uoqvJNauBZ(Cwgj*@+t3c7T={IJp$#aQp9svX7VB*UwF`j;H!%9JQTeM
z@sBc_n`ar-HG>);6c6sWeId6VLk1{N=bIg?4M|HX)f}oUC*-$u%}oo`8m`)$D^}Om
zWRPn$x`zZr!qDI*@|LXrhVgB!**M9!XV{--qGiUN9#b@)uL+YjOH`FrCbQWK*TW^_
z&)2)2-c&B$d&IF9#KxRXazlc5Mcg^Ia{0As^u-J8!=1I#Ksw^Gu~>{BQ6P6^;7;%g
zM<fNE?GL<BXu?HhEZyy0>)xBGHNXE7=W=r+>L#pUr0w^gxcqnG*vK&)U6I#}%#7U*
zdf#qWCn(=4d5HXJPW*|=OSZu_l50dp$+~h(W4x9tqn%;lXz5G^=m}nIw?ir9jthHx
zGXsVDX?9Ppuk>`az<7K6svKP>YK)BN4O@ElDNv12Om_F<I~@st%XOi)<I~L7GG5b|
z$|ON$<l#cFgPXQR*R~KapMYDO47%tm)GqhLe4&O7xX#(wLf(E@@&u$%m4Y32o_h-r
z^06w|kXBKO##wT)rKp{7dk32J^{)Gs^`=VbYVsWi2VH2`;Lk~4WbNKY(k<=wyk;ZX
zD!kjY;%W!<&4-Q6D|>M8!(8ZP1~}0{zCR7BDZ_-vxdoUb6CqOw<kYyU#n>SQ(kX?$
zKruEE>m=ZDi|a-o?7Ejm6~~#ClDt3P5svWO_YAW~s~n#hFJRhn%1TshwTyD+ZuIZp
zVe|k#^Xah(w27X!c44)zn6hlTQ?)nD)b~U|-|Ws;bfl$sF0uTPt#oRVPxzw&aF;n!
z*h~>jiPe#1%)u`T>9C}iVQ1{i>VNR-suMbepK)ncP=TRO<1LH;ZyRwkUKHt?!P>x7
zkUG&+ih_I@apoqidq9dK&7NZ)b*u@Gib;AYg6O%qb!fqB97&fkz-BJQ5g-2Df^S8r
zBM|NwI>W7k$Pw}8gYgd6=&j7I!qjo%GwBcW`=J+>43s>)u1~nitI#V%gqHWa!~5PX
zPvi3TClS`NBT~%~N!DmIRbMmlQX+GlXOueOQ!Wf3y+`BcU-8-8ZtvCP@(nG}Ig4*g
zxKDRFazhfahh$W!ymTluCKptf8e>Ci;l{cwZ`}9phKnk6si-t%iA|?YlLiA`T=X$`
zPF)XP^z4HWVGmzRcQ=`DL0fixHfgH20qmCLQy1&MaUM|J#UVK&j%%mofh|&^u6z)N
zBa)je(saTK8DVTH<s-R9tBU1%|KTP|Nm-@3&;E&Pdm+KReOA;#2bTb9o%V-z0e>zx
z6CBm1*xVT}EmuSesK%9D(NVLD6qfNlaKSGLWk^<A>9B~Ipj3?@nwV?`-P^`I-SpFN
z0MuWEQv&{kpZ~c#UMd9KRC&_}(yvlihQuNek-oRX2j|V-t-jI*Wenf5EVQOVhMkzi
zmQSe7<aKx&gR4_LjpZF000ke>=!jW=s|o&KJ_4#22<2zj4`3tLOcM<BlvI=b>`jCt
zId!;AO{2jHf08E(P}h&V{@UOF|9&+6^HkSAg5(58p~FT0hZ;Z<*rq}*!S?^yq!l>O
z&1LjdHK6lq){8>e%D8!fYo*+EFLk^>QSpyo=hXsq7O9p)oIrr}k-u$<O3tYi|Dy%S
zWDs#GV=0uzT&a2U&qMt)L7$quRBsZTKpo8Z;E+mLMl>h#{Gu(dRHS30OFsQ)Z~ho?
zc&D2nOB!EsUxcvypK<)hB!R-r29!wK$V&d!TKvbYkbuFsw*6=1{X2HNz-9o~x?NSN
zjqHCq`rlvt`0NYs|K(c$L<1bLAq*AS{}1~-<Nr$zBrTq%;@5yYQh38i@juAzZs`0g
zEWNepq-RFArs#aAK;xcv1`Ghzy?6%%5F@-o%M!{11K?7NeqDF5_3oDvK!kO(+Soa=
zJRC&f{Cf=ad|N8ga?L)+$$@TPSFk`Xv&QNsQ%ee<ePpmc9QQ5<1OV+bmeIlec0m4#
ztY7<SmIi`TD`;2^2zN1(wC}aU8Br%C(!rXNw7<IMJtfS4Ma~Ao$7ibSnvlgl|5J?e
z*LE$IWI!JS%gbn+U$%#TAMfv9j|E)LMjKAJHPHV(Y?_k+nAN->-Us{Nbve>-K!C=r
z*)LQ6O6=*q`_YHdX+Jsxir3l&ttKan;*v(|`z4zaN;O@;IIYO(d10rohB5WObq+n0
zpbK9t`V@4C(wg2mk?x3F^PBtGB;p?=C26<KcpW+rthoV=dVx%t+0sFBQ*E0d7ZOrT
zG*a`-Y03LFsyK=!_kQ78Zte#aUE|NJ<Zq=96#nY-^N(TpL<$ObC}J|ujHHc&X>wL?
z_UFjucz~0tZ1~$6B3zq~))kfFJyu)Z*zFp9G@33mjkGK-6=S~aE&=aXD!dy^2?vC1
zc6N9?rH752)%u)=iyJC=V$5=kj5FfD(^}BLs*sM@bXJ~kY8i5=@ynj1(Kw1r^2pg=
z`1ed(KE`pc&BQ+Ld=-$owW!Iw;y|U3O_8X3OzduD{;5gLetnkzgATPe^UO3|)bqET
zQ0T=t%67*uEy7VM+H{4f$i1+{_wV21^w1YMxr++T`{D}-3O64bIiaASh`S|nrSn3F
zsN`j2WU|yKrWlYPzc{atJgBi2qf*Jpy7bJkmRPDcmRnt$2>sOltC6|~uXk*$I+bMO
zS<^W!8^fZYQbk?GacVe@=LCxs&+DcWE;FUaa+7>Y4%ItSZYr(7>%i0r+URCAeKmUp
z|3yBrW;B&rxF>B1fg#LWa1O)fhk0%g0DobjUVqbfnEly8z3Q_ZfcZP!0|WfhIJ)!o
zL;d4fOSI0n#*2e|6$q(fI3_65B>kst4-YgZ`s-&uZ>1M^PD<eE+=fvgf0-=6yjy9<
zFG`wOpVFu@;-S^3vnqbCap@C(O|P)~=6pDno8}@iGL-YXr{$@lc?X*fzZ+PwiIEYs
zJ6E+uTeKTKH$q?-KJ!3poATAgS+H(R$aQByjV=W`q}|qd6~vRBzN(7kCmudN9bl)g
zcXY`&HDWTFmp2j_+@iD~-5+=@hE5yAK(LH7E8yb`dA`4*ryCG{wlhZfb~%|19&M)K
zojJNIj3MVKiv%`TjiXWxNvwUB$LMo?;l07vGL|nAqNAhHhLbd!^t7MVp;5eGvd*8U
ztd)6*m5f^?F~?#W<U(Pr*l+pgt_3_ThD{%^X`ApgbC%<IiivkosrA0F_FJZ3`8{7L
zn+%wRkT{*i+>~(}_pHz1A6=%NCNk^i#Q3spjJ5GYTCeWwl`8pa+f(RxeDLyAzo+Mo
z0J_iEH1KJ|BnO8lQ=&19%lF^kxsS&-Hg)5>8L9TU2@H>ANB|4QOE_9GiE|!?A?v;1
zRNu|U{vT|f50n$8<Tmxi`)b`Cf{|FPh{*txLPCjECA#iuy}x&{vzRQmFYy4E1mv?i
z(!B2O;PhVDC>UM^ugKx?=&?u{5OVjY>uS}mp?_@BzJh@j>cP-fIX>u)#ES@eW%=-U
zgB?;x>C0oPM4QBJPjphhU^>}kzs4cvtT&?4;D@p|Yrng@vy%>?hRx_^HI?En7VjW*
zcMo(%06Z2(B0X1;lM-bKE4p1dSy|L-Oz=q@4hJ>|^U=)<Ixoddci#-EWssbQkiyhC
z7`d<9;7ZWYtf1An02PIwMYCVjl%emt!*S}imppfvjpp;zq+)SKCm&9BN%Q41?|NF&
ziFI{!;%Pt6l}Vh6S05DQ=Tnv={!#o&6WD@X-Vx6yhhxXT?L5kekA6IdiJVHOk7;zb
zY`ihj&*g525EyK`9`)FixXRES#=jBC&(D{4WJsBuSJ7a0v~!Ez9S3a6N*LSM%PaLg
zNihY+c?H1YvV8q2)bKF#?EAzgS&jN2r~uEf_gfV!EH+;U&%SptQ~F_MO>sT;R1_&K
z>QoUSOP-f#^QHxGPrfxjT-&8<KQYd$q}HX+QhYu!PibRGHsni*d_TXhmQcwT>Zxot
z=!`BEkq`6?@weI`v0O^>z%Q#Bt8xjQMepp}I5-ZoJesZW05?JTTzVT7TpVE7T&`B!
zpyBzT(39gN{SmfJvxBqi4ap$a(OJ)ZnqL;mo{=mvnQy~R4bTqLI=HvSWpxD-wsIb~
zU+vPqI%cut%57({`_=*yV||n_P*I<Rs(Wqq$A}7KY6EO2jX^eJc3y?=`yKq3>sUmt
z?vv?cQ<`pJA>!29MVCr2hE%?E_*br2XHaw!^6Fz=5{}2mwU9rWT^Oky@5@X4=i@4V
zwW4cM0%>f2x1!T}@pa$?7gy#u)wbk~6EAdl2%T}!B?Fskja&PnZX-m3-)3+xMVBw!
z%JtHMSi1Y*b^-;jIHJtB`(i!NjJ8OW57~Mp5dL8BYxS#9WoqdwCFSj~JY>`H;`)<R
z*sF_3+67ZZ8#Ok=Zx~*}eQ!e;=rn5;x5Dz#gLI^lnWuVd->TlgVo^3~l;F;(L!);l
zOk?2U`fq;ul7~4mmdxl8u|P<>r`WVwCozZkAZ+Hi{^_|IOCh>QUV*r*Mn)#dX(;?2
z;`T&lm$=WK6G7taNRQFv-8jxsl&+j@%;n*Xd-vw#iX1w^XJJ+~&RgJR14LXJCEB`f
z^$WLNZ0W@*iz5$>hl>{!YCM&>J;k_lL+W)hX&(vGBbWNolej1C4;D>_+Ok*4k9%{Z
zqH^e#dXiZ2RgV}}_By(o;9<}y-ps|&{8?A)#XXZvsaE$0y|fH)ZYJr<pzU6!aqOSQ
zB!~@mI{svSc>zyhY55gWpI)^_^@C|KI%dqY;o5%k)RH~9rGH!+FaKB1*lJ3>FYt((
z&C6R4Ne2!^dZ$XZ=z7>e+XHHJ&B^oQ#<IwUk)b8s2X0Q<>Zq}^2&_JLriClZ3w$Nd
zE!w^+gTE2H0rP3rb>Ly@$y_Wd58vBINmq6{V@GqaGP*9^@)LO;6~vQMEi&*E9jD^t
ztbdzEo%;26&A^TUt|L8-YFQTH*~=y2X^d=%!4%JR_SKW!`h>PSTX=5V&2uaJO{BKy
zDh+qe%0xzlgU0Z!(w_#XBAG<-9L9>S5AS=HRUt}6{2~!g0u(Sg?=KOp!C97)$Hw!*
z8hI8!Ud}mfE|;DtGj{bck54EH%-34la~5i6ToU_5qE|njz=^%3X5JXca1fHwAsqx;
zFXkOIO%Hl|`?NgsA_AjsO%FnP`tK9n+p6@n*7|pHmp4S0?9`Mi-!0#I93#{d9Z<Wa
z3px1+&aMxKzwhOxc;SBV|4{drQFUxv*C?D22oOBDyITnE1Og;jaF<}g-5r9v1lQp1
z&O(B_ySuwP>lVr0=bY!f`+3{<{kg5(KeWZFT2-^=9COwjqmSOl#b^0!!_kJ62L#u}
zppdW3Ho=1g`zY^Xn!n$iRZ@mW&f%dDFu2B0Dc~?IKmvq(x7Uam{%CYN0aeT7=i47e
zM6&7`brvYY3C%_+?09!95BsvKY2(yXRWNNIj@p8UQ~A1%a9B+k6weJ8s_HNBBkwe-
z90P&!4Mcr-Pp6rdu)Do8Mu1#~k3~wdhO|Fq!h~Qkywy$bx@bs9C>#eGTFt=*32e@C
zy&LUd*ooOo=+8end3fyHc|@J7vD~_9w}+G4#KEH5<`uf5-+P*o-MY?6gvnc2-5kN1
z|Do9!p#X8%ud-@mdWoT_X?daY)iL=U{aYwxAN={B$Zw4ze+1|4jJiaDsWE%fYCnHw
z#uYMyl%?gu;zN8OW60EG`tdD$(D%juQPNAOvu$k6>DE~uEd^213(SUk5EeUwk)P|v
zk%B3o2xTK2_^kKc?BT)*oDjri2ZdA}s4#`E!dr&s<I$mBcV7+Bu#z}$ZGI{R+x(b9
zlz#FOffekk<3W=wu~5f?Zp2J-6m3hGpKr5bN(MzwLqsYb<>g`B5r3ok2eNQXmR|1k
zK-9N+k;?QJ<!mG7a#L?r=E==2kXuAn)a<o$8WP<K=3DE13!PM49(AwDhqx^og%a6#
zM)|U00o#XB!=jx=#-2){RV5t>fuIN#i|0kWIcw-yk~zIJ;E7fGy>|e-kO9vjNF4uX
z)B1#-x25NUBu~TaKRtA4e+4BLM_sr=0-miy=nN~2ruSNV+b$AHyR+ltB`CQ;?Ge@*
zcfoVK3{7lFSH<Cq*!Bh~BoSmd>%&C)g@Ajm+ThsT+iw>a3nmWn;8J7;2kNJ<#dNVI
zr$N_*F{`oJVl_Le0om)<kY5Sl;6A^JI_a^Xxg{#T(7kTe&GdseoXul6%PgmX{NChn
zXb4CZb%9Y!=Isuw=eMUePBQ^28LQ<EjB8;I#cdj?eJIX|RL!@sN~mUW`d4meGbkNJ
zD8Au$Xucm!FIoq5zW9T;`QYfEo-9rww;9~4E5IJQ=BalHax6dJvpz{a@emXKYw1dR
z5tK{6D}6AO1QQNdy3bI@l3tFwr_}g>jGh*+t}U`BgPP||3>m!a(?!R3h1V+mQNLaH
zEph}prXRfe>1{BQ%+QvRoSPN8j8Xa*P03yt_=(`2uUd@!A4xe1@4=Zck@=xF9DAQ&
z4Bm+^GkAaQ5PxNYu>(4ls??u$mM=F`A7iNv5_5LxK;F;~&hHE0a47mZ3HS*V*#j;L
z)xthXclLQ_FR98c*#r*-nYf6z!lLkX418M39cQyi-qEv>G>0eR-e7o6Yq`^L9~L=M
zujr~XsP#HnBj~REh)s3$(%buD6_|IQUR+`bRT(nP2vV*2y|Da3dd}DO_QV5ZKQ;_s
z@|xN8&abK0(;-w1hZlxW8W8&1s!@K9>MVu+@@=~9M?ieXd!TOW+nkx1cv9%AYl3%F
z-k|PIw;1nr)v3d=Vwa>Rjat{!hgbJkMauUUnc!`-Og3TPK838@_iVB9!e|6KJW4kh
z`dr47W@S33-&twnRymp%p~GOYTYLCKI^mg2L*LcL)&Ny5DgiZydgsTSiz#XiLDiaY
zX+0G~C8Zx|gwgH;Nw?FZLeSk0ob>=gXDHgnD)ugzddBd>WUy0koWs!+s<5yK0)CzD
z{8ow!65M2Rv6*RS14&yl1x3^gc8cAxX7oN|MvbPSv9Z0@M;DF;>AM^w79Vk(#Ix{b
z6k1V_YIFC$y-|THxahJeVU-PDzL%&D_iR+=LHrcB`-Z0baw3g3nv$O-Q0<5#wm~MI
zxW;@Tv$vbcdg_9n3I`#p*5Om*@^UQig7P=q#Tdwyg8H`Wvn}EXkfP!`#REt)#V(JM
zj-^u}pyH<OsS}n6m>@eDkkc``!z?xeem(@rG2$}TS7hkI>WPRSvowJ+HP&rL;X4U?
zsj2g8C3}5Uv3uGux^dh~XhZ$g+o43$w46{HD&$~&Dx1uk)vV64zq7{#7p*A&k=yo?
zc&=~;%kn$q5J7{CMG(9!dxDTEpXx+FSc1l^L(m*-Sb4_9uu6Yfdd6jaA|OAJi%~o$
z#wZ{pL`ux}!4xGbAe);AwO*;k>yXRde7vf)DscUoxSqUKltTHXvrhs2H*vjc_MFS%
zc=qSFNdRpl21rs^p0Zdv)%p^?dA7@5LJ`~{xS?qeaiPWdIKFLzTJ-Owqju@;f6<Qw
z*g$lOf9i`p^6R;5V5N1r!hdHwp`5;G(rwSoY%?2*Mk{l+T+AJTx7cD3*R%wht2z$Q
z;BW9CtS-)ewa`We;;GFq$bSTN%Js~-1GOa%=Cag$@C+cEeKTgT9k%{efy=$Zv#^-Y
zSnMaqYgsE9d+ZOInXXz-rXi3^lwN6;Jp>uU$}@!#Smkv#iFR{1Kqlk`5(9w=Oi(~@
zfFxSf&$QRVo71BMx%qy!2k_s9GV_Br%+g<3Cuh5muw!3}ETo((rP;hxSl>8eYD$n<
zgiwf)$#lAB_1Jw;72}1`r^N$%=L3O{6|9Q=NkC*Z>|!g@%mY1Hwe(e784dAygXiZZ
z((9#6#XwV!dU_7piVsY3#0fa1!3%uWxE`*L*17tB@`|%4Pux5bBrGs~OKtZgK(K51
zW)cxyg(VIh^L4FVV~oB`8|h#~y17Hf1{YdJn1|FANQ(%md)NDJ0%_D8&L|ui(v4&q
z9|c84YfbCl004R66(ZCj90yS(Cm%z#APLU6yhQ9$<^@k3C^V(%-LPh9$|rX7g(7_%
zWHOvgsL5nsdpL1%o)30#t7;Rib&gN{luX&(7}mBT30v*ZSAn4%WYP^n%F0wz)Kkr$
zK7HaSb8rAuc(Qf-#tMs7avA(GcbK1wRX_w`&<jnvpbMY25-a13*FpM*S*eMR4*?rK
zz3>E7X`wWe+%@JyKam*!jyat$Lp?Q}+-<ZY1<++~wTC=@L5>xsL*HIO2MSG9ueTmf
zuYU37b6S2Qz`4bPQ*bjfKil0JAZby5HpTuZ*ghzpl*w~Zfy#JtoNbVvcN`gruZ=MD
zjcfdhud9~?rmTc>eLBA_&RBO>GJx2{9EvC^n2We@_$F|Xr}S2rRGIU=uZ(v4M<ux<
z0{z^kd$zTS%$1cMN4i%rOmzIviJj2a*;W^88JWY!_o6E~%vby(j$BQ3jRzZsw<pwy
z(s^dzRmW;Iec9>t!@6qp>6hI?5^Q#;BM5IqOL+I=tSF#0D+(Fg_&#=ha5<*Gy?tYS
z{ItFw$4!s>=jF}&@|!>|<sVRd8ROUex?CnLabHOL2#RMcpD;e578*ZkV01)U+UrLq
zx&uG}>=Uh2WoQEet|Sh3fmZlX9+6e|HpWmlYGyfmiRK64EuiN4DplLGJ7cZcoOG#-
zF1+Z8?cPAW26t77R_2=m%I)5y>rwCfz(82qr>h8)D(BlMP_2bRo;<l0U&{V;2@uN2
z6-{&B*{#-9yG*P`fNybimvgSef?-gZL(d=dki-e6Ct3kHwL3@GM+{DMDf?8)e09Ft
z;J>%sSDtLjIc|rp^IhQd74h`(^~>RmLZKdh?I%)4eN=5QjVM2yx21{th?0AyT>EY2
z7oQS?hNZ3j2fBM8LSuu$(Ec)HlUDxhY=O<%65Kbrz?jNyb3Y|nkElcXwrSper^<Ra
zW4iP~ESBM%j|!RTNSJm?k0<EQHVD}K^zgkTLmTEeA-j=l42#9lsW1V>A{Pi0?WyZ*
zc~JtmNMM+_pejSy%a8XL7(?UN{Ij;Zk|`t<x;SVOj1?iSs~!z8>XsX~4d<m7=Xqbu
zwxR+r*X;|r<Ki2qYj?*A^RO4w8x_I}qWC8b9)9)u=OKKL8q6c)%?~{H9CYw`0w6X9
zz9+oT3!hLmXKJVveeGv?`=r9yzhT{Qk>OM`7I5Go<Qb*qARPr{+iM+r7X{-mboC&|
zrI2~Y@=YG_xdvI(9MHsG0Pb&cWWdmk-fE6!$%$xNwX=DQHKL#3YUIThwqmz-*0wi}
z4dZG|;&?-kW2yh{WwaT%^|D{8=TDMlj{x8j!&^EAJ~PqSAqj3ot2CX=baV~yAi_#Y
zg>=}o+(|=POKH7=_u+;Yb5c4*(OQ_46t$LGy5aoSSxsiS20JuB*N7+AqQ!xv{)o@|
zAd@Cq{;`rid{g%J4bIL$rZgfPoKX4tRZ2rh!aJ2ZABesr2S>(uX5HNkryF0${O(6+
z1WAitDl)f?m8XPpiq6ii*_qkFcu<*JHv?lTZ<E6|+gj&t=-YXjX`RO{{Jb~3_odVg
z4Gp~a2p>m7M%y=(DvtOavCb;ki?l!<!{&IkfP@N2H|g8%A_Vnn02C&pide&|?>!!+
z>PPkZsBN<h!a?Q>M+!Z?*!Y%c#Fk}#-uI2Q7PA31Xpud1WG1!86PK&r_e&t2>!T%w
zO#2j#`*3+$@MLlYTs+9JKEbzh$V@GafGc9Tqe`u`xx(!)aR{Ibzo24Cw-abp)C!%3
zLLCO>7?o;tKx*me-djiI_JmxeP~T=&Uu1swUM+d4^;o=U;+Zt_Qh`;^f5rHkhVAAp
zh!_!+p?k{0+~1Tk16}_MW-(}aDRqy5Cv9o~TgxaX3M7iAb(J8iaS*sJafR^IIBZMs
ziG)C-1-W@losd+a6+7+<K8iVTM%3Oc;G@OSqdsZd#x6Ej{Kh50g)gQPam8acJ9*Q@
z#Z=l>^(TXC)8CTQUdO1?r#+kgC>pZOkL;7jN%2k33(kWBBm)nuQPoD!S*g;I1zlgu
zfkg>2IUQH6N&WUopf$RzhuO^*G8FesldDX+d}Mtvz&M+dYbE|&4(eYhg)n3)l(2$5
zi)<F<Zy)xC9?I3#wYk0&08~BV^#21;)hqS1StZFk^ZM~9C?r^MB1Od$+AtYk_Nn}>
z3I~1e|0z-{Eno$}1n9Lof0EmKFkVhnV{u#U0aYSJ;G?30h6=hL62{|z*c^~_Gp677
zZ8ACeuX<7cfdBx+<hNfDc8=F{41VJuJs4iC?V@%&6RZ!q${0gSmCK$_LVl|Popi}R
z<o<pW{m1W5Gynv_1M^R<i=P7auvpu};iYuRfP@PJoWZ*M->$~*UH2c}q@EzagnsYU
zMf?xP{yq)xhyfXEvkrp)%Q+FSz&XtSKVL^c3b~AJLh;Ou2K*)l?;ionm2Ci+emoy^
z5(P3dv7x%yt>w317^nQuX-M&=KmIq~_}sKHOlfiO+tTM|_j~|K1<w_7#Ymqa@WTbk
zp8enCz@K=2|3qPSG~mrYKcWf)03xeM^}+rf_x=Y|Q~*FcSv(N`1$h1G-@p6td6bCM
zo+;KCic<eOb=4CXz;lCtS?oWcU=_l^I%%rCnf1>t{r&B8Ltg)Xq#+X(`hPlPg`eD#
zc<0E&xJe!0kN&4s??cffVSq1#SKd5-P1OY8e`4UbR$kAm9Ev0Aqx;k%y+y_n_zx(0
zo)|*=<PTEGKPKq?qYv=+wFKB;c!E!c{Zu%A%keHt1E%lZjv1o{%;)#SKL<t)OrayK
zir%5#uOa_K&r_YiJ+u9NZyH$veC{KJ*s~ruHDJFxn;WwK+2FtK_g^67KMv}HJuu*4
zdq!&Z|7p>TmI;i1=K}nv2?=llCZrhlf7KX2nFlD+kMm7g3x8=r{?ncR3$d+`BVu41
z;t4-pn}u^fq0mr$9Ie;)zo5V#X|k~5j=L!N*1$_bk`W@;s}QWD=lmM+?*cdfzV^d2
zQ0fuGb1eRxJhBbTbLsZ|WS_5;m;X2xdx@HpvtG}OMAtv0uPpApW=LS*X9<bEqnOUF
zj;AKqYR9<fjSb~qH`LBp1P?GS3PI{(|H{MvVd7qd0O$O!8-erHvxVqmo}4Yje4*4z
zd3_nJmyS7<jPwTHc(f)vsz~%y|A3>;Wnc44=e<G6cKx`)G=mmt*yQ+h%XOc_NDr|f
zApDIg5&{SAd11R{%Lyd<Jx}QqAqWEq3lRR!y^x&V`AVf%tqB3Xrm@zrLin}&aj~De
z#?^F6=rT7=(jD!jPK8l;a_n<D1>$pwV*kdG1quL7%!Il+I4M}pN{_9HjiPcqKB=fE
zXHZK|1{yUROPo|#l955eVBK=fw`*#sug3E?<b1OU@if}Xu#|GDpkr~}&@IB?T*k~m
zy&6|abB}?Xf~9sl^3z3|(MN3nbga_fc4>K7Z+5US&9lUR(zkX1vWp#9IA2>p7!K3x
zm0u&PJTl|Nwv@ZMQa#Ds6ZIn_6X%n_ARwIFyT~eP!Zi3@yTQxiIqV|&C*|*C8KchX
z@~$whw8M72Vkq0$euu)GnuQE<lC$Hk%|f&3Xtdb`#UxiS$KH-+>O>i&c~I{V=U_M8
z$99JiBNjcsSFU23#$=^Bt{VEC9}+xTloFbHTX8FHxjR-LENRR_WvCOJugY%d{&c}v
z?%}Hbkj@L8SZhQKsj!JCx_$3(R9!SZF*Nd4AtpC8Eg6|Gyld23<g3&G(UATAon(>6
z^_7O<XE8C=_XgUxBqdS87!GQ+dluztiIi$QY}ylHgY&-j_196{HQLn;^m}Y5jJz%n
zRg&!(%2`R`M#@GeM&jXbU=gt=DqDW2yez7pCR}{A3<aa)`+WlX`XG(xn+}tjfhhBR
zO{i*yM35!=xr^ES?bRi25wezp`69;Ma2gXP{?-$#%Y^5u<9F^ijOvAVg9WiARBl?@
z4oF8!aUiI_F@5WRU;Hs5F7;s6U-h?Fak;TPQH=^W8ic9^iG!vzYFoXGrtjWSWVt@I
zeVg+WNo*j8$2V4smN^TZuCk=pm#2cm3{*bfeL-j?xX(jDZ(3Nettixg>M;F7HmdSO
zGx?9HqM<}QP{t$uUZ$kgf96Z-hxe_Y46(8>tgYSO>spk+2Elfo_$i`yq3y5a8Q>=%
zH(g))2J-Feyj>sB?CLR+N@(`IJZxJdndariLPo8~czCxve+USDcXx6IF|N3{IJ-Dw
zZ?l)IX-Y<VX{b2_1qKqZTETN^wOAwgzW0$4y&~M3&UUDr8gxN8u(`X*M|t$$!`)#w
zocmOVgN8g(D$WQQ4INIP*x5uwQjD)wWm70^e)piFovxi5o)!}PLmDQ0-9LOyzG+ML
zl6?$bl-);5ZOTk_B!8r;p7}wuQ5|H;`h92|bHI3{YBk3Wmm!t=SQC`<Zob@GbYgPS
zWU@5WLM9%fGZJ*Mr&#r|JZake)1JJK8y+8@S@y0d62Y2mE`i3Jt!Z3qQwLP;^@iL=
z?i7OBS8Y--US>f-!?)c&j{F{uj8zX76Sy~YMC9a9R=0o|5rSN49F8XVAHxV(#)@_7
z(ZMAz5&N_qOh=!_noQyi7A9aTa|Z+r?~m!Dc04|Gm%0<0%oV6i<mOfPE3Os<<^!lT
zy=K7bqu*CK2H`hw;=C2d(q7-8g3uTfm-=S^NE@T|z(Q=zi9p#7!0o9vhdFz6fcJJX
z4$JpvvTk-A*jCl>FL^#8AFWSp<bkWHYk3)1)k_L8f)JZmOVyGS9UGQ(<jh`$8;G*;
z@#DP3)tva{?s_UEd~rBdr(J+c+&o_(Ii@(-G2f=*P<tclA+SwN4&vNV{^TIl8&k2;
zynX7xzSQkr)oa3)qkJDkq4k*7uo}ozY+C3*E3bv+Tcs}~xoDK#pnLkm?dcNMO(%vD
zTt;GMoERtKUw>U|w52$lThi3$U~vyoeaFe#nlu3DUJ_faW||iTiG_4p#;DU=Cpjg<
zHJp>Ye_^4;Bz7ckxV-DIl|~8ez21ha95YORnNDl<xNct3skU6N50tw7+1xD<w>4;1
zKt@41SO?n817F^3KvMGV8)Z9xovvt$N9CN;zq<Y)%NBcmlDQn(Wl}BA+Hu?TFw~{o
ziOz1>^OeauSC}(8JG?PbS?SEto`Z|2B*^F#JKM#0L(#(dY?xi<7+Oo?jZg6;g<qGj
zGY{|kne5HfY0R93rHJS#dD}13VmX~8>zNv%DI#b_q(ypB!*^vjJ^Gun!Ks1$>!`n{
z+RgJe-(w+y8F(pkO09_Wtj~%1Z%>b<Y1M!S#+s1%?3wLvL2G$T>`H|0E|c=}mQo3P
z;)}1Z8(5H7Jd|*n?oO8u8NVc&;F=T~FCe<rtZy1s@f$XmA13r(w`)>t_jS?1`+SfY
zPB$vt3NUp)w-Z#qS$%|N#vI(8195Y~f!}0)lejAsNlB#Tom!jcZ?G%aRWw^2xYc=q
zgFUrLtEAreEn(!g$E%%blu2$|%E8)7M7$;aRhGqJwHu~jwoVmV95C7X$DD#$Sy-hl
zIW3wSZ`g?WUPf-F>x#-3C<-enUC*>;%D&vmL@!jBnj9Aza9-yp@D@eD=idCH9hsPz
zD85C%H&yHJm7ZSaxlm9rDl^)|ePzjT@Lso-E}f~#h1i&}$#ixbAhd|OI^92MOd2b8
zPg2k)#nK)a8%8^qK7y`^oo-KV*U2@+R||@p%&zS<kQqv+>%88@<iu|AtAWuq;~Xp=
zQM}zBdTK34N%Z?c+N}V~z#P3FjyLip{Stmw{F~)iDvhzZsn=g{SS{YW-^9CVx<JXA
zo;)PjxItfI`k%o5*+dfg!x`ok5I@lp(K)W{UQ>@$-l6HehHq%-_&EQwIa^KL`r&e=
zy9Y;vaKenre8+Q#`Fkg=+x3d1#s_@yQl;%Xbyds8BUi{oVTs0l?vtyrp*^|L8$LF8
zrsZC8P%M+Z>h;D~a6cT<L?V6G!kb4F*y`zW0eDOcG<JS|w!5x9ID}a776v=IzEt=+
za>$=3rotS!k<xT7J(Jn-=cQwdrS6U#7jqSEtOj%2%-z38pQiEbioqo;eS-J>+_8cU
ziY~?jR86JRg0(Lv2gSsO)0X5N8G~M2`@Bs-ZsI+;Itvoro}UBJ-n^>ZzPuGbKDH>}
zA}GJ7B_vSYU}_UkS&gkx7!89Wx?4yWpr@1Nx}$R|g~#}@RMkwV1=^V<$meCGVagdy
z$nUW~RxMjfpR@6NS8BSPxK$EQXl1<0(1R-ay7!4auF*t7w0~>6yS9;o;q_0HB0|lq
z;_og7?0@D31CTX(!@yww?8cu6uLvE8k}+c5Brm<sFjV`Pz|PC>w-E_VsAb>s4isr8
zyy3YLhtSW{wNyHkzLacnLz^~|>v*0LALYXsBFF%nN|u}TBod8Zw=I?O!72pfP?h>U
zrw-^F##Yj_*@eq0<s#ur9kLA)f1K`RSS@mO@jE_Ovgl4^=PT@mFL<(L(jPW%GjK%o
zKI$djlXSVA?O4rTenRSw_#yh`r=YE@Y=$K_**OIn8BYUP`jb7M{Z8IH`Zs<==d~Yx
z_}yF`^fLGM_DZU<q8<m(5Ptf?XR{VElaX1-44gNzGGaH+Gr=l*ZaxN5N{s1uce#Ba
z$3s%C7BM!i&#qR;e;<`aw(4bugN;j!sxtFkP8+jo`4lKPYFVlw^ib&8B=oY%1Lls%
zCC;Mes~m@>HTY;k&X4SNtK2G7&E4u|3;r)DH?$iKs1pXb+nSqs4_@)!Uewdxz@967
z%`AkaEaHM-pJi_g#%-DL0zKIS`Cs%eU&?$<{|1%u!|b2{loV4jWb!`CQv72%Qd1Mj
z#i+c3$1U~OvqKNeXnfB?!-Y);3}G_l<&UXnD{b_VCa#PJ`Zx+5+TvIkAN51nu2==v
zNWSZ~aDBmgxig>sCDJQcCSZ@mG1T*BaD@^kE}VMq<#<h1@wd2P_}#9yD#CSsVh+u|
zGGv|2phnkSNxO^1OP$wO0dTsckI9K|KIjQkd`yeax&iXY2CG8L%IvRLkptpr>4p@i
z#}GbN1a9c~Uts)bt#UNs?a78BnG;ELj*$%Fz1zuMSsO**TrbW1o+^B^&gm|7l2PY@
zU#;Xy^P7|>;1vQD|1zZ<sq{I=^^?+z7XGT*(!gcpkxU=2_6ku=9VOSgGnpIOhp<zg
zv&C|U>FwBEe=&ToG+Mid4d}7Z!#6WA479yZ(i>jM>hiQDvK2gMPX3|zfh1U1KoJ1K
zr<C{hB+XfrPJ|Z(GD_*4>0dvbz7-kNsQKE~V?`OByfc@}{r=}Af~*HCSD6dpSON-;
zR3+B#Du*@_cIypS<MB^h_H@7Z?*klMoYRe&_e}A49U<-b_t>Ibl`jYP*>9%X&icDG
z=!@t^&+g9Ge4%A?hm$!bn=HPpzQtj#!)&YT$Dl*$z9N``cA8qNb$pA4Y-p~{;KuXS
zT@JPNjS@<=D1srSO|SpwPJiXsIP_!KQ^v+oV0=nS@h7^-K+!@(v#aWb^OYrUlFlH!
zC2;+dNI6MDyuZ+2&T7jKfl4_Kid-_%*Ne;b*v)0t4x_Ccp=HC_w{76&^{6%avrl9G
z`^wQOcZSzDYxt+;hojv}!HcicQHZy;Y7`)mv(SjX(SM{F&B)2%y4bUZ44{2%33=V8
zz5wHXU{6&23F;2A19H3XQURZyZ2Rbp+glH6zz@-?S1ToWC&MDRlSm0On;sd#ft@is
zR_(Gg*CEeb=2UvmzgN14gox{-a#Uriq_b0ppg#*Zhdst)0vZ~>SB+v-J8f9v$g)0^
zswjlL!7e;>Z$}ze>vp1Q92LVaj^$y`E%G3Fm!87gDBb6JqfP$B2b8z7M&l+-Q)9Fy
z2d+FTulK412pFl}RAx;l{9#9)kUsn20R-KEDRIjGn(SdJTO=T3UHA59J~sFJULNbN
zyg+G$=-NE|QT(mlp_|cD$J>-rHdSC#-3eR!6!<CN&d9i&sXT9S!DS?FL2p(~JkH^l
zf>Q1KxFgN^sv+Im@7d5-2U_LstTa3@nIcb|4T3RZW6W6FUwHRlhvvl-yTLvK(xsI;
ztz)eHicaQpHTOHs5WZwB)_@BsxT?!!N{<*x5Ej&HDEhO0+LLe0=FR8{j-7G3Bb2cU
z(F?b=6Q+(S$w7%u^ETyGwcTyO{z>sT8IbPyU1%PIY|ku8DE0y^ut2wN+kkyU=fe)i
zAb*ZBVAx{Z5q(fQ2&bfqB#tFVnUkqjIUvgUDvs2<U_&N{i-Uc5J-5EG=JV4dZb=I<
zVPL@r?=Nw-8wAMMIKqO`$kJ|K&YnGVF<dxb4n-xruq+L2Zy56R&j{yZsIF7Ih#oey
z8?X={wzMCKodx(6XdjrgsVu#|v=OU@{sO=<dJe>o2c~)Xq`b&byju(N4GnEDA9-Xb
z8-~gwE5=FAancPoU`VmJs-ri+TaI7!it@v0x^%W1jaA!hB=d3lD&%@=ve?mUs2`_o
z^;r7DB*)(-MXTb$2hYlH4%>J+NC(WGZ&DBM{TN4;(y%!yU19*3xJ{jU?}{7xkUClR
z)MA%c9dPoO4PIH)R*63<Cmpo?6-DO<;sN0Dr&br6-x6)$ykCP6lz@6f)6L3E`0K>m
zEHz7W_=1-iQ1vt%_4-ebhj5FpOY%7~9%qgC&8G7@LtgExRvA&di6S7_?T%r4z4S7g
z%FHgFH2J!0p8_@<FYBy2mHQ9$x<Cu+C-V}_THE;6;Lbv&iMO#`?2uN7G~JQi?n0+Z
zaLY%#%^}Zs3|%^r))xK+BMOU!t3(}7?XNYOEsZWZtlG%f(%?w$TTU@)`JiuFgo0y2
zfxybk_Sf3-lVj+jh<MH0H|`G&F{e!s8IhpqqxO!0i#}iRvAAXE?9^GR`qJvn%zLCh
zrIHAWPbo*XvY1&ONYRIkF6gim9E4{h&EA01b%TZBcVIUw^LIA+2FuIn;$Or*?Lk$k
zZWgp}@YXL70k;*Wep1?~b+YHP>MN(x9`~l3CxVK2nKwdpKGEB`C>FlkFrI6=W`ahD
zRVx?#(JoWc3WOf}X&Ogz(l4=7WTLTsr^kdu3_)4it=6~X<n_`&h0NK>bbwtnVKuj9
zDnY^bpGY~vVx_SKTzld@_!*A6&T=YSz2Vh?=Z$x0WO}~h!yz=}Ym~RrKmdb3t5lJd
z*6Y<HP8ycO0QmJAs~&Vk%M@UNXu@RhHj2ciuN}aD+8|og?5-HN0O4AlZFq;5D!MaZ
z4MP9kL+bhess%SD;5%$4KSzn&nP1}3Q{h>Y9Kh8Nb09*6uCbjK4qb5LE{2f%&p%Z8
z*KU{SkO#vBwy#MJ($l8`itm-)Rv*(HKXd70#rVqja+2^sC>_FKlsS}LFEk>M$8-)+
z)g>>9WNo)DnjM(>I$a%Ih)k|`(aXvejN^t~C0-h*aoZ_2pjBTS?y(y=-scSG>r$2x
z@L+DCh|wHhEs#rr4072?Dq|MOx0hg$7BslSuP&e}OEelPjDXdeY277IS3ixYE`$U(
zUaZb%yS8K*4K!J#b`QA3i}Ni-&~fhtexwq5yb6F1j~HCRxHB~RESm-?YbD=*Rh)Lm
zH(PB7{eI9YD*eEC_K*5F8UXem9+<36H0RgymbpQab8}84I9PCxX`o2+;qQ1;LcpyJ
zafp1e9;p(>PR|x^b*91!jozpoC5+{}2>KjiVyN(8&N4u}Km0Tj%){x^#b$p*h3bX3
zJ)ADl(vpVv3H6a>Sl7prjmB<eS)n<fl0C~w*z$(hI*2zFzr<KkovL)z_#hytH`Ai1
z6(k0K;qLb2l$G_>ih^KQa&jVPETzn#2jVIm@#%V38;u|`1y5!5S3Sl93{-yZ@~n?1
zXaw45u~sk@@C29OT)cj<ydPvnj!jXlAqQ3l9aXxmGk<89<@JxEyST)SPZWE+1^F<Y
zT<|QmC$;|Q%}Y1uo{>2vBbA-IfgX#qR3M%|iA(}H&l?gWuHVto6XCC;?I}w~<EO!`
zDBwbl1y{`kcNZ-!N0eJc!iSD|m52A<B^-;JnltBVIerq#S+L=0R|=Eg7Vy!3P=?-B
zYQ-%n7|S==oL}9J8+4*A;wqI4Ca}Rp%HatIjP=g5nTp`U!++>IoTz7Rs5w$@5j*r7
z#M$gk!W0FQQ;-$iID{@77HL+Tl?<Cr?DxbmE??446D%|>XKFECT+B6BI@3Ea38@?@
zr(1R0$oOC51NSlq4dF*1JZ@diS5kgSYjTpQQ>~S0l6mD{s$4hF+lhS{<|_g@Wfiqr
z&`BF{q0uN0o3>wD<7kTW&Naf;D{NvFVSmz0*`mwG$PQ<UnVG%+MiZN^LbBVwe~VtE
z_n=wm^-mudM2m^3Ct3C~qx~%clWC-V?wdZ}{xF6xZEeCYgxs74yAN-(TezY$j~?{<
zVuY!j_Ud|tgE58Uxm$YU+VFR@<_6JAdy0C;)vC<&buEI2qPi+dV0Zzkx6I`cFY9f+
zKdC9wL<Vnu-gIeYgK9ZgVMSrqCR)>d)e1Kilk5#h`SQOd0WXVDdkDDqusMsfo>@lG
zuP{_CABYMBzqEj0bD=OMYnPSv8<n2~cRU+cK9hssn;PJmOtMrn+Xp~uJX)zDRcK6-
z=$})z8N;XSCmCBjM%FGMv#5z&aP(*Ov=Ar!O7vG7E;|E(;D*WPOnrUdRjQjQ@L9%A
zmNI1K_=b7ERFtN;vmE+Zb>iWi!ENSZz-U~*7S^$nzJY)Ovg?z@N(}iY!lT0pWjZQ<
z`5l$(nqScAY7?F!<ftK%UzF`tXJg?p&YQ*&sTYjbitPYL$|5i7&WLl>J}+99t%X@|
zU~)i=j+PxV^pd_`@=S%l!O+Eu_Y=e?MkE3I!M|2-VMuu%>)Uj#IJD2JG<?sy!VL*8
zxDO7vX%Bl%MnJu0Ga4jYqsSac=sWg`l6N^fgkjE8tEXwwxH!<6q;g%#au)vg@_Is)
zWR#k>Cto)%6*x@P;vcMn>5HYld~Eyl`dZ9pSLXb<r&GZ1c!oIBoUh*7u;PM;%8bdR
z5B?Y*)GjF0AM20=GS&9aDdxUD@XLgdA<=y(V`4AW6s<y=48mnGWBE455#5OFm&WIA
z-5TO_eZ17peI_Us_UMmjI$DCxFc{B)0F{|ts6a&R*p;;#PI#9Q@_sB0hzk1IfHisC
zH1j{!#}Jr|Cks$<tJmS*fmyZpvMVt&GBd5d5uN2wN~F=5X9+J-#0_iVy#IDH)4Sd&
zLT5TSrhxmT87_#Y$flU$Y<tL^<*`RCRBmPO7dtaFQcgOu3?5WNTgy`%cYCz|Okmq}
z9W`a5T+BctotafVa&r^O*ioWYpUPb;wvT9rpMoDZsAWBU9BIk=p2Yep8XJf?BRwG(
zS^U)MY}yO)t&}OkwyQ0VNAU;~Q87!Wr1?=*G;Ir@7twhlaPL9Tmj@mXCo%{KlEbe+
z$#5XxDM3UN1o-%@PE%FpZq6`222#0fdXs%~OVVtp&*V@Kv)yiz|3$@nsD+fa%UU{>
zq1<PPF6KQO3?=#jyctd{>~()v%xEd}3=bb>ueGnO+Q?G|pkCNcKn(WRG2@8_KmzPJ
zeg0b~wR9H;b8#>-c)gklS1Tv}{UM6=B<EiU%}NWoXS9v0^=Rc?v;<w!%N>cIRxm&)
zfE$*Iz!TsqFYnrIYyS2-i2UEUI)Ya_B6SbB!I47O!)E`Y)OsDG2`uh)uUbgoHWa&s
z9^>^L{eflN08;Uzo8|#fi1!%{lcw>~^$+uNg;_eeZUNFS@Iel;1=Ute|7wkZ5!7o9
zmG45NG9sl3lIYnQWSGzF=9O!Jr+9bm_*WHGw4QVbAfUkEvL~^cA<X7%2EaqZ>2DU;
z{slkYNO=t^P`Ylz*aMVafL<-}Eam-~1M#og*Hqpw)`t4Z;7guKwa+K~Y2NckA|+4O
zpPLnBfA}8%dF0<Gxyu7kE+P7c<L`(1uM7NjS_Cbis-}+dH@5Ik7y1?cjN@c}#{)FT
z9|$0(oFt=NN&8v^$)Pv?so3|;?X#=nYO@41O<KgusuL{z{~xaIB%v5fn6rWFj<H(0
zLHm#Q_~}^%fV2-z&(9Q5SYc#E^PeE*zcE9-dZ6}|9w#;B{|P7l`v-x~m*V{A?)m+#
zm+3S9rl!nE{Xd4_-yQwjYe22;w0{rJ|2+15FCb+D;CcGS{CEx~{BJh{8iM`59ecKq
z|F;_Ai39uF5{Moq?MVLJQ-6ozc;_pYC(}}%lNB~3fXA}g+8@#YW|<MxTHA6HXA2Jl
z3DF_c=8dM@^g=_QfZP3>zH+?($=&7DAfmWXkfL09dcF!31(5#`#90mqYM+4MsBA8<
zuL44JeOvB>e?9(F9t!9gfd(~YECAKnBRF4X54vI0W<JmkB=d;=)9JX+nI5<;|5rVE
zEkJ(zqI6>WcS6vAJ@Q{e^3e5c*<Fkbwf`k$@E;?(qVzmjXfK^C{`X1OQVv*L%V}``
zZ}s(m9`Bo&=X;5{EdeF&fis$wRu+84G3<xpN;TuSPi}+b5*u<%rp+Q;E-~41RP1AL
zE=|}CpWvq3pBdHvWnb=L!2S5U6C9q2zbCX%u7v!;%J$PoO)b_ave!~|jj$Pi=K@Gc
z)!5PTIo@EEn;kz1m7o_m987H|(MpI(h<*Chv7W@+Et#xXW!s66RNH%4e|PLreL48*
zmG_3`;F(BgT*_wcmd}6P9I#p~Dxhl_JGP5|=US0@nE@g}8~xK|?u%)*Ef$Mg1G8`e
z4>e|sf;%@`#b81W7hG(di-WmcH6fdNrP8yf!*QAz8rMpL;BTQRDQ_;Z-wkXJY0M6#
zayuv$s`d^H$Y06YS5Y+|9Mo}d|2@%(7LLz~SrK+l#39`w!MCf_rNay{8dvuq7Xs5m
zhWVjCNrBRWfc3_l2(Lyxo4a1Q=eE>wPAIOSiHZJcV?v7g{m>%Ylp=aR2o`mr-i4o-
zSi7xGX0lL0QBMpV9bLE~#*UuV<!&Q7I@)B~B6}Bn2fVXS4VQDWNzU~Y2%+Lq6l&Lb
z{&a{J9xXEZ#{I!c8lMMyQ+31BBfW;V`Eg%4S}$xld+hWLpyR}d;#gr}E7b)i-)j85
z)@%ZzIjWpmm?h7ktUxTRdcFO6_Hv=Une2Ed9J-a+biO}_i{&S(0vkHj23bR=%R9;W
zutoYqjSzagKBfHMg}GBSUBqJw3v^9=8!*7;3p6!gPABKk21!0w81u0TAwJSVCpdCy
zn(ZO20!>h4q|-|Yg<7lraf6}Y$Mv<f>jUn93j-!1pw?t~A%M*YriH52=zc~bxC;{U
z3&Arm{Kn|&a?nAo-ubYmurRt*PsYV!vUvLF|Fs<dOI0-)lY_SV?$sf8BMZw!5~~pv
z3k5m3WD+OlkDaaBu8M3piA?45c>dg?+wS&qLu_?=wfxstX9u^zImJ)E@R{@ueDVWQ
z;m$vP6d6jc94WSzR2K}5ByfA}#onYZUh4lx@Ai3hrSS@wW_NW!lKL!WoyXpre=Ari
zTg+-JQDJ-rUf`*pthO#R&NJS9ii*KS%S#?^>|v~DwfK`KB}V=;N4{`X=h*}v{2?c*
z5&95$)1so1@d)uRpH2(M;Yc5k4RL2Nk1G!M+RoNQXu?1qx=xZw#@>=atT9WA!KC95
zZuSp8k0gs69`5TnlZ7<arLl)xqN3drc>FjirRq%tSO7!VY1ykirQzCWykhp3dsBEC
z&!WT1yH{?!OrG})L}j|yd@xku*qj|r&XW$u5Q#N=(&>%!ZBERBLhWIx9O$^1v`dd8
zk-DoWD2Gp49zu}{`XdIrL9D1b0|M?2hlxki77K#Z;qY9+abL%NYU1-QPH1)U`NxCt
zd44jURRCqQ7k+-;zprIbQB{R`WH*~N*EMT$e4^_pf=0v-J!wi!HJ_Hk?+PV&9kg4y
zwaw0k!(>auMLO?1t~mVq()jvt@^Ny18V;j0AUJ&a;TT6a_Af^MbGOyKSc-4rs+68?
zkVqF{w%&|#)uSoR59TNi3Nk)vZ$B<^BI^|0osF$6<fN&^d3s7YyBeD-+ulaa5M;Te
zE2h03ueR@uV8>L-CF>%m?DB1@i&s-v%yMKte~<5*zoaqm>9m%~w*r1NWTIW1D$q%*
zJ8^JizoA}f_A9AZ=uEx4iWxJd?6_7Q!7rUDn>JQ;&LLM@rIqxLqukmM`&?1Vt7+H*
zN^kO2!_<v)K22L{;i`W3euY3WX}B>@Xz?>mfwA(;zD<8yYKqKcPg2V#(%w0FdFfq}
zl`Xd5ij+sGL8W1njWK7a9NF=)PR!KCmRial15rWS_?(h@;d=AehzetLFO*(c97{-r
zOxMyH$eF=>ladOkug=l-a{jTTp+X4W6-s^ZHC^<FURt;sJq{{J%n`0H>GCC4kbIjV
zw5+Zi=+O50bo5q2!_*`Mpo%=Lt`fHkvSw*PKuPlPa9}x_aOZSd9*E;zQlG3Q+4SoO
zKAt7k@5Ezb&J!N(n5dNC`m}2%GtO8xq=w=?A)aov1=R)oYNU{=Icl$hHy!01179V<
z73v6S<!_F%+vg)`*4G$e^!}mRuXI1Bo>>VE0fV_==v8>$zh+i0oFFAdkFl)0m73aF
z>5ZC3n3!c|s8w{nWfDx@5<z5{qPb0HDr(L+L}0p@kx)>u$DS*!ezWxGFTORrH(!YR
z8%;*uC{_b)bzK&onuV9(_siR+F&TIPL}5SHp!eV=<3K>Oy_Iy7iRs(`tT59FOW*$b
zI<EP$247P+xNb$<G$bgj%SI9bVb?r}r~7D&L0vUpkaKu&ALZ$2vdISc>6DWxMz^tR
zDl?7P`<9zu1d*D&yEYN{NIv~aB`WN0eQE9f@V{yYlUV3hWQ|wHV&JwUFu8pE+!}4K
z;!}zdn(;YJM?8s1ai>a|-3KgP)s~6}uJA$Oc-+(gmOAQgyIt_^4fyUJ+VN;EG>;|N
zB7nm6?+}%u*Uoh~iVdB#!FOagDVx%bjv2tD->@bm;SpY5toR^ZUnj(xhNi0Cu|XM!
zD-9bwJe6Dr>oSX7&CtWUdRP#y71yweWaRjlP80dCp2u^zyE?(X(wHle>CHa->cR+D
zJCybVUN)65HF-FLL#H&-!VUPWn)S#<|H@<+ifG43rP;qGT|<5(b6YfbcP_fsMwsP+
z5&T0<qtejd168*@lb=WE0y`6#CH(Q`HSv~Dyk%pr{IH3sdL7@KE`PI|gWC^{&`2Dv
zd}xi0O1ku%Y*fr6@YaHLcg{I5Eh9M7vn>*~reIo0*&)im*_l1YQEq1(RJa{l2@*z+
zTAEj@3zJ`GYIqYkU)9(U8flrB?u^SZei<5Nl!iUEWtGJLm@udT7HDJDSyoOGYU&L#
zl`IL2n9-Iqi%2!AAL*uC*5Hq7`J_AG7k>{J*u^0&S{^qO*G<B5uM^JgS+K(gNW4+w
z?b!aRi{jH-9|M1iIYq)CC9;#)?eSM07>6q_YvZ~N63|S(?Wl7ft*fC?wkp@x1Qq?I
z*}DRQ1Y~JIbu$UT+tU;8Wur&uy>;U&#mOGh?TV4;sN|^R=%^^4W3n$%ryrx<|5yzF
zkqdOR$bHQlbZ(J{iMF-}!f;7O&AZQx@TZ&IUs9*?G&gk}>rOUR3&?cpPEYf*DMy@o
zel@QlcMBrc+ia)uTA+x@X3Y`-)xE<~o~wJeclImA6|0+=>F;hR@3^oM@H_b}u9kgZ
zY75>T`$2RG(hJlfNUF)u6P@V}ZzIp**Ui1$pTcP7wLfElm{p)rLaWJ1&-YTU96n^+
z#=x+pBKnv%N;rJND8-0&tYcwtPkd9@K)9AI2!$`;qx^7v6#V#i3UN=ez=5a-`~({f
zkpst)=d3(_o|$3NbkV!Dc$lp>i^vVa!6JO9kX)#`d?crehSL+w!&+Iy5T&;RZ%lSo
zNOl6R0@&Fjw2LFBv8cOxVnjrk1!p3UkBHBL4~+DlNT`*?muU`eXIV@H9#n^?5H1Da
z-zc`9#7AISV^Yrt)F$@0b*V{`5y8o9MQ8b}KtmVPTnOrvh6!6iYN8-wyw-V~Qn({+
zp!aKmo4A!DuO-vv0_cOznnI8{2zUj3Z<|`SL+LCAa`eCIDpuI-R5A;?v*)nVFX3@c
z6eQk~?GGm{_W;UfjPP&j+t1IhZ1VF8l41=5ksx&LMZ#FomlM^0lo@QFC2|qVhRhE1
z+js1fn9`purexK9nTok5^$VlNLVMU-cT04{-JgQG9dZ-`7Tgb6LAadLo$#@nAYxA5
zy{4=h+$V_ig6vnW`2A7N_EAW5eRF+xm476P+|@m?NBGTquz@XZGK1$ZWn#>(ryhpu
zp7bnTjgvEaS*;DNoNBAD*>Y8h+jeTFI&HP_66EJ*LFt>#ekClRx}Kiv=V8=~Ctiqd
zLAdY5YvduS&5la}Odcexbze%&dpy}#Mlef`mTX=ysi1jcG;5UarBMT!rUf!?Ez>m;
z$&pydSOHFS^kiwLXaqSFM!`G;{2PlNCp~irNu>NZg@Sw)+e3?kNo->i5|VWyj`+H?
zplMXfR@Cw$=2To<?4Y=b2{Q09%ln4{a%yVU1pFV2T9@ntT6eeU6Lx|bWCGzLy9u{{
z$9cRC(0+mK6|6U7(+snt)X;_5d_X|%U|?`$W8|;(_QyvU6$%mGH<JX?-hzgh01bE;
z1wu+J;z35mT7lfo{Q(wFpLZmH!_->#;m{)yE=8uEgzv2BME!yN?C{WmovoAjV@bw$
ztXju7mPNf5;q2gC=q}QEoNB%hJQHn4bv<PBYg@1~@hI*vD>&^qMA>HPA*|vD(VD4h
zW2ew?vxrpnp!&SHh2#z%?iB^i3Cfx8DZMoX@_HAE@4*`ceCBi{<OpMW9#M6IYcbZ(
z0hcXXD5rZgOYpi{J>Ibzo(mZD6sIUJ$Ld#g$awikq)F45mK@>ah{v(vFmgKyVLP@R
zIgyL6RPM<cKb%>|Z&&1VbsSGLhBGn{sc@$WGhM`0$AF~%#8LhS;n?<N?P{Fd+x2!W
zEtdoO{NA7P;qmdx6XpawWnW$w1_eLLreH7j#n`!7?w|34&68^l6Rw+I5qOlM*#uFB
z;VM*H3-9Ki;pRTQ{w~6lN^2{S5axGjtQ(b0tGF)Rit69!3v+puq6t8}e#L6lhTrSX
z51fKULsH^D6mPHuOH|_PsRh&T?d=(rNF^~{10pVR6d}S!-_!-$E|Y4Xo(pO_P1hjk
zd^YU0uaf=pvBPGTGy9mzjT_IO!)kBf!=nphJU6~?x|J=ln0&4ZQp?|BX+-ysEOsa~
zk{`UFX5qCK&;lDOYDIQo<t?Zt3}eIe1M7Nzx!{74?|TkQO*C-qd}KCWYVQQp@=@6n
z@1{j%q;?};5_Xgu@nK;SqCZ^x;+UXjGg^SCCOUGi`l0bT5o3c6j($dbGz?dW0RMwg
za71@E9BV5528Hh69=P-a@x-QpM=xrAM(>!7suH&6!GXgxJKxM)(^v172=d2Cd^uUV
zg$5FCHB<S1T~C^se4D2h1z}A~@Zn~Qj3Z=c9LjQ>{A_bG)1c;tdr~Uw`|9j_IAZrI
z*Qd;<IOmZ7Pmf7S*`a%Ic(nSRJ$ez%B`U78667!fzRAia+{Nsz-Z9nrdyn|ILo$=3
zZ>qa$C!D`yLwe7}4JF2{h@Sro{8jCX-l2s=wwx>J@c6*MX}10)Lx_Isi;Rp>*u9X-
z#?8${BSF!+#@9V2@3ll^6cLze@mwG&xE6<7n+9TJYAQ-SoyV!FQ1O=LMan7Lz<`8|
zNWDWiL(Jm-utpggdd4dV2$?s!z29fo1U_c_BkuWYQCgD9Yh%!8!1yMuqh?`XN7zTU
z!GFt%TJwunOnyhTQ)rqwGgF6N2*#c%#YBWhyE9#0)i*b%XhJcerBxTyO&B9*UK(XD
zHJ@vERb3|Ypt?i-O~k{7i2Lu52%sY7B&jYPg=O$KJBgLO;={p)e93NGL}u}dY`1sW
z84JT&RD11St$_#=%Z^ey7mKtC-V8OfoeZ|k34TKg`SFR`I!IFdvzXL+v96$PfGN9z
zomp}qWmV<^b8`n@y#nhQrdfu8(rSt5{ERfee6N5d4>5(rr}dZ=nkEe3U%PM7Mo%YS
zJrZA3#imO><o+B+d0<3>;_reIDubEbq+&~1S{$#+HTZsT@a5%o$58pIg|G9Jq38h4
z>?Ys`TCuV{;%YN$4-e(c2ER*BtZ7#0)SMHsw-{m+eSs5dWV-pZE7*!({-+jR79|ll
z^YiZIw?8!~^yoa#TNPN(GelBH5Xkq)2)~9zX_0cQ=es}9jD?EFP^IS7RAgu0k}gx~
zXu#mfP%V9GQ1&Salkz<?M?r}q8KU}rApMIVaDa-I*j`Esj4ZtCWa;4Iq89Dm^$TCq
z#S%lOe@k-AbZ|<<`s46DQofkrXM~A(j0QItL{68d@9GE!xq_cqmTXoc94~*ZW{&X+
z2?>=;;hKC7z(zuwnrSldNQxcIl8fJ;u<kB+(yaa9{Pi{H2k31&N-p)*VA5T=^uqp4
z?>M&Y7NFGkCs0(O{^GVpG3Jg47PEU$xUo5`V31Ht^9k*Q$Qw7E%0{9`9L?-k3sq#~
zhcBzL>W%^%AdoN4@CP!?O*$VD{9ql9w3E%#gfs|3ozxXkQ5`{Y*5(fABS7XWq;sWd
zt&llbrcv-pWUdSGQ-0V*OQ`i25Qz~2Dia{l_<WT@a}bGTdQEZ?>LDp!<>+E1S+^WB
zQ>GM;@kNg^+PsxBh=UJBf%P3H8!dqh)fE%%B!)R50p72^@((<{j)J>|@$_xW&?>7a
z7Uq681ag*NohhWDNHILm$-G_df3gL<OD|C{iq3Giv9eSDC{VY&IYODQU#f2r*YYXz
zriX~EKopuk+#O7Ivc;C=P4tuS;e=@GBN}csw@(8}MNRx+x&dKwD-}2WpPE`k;}F(Q
zwQ;-k91*`mY*A~OC)_U(Wv{uLkO^g~N?EyPuBqIYZ*JeGYZHd2aD-N^vDBK6l|2P8
zp>o+Bt7SS*s`1r+N#&yy(Ph+X3JV&z+@ENZ@yWYCD7P~CAriGdA+w0A(nLRRSF)j5
z>-0m!>3pjmyn+HzggaFn1uE_AS6pmx%N5HG;^Mk3QEzhJK6-p|bN)#gL^@rfve+Z-
z{w)HlhC!|Yts)l))L~#;p?Iy>5hNAU(Pxh*cP5cohCqz3Q$AjbPA{=87HTWZI~+u5
z$|m0Rzkr2BFqx*PhNvDvT{TMnS!dZB^y}yKWP!YdgoMv4%ZS$u4i4BXiY3xRCd2M%
zYwuWDXB#KwG*ZAn1_grSo<k>qIn9!MJ&^q($*i?fd^n6KDM;`lBUv$~883#;rT@Vf
zSERZA($d8OkH%2V4XeUi|Nc`g(Iu8vv!=ICm+Mw1Ueb{8kqr<&&`MK#I{20LX;k<f
zPVVjJ@IKuG&qSmEX;OPr#RfM9|5C&eRA(ISY2mG7z-t)oZj|uvsGDd{2E3iimI^*<
zVjO5<j6Cj_ACxa@>6TwDYNlv>FJqJqFQ#?dcM}(TPw~Oo+ME?Z1D8E{I__K2r%e&g
zNKaff%`~+jI_n=glFarI&BhAp-NBj6N9LyCXX97Z-Az24N|EKe2}F|f%~N#_(>$6f
zDn37%rAX1fwQFH|KI~nz-6w&FHq2ydP$3?zEqtu0qy{mY_*(D+m!!w4X?(}<^NLZ<
zZXh$p91X%M-yE8RKKm*hOb>C5E^#2t-y4S;UdS8J>G3I-H74M&yoKdi<VQSi6u+GN
z5tWQ}cTfblMJ;+(noIY<?20%9N`N)F*t+e5hiu}mpS=D1<7i!exwvF*<txA(nwec(
zUSQCxp<`h9jXyNlAHCCGQ`Y8qLv_4Zt$$Z^YlF$~L4JC+7bSA};%ZZI3Vo8FLNWy#
z7c;m3CwP1KU@pIX++f)4XaS#1&(1ls!+zq$Z2hF}Mm+3~+`+NQar}u=%spLrJQA>X
z72shDXkI1S5zH`#sa-79XR8z<{w5?--N`iQ1+w6OlS(qwHm|W?^h3=ZGBh!&Z-^~Y
zZl!Pf{N6B)+s4@O<3>?^aG9^U23N*Spo#Au_Qm$UmnWhBhr92LYqDA5RYWW_1q6}a
zrAwENfV9v{kgg&i9YU`W5drDFhYr$(fRxY_=_T~u6hiMELb(s>`=0k4&-rk_+z<Cl
zeuU@A?(EF$?#%pWb|o4lOgys_NcUM44v%;8n2Dr`g=W9iz6~)ANC|S8;t;7k7qT*_
znwojtY7Y%_!LKMDY;DWKdzrYM`j%>aEsUifunkowuJ(P$`Rp6cRnNWj=1PHA(O{+F
zlBq7iz7RdW-r@Hn1)e+hT4T2c*3{f@b_5fdU#MWYv@%GwCLTp@_`W1D!Sa^p{meFF
zaFTD?FsK4ECmkiWsRY+*)^_rLcl*wtXM5VO7r#dQ&S&de+?vJiJm-A>0tn-sc^<#H
z4L#lyl|^DumYM3%;1f-u?qrCy--zzP#xI!MM-ls@>-<jBEC=)F1lZeaKcnO$*S{JW
zKtEL^?QBY(kX%6-75!ipah!ME<)=`g9Mh|Q>DDaE+`rol5|1N5#d5+%3Ovl7p1=V-
z<kwULj&lZXc{iRh@YP4tZ6&%tpzPp_C$bGKU&WEx?%!m217UFgYyusbvN!sPFEG!}
z&FyxJxq!$r@GT{vgdcugSwigr)Rj2P#DrPH5O1X<;eS^uOK)fVvr?J5^|oA3g@)QK
zFLx{|M^JExwBL`ai&7V=Sw5Kcl~xm`S0HIg>9x8;7<&b?mWPICdA@00zFOwN$5>)5
z4_k|&X#{^Moec5VDk4n4D+T7jElnG7ii}|$5k#Vc(Z?yCMq$D#8v?VXMIH$_*k4=j
zN?f^$c}Fhz3d3W9Old02I}%rXh={_I?u1f^o}z)e5}24C;)l4vHP1M$*3eWD+b<bc
z&)l^iwu)oVT#qchN&V&u#!c!wtklgByZrZemyR+J9!wy&+XaQyy8;Q%ZBlTlFWUtA
z2#|e)=_vA8U-I&cs|toxJ>_VHhKD%x;+4M22JO*)qc=pV`BidM-mmv1sC}_VJ;1Rg
zIH8RPzsPiDy-Lt)+x*n*Cz;U%cFxX`C9jeVHlXpraISj*AwQ}4`-A?;n+Lt}62>?G
zc=G#2iLV&+X@vY4H~!}f1ekIXOjko_Zc>NiU1zfzaL=ACr+OiDTKXLHpS@9U*#NE0
zbcgi;FB@V`796T{k{Sjo(JFF|u3ZBL{gVxUe{g@eB0$siaFZ7;eZ}YKI@{Xh4j=3e
zG*z?V!4D74A!F(*|M`nM64cw5^x8gE0Yp}b;Y^7dSf3uf|0nU`?ikUta-tq!nM-E>
z-Q~aj>aVzRYsvBKpiJ<;J_dT)2L_%C6J@3Qo16d6++|%roHgDaW8{B!|MMpR4fJUm
zNLb7-+5JI;k0ZMThLAx+ofY1Hr}2)QC?M`UGi1jfoc=|VL=7?Z)s*5HLw^5DCHyah
zX2F1A4#Le${?{lCu*2UdkJxf1N&OE-sjD>d?#G&5Hb7l;6LV5H1}sT~_s`~zBrw-R
zI-t}M1dIR?;fa@{)<~_mD?z<}^WAk3Z@bsZ&(d7RZ^;W2VC!iguAHrlvgUSg1>FAE
zsC|MN?*KB-v`#pq1x6uHn1(6aKY8Ep3dXV$HM?1Avo7}>!3%dOGx0x089sd-kkg?{
z{29#~i65B#Yhz}7r+|k3$XW(|{vWTC$^kONa)*zx{O6P3FK&qetu?4v5C5E`e~9cV
zCU-c%P@FweIFMBSUmo9)nDx3H{>D3XyztN7fA#T-8W1Y!QnzWre-QWA*G4oE_0==6
z3LWfA2F)5=$D<TmiAD6566WG4JEBA5{E9j`gJSR3CcbOw?R}K6<sYaK`6w2cq5q)(
z5*Uf8mrYQgVe2EjHOf8$*rEcRUPx%@!9&%TjcMr?B1xaEIQ6Q*{>62K!H-zDS!ik1
zDQ_K+i&<Eea%;u1>Am>0h-^5wG1)ws4-ETKz<Vj3f9pr0>?WW<#4?Oe0R8DNZ~QQ1
zX<b-E#&`NSMA~h3vnlfUtk4O>0K0)tRk7L6T97Ff#z8?C{K>g!MTKg*(69pXR#cDQ
zR{i7i^XapCA(!tN-iun6!y|=id>+muXQ1-mgKG5WurqN=Wm*J7mk_QO+qu^&-ym9h
zIF9De21;o!X_62D6mRa!cLLx`xH2ZVXsoxeoe2z%HGd_}I#P&4!Qcwnw-rQ4I1EDr
z0*;)I1S%}RAjNkwGBSb7;CicNs#Y%&LPCd~L7kNILn@JITFTT)^O$(ICEwp;HrHu9
zY?&^wM1y*^Cpndhi<e1UFC2A4`JWnlxXv%Gk~JvzF~pPqRBIplOTJ({kOH*C2VZ^`
z@RbZ*HY=<NJtiMR`^o_1T3cZ2)UQNyF<#6P)(;$8<ckz??EJ1X+Rkp9y|SOJ>^JVv
zU89uEI{eALgV~AQ+o(q0n(BC}N{C9p>tM}o0K8rZUr6S*j@1`(U3y(~5(2MTh{zMO
z>9@G>k+Qh>^l2*uz}C0T_`=93DLJ&++1R4RKo|PVG-nQ|M4?x+v)@C<L}TI*hig#<
z+zswp;5{}?1tDJBsqf41MGJ&TY1!cXWXy5Jgm$r^nT^eGtvQ{!X1<8+X!-tX`piO?
z#<wpFF00N4wRNel4+Z$SW4U|P`M(Lu*1zx81<BulFvk6r3qZJDP)1Q&=H%>x)VAsk
zw>7$cJx{w}#Qd@2eEid(xO>c6?bFSfo<l+tF6Y^z{2W^AVj{A?mLs1kOv+S!h}j{g
zW!%^6iAvogual)<7N$C7EklA+l}Wl|3A*DsXlurozJWr8;Q?+-Z!d)vE`pKM&VviT
zR31{5#;%U^(>VW^FEcWme0^bt4VBRGPFa$|GWXb}+8^J_74l_czQ?H`^O6b{-dHs!
znbS>;2_BrCntUV|aCUai*C>#AIh_Hv7QTMNKllNcv=EiJ{Ys#URp5NLo{Qt!FhZ$d
z;jCe4e`Na1>ja8=ZktPQm%V7b$wX1JANy{n_sccQk^JqWQWv<&gjTWUi}C2~`g(7~
z!5TI$wwCrxy@QLy^XC)LRa<(-eAkn%M8xa_*Br{z<*cScB}I%iTja-bp&>z($^*|=
zX6OZ@*JoIG=T+WQC=iJl^!#OSudQDBvg>@KG9e+MNdQq~&&tx{SG^aQX8nT+WeC>A
zFjnmm>ru9#j?oPRVIWxSI-Go6yVzi&)I227(CD*g%#q6Ji}EOq;Zj0IkTd$U-S>DG
z6_YTht<)v+TlXboh;L%M?i~&GCu_Nzat?s)Keel=Uk|*ETU%{%)ak$2WnEUSy=ob!
zx4X@@)E?vCN^)HsVgBmX%T1lJ%wcLe!hxlLa5(k@l=b6<zU>*hw=f-(?kL2@9S}OX
zUz|ncXxhiz=MX9V9_t~`qAhn{Pi96k+}qC8=Gkl%+t_XQ!Sjy(FLMpH(p^oN4M$UA
zM0fYTe&z7@sNl4k>RhSSAc^zb0N49!-0d!DGJ%0W6ZbaDC%^KeJ7pKC$YE3~9!Oqz
zoyPa~Hur=;H+(xqAMe0R1FHkwOg9HQlY{sOZ?uag>5j`^#4oj>Z!8{7od`1uNy1Zv
zj4WmEBWAE>M1@Kp(~gdeSG?X3nu#}YR;A@#IuLrVQI>b7!GoB8jDe*U!zo*B#h{H|
z2YYx|u#%C5dyqrhZ_=rOi+?DYB_I?B0k!))Q*@1SK_@wg-<f@cW&nB-p!6dw5GTsU
z+a>gVQoIRkpZ)-oM$V$Pi<sECUSM(QJ<Zw!#Yh>XyHw1lUEcfb+D%5HoomT6nFnc1
zX5gb4QJa?*-@&Cp8WE!%WHK!|NDkYG)R6e4kA>G)77EApbYDe&degcScouVL;-EJI
z2oEqQV`RK!nte8ZF5~SF0TYCjD*@PxxicCA^H8X!a=q%%>v}zpMG?;Wn3bPHYU;eo
zV=~RQl{=MtdOb&DzB%cqM3suNuqbSZj@Fns@Wnkq&PS5eJ05p*<q@Ly)>x*ZHx;1r
zI|`vr%eLa3of`&1(FN)rr&+0knB~czVl%oLdQ$Tor^~F(?Bv=8sh|(ltJ2Cn`O-=b
zGFZVStl;ubo_QfpzI@r4{5q+R(0d8%++b8m0^--rTAkie?`)AaDJOVGx}jtR#@$9p
zQlhK`Bd<0}l<WS|h`jUu_u1JkbcsVu+{>XHuMtr+UR!KTtagcEis*KwQ!Lw#dU3}(
zE|5uKSo`d5-X;xq3~TI6m1#nxJ%?er9HK|mWo>*{-uI;AnV@k!^e`6Vc(=VXK?BOB
zQ=drw15D7nU10IFRpa;W|A>0l1)Ua{5Cf8L;;Voej>i`)#8q41?NxsownT<8Ac|tx
zvI6}oG`?dES2Tp)_Hc4o4KUOGoF|J}t8$_9=~z>Kc6wTH;d{jK@q>^!2C7tja#8}-
zvelKiFwW^w-YmHZBW__-O!-dHdZvhlm-#yQNBfwTKxHV~uuUm_S%oBTSvfK$_xvW0
zWo|Bsz~q={z2@OQ7XR~)?W-k$V;=-u*fhnvE?zjkThKn*W@B15Xy*hbSo<W{K@S^y
zf;<uu!^By<e%sSdS1jcLY0_);tzj%1_wD)9L`n8svLqe1bxNq&Vb$AisQOo~C1T3G
z)8T_YK^7-CQbQ^7$mLL};uDg&-G!9kbS*ZXX!XdSezl}{8NIe+8mC^AZBRCpevW^;
z5=M5HfSSs;yX>*xJ@b$7x!gE@5W!ex&n$JS<;d`v%Fajv{NAIiot*B)({ahv9xiU~
z`kDi%Hh90oz~hry-HUpGL$~#mSE;%Ak<c(ad>}LT^YdNvNW%vB>W%hJL~I;c$hXPq
z?UY&*N~e0_s0rbE&XZ$W&<&RaU4O3gD^(wUZVQ-K73}DLIx}w?p_ubCSUYN?ljAzd
zY2V}t3E3|w0|NU_qa=2vcWr&+9}6?h_|>5=Vt?FEg_<5wnF_781wI!L81W0bsG4)q
zMn}%amCRJ><bs_p-dsTySS_nZHsRujsUmRKW@Nn#siB6(#&cA;iuj(#>Snjv?Kdau
zWZCQ4C_>4Fxjd#hHv}Ds*upQY553M>*vC>PtyD#A*pL-W5t*&o3dBaItq|t1?~9uy
z`jK<UvVr$ht&9ONExLTX4fj+j_g97^nfyb^we{!;i(aK>X9HgJ&e<~DZ0GENg0u9b
z+(d)#ieQknxp}E|D~FR6C2~^XKu326HAF<P?UqlPbYIJf0QTFodQ&g)@xmD7;X+5q
za|Y@Mmh7j>3mpkR*0Lvn_4s{*Crd~yUUeC9q3w%B#z1Ak81kJTp+dvigSqPUQaf#-
z$E$McTITqkb~1(?1pQ-dL7B<bvCi^(dI;i9-6dmey%F-5nvUx6v|L*Sf97ipV~GqN
zcO6!(dY&dpzdr&o4n7Y*3F(VSXN=_s)<!Exw7Rl&D?E9v6Mk+d_?7L<ge56C8(5@c
znELL%h|Gvl$%TYYR6ip$=D8+-Vb9#xKiFZY%xcCtp-fPw_M(((0;fjw!YnDq*ruJW
zGZwW5mzsW{!ugST|9<5M0~1O?DeJg`T1gVZdo)rI@CGweiS?vHK>B>ZzJTS6#TEVX
zh<6q#bphE1p|gvnYbT;Z#Bl`d^yzF3a-ViTQp*;=iBIHu-aei$VNWfVI@@5Kn&%{P
z053DNn+V?B)UVAu&5#^7600X#xlmQk>?EEqEN?rSI@en+X}XVG`Q`k}C0=1li&|)T
zcxm5<yg4;^aR6C=>sj1U9ag?j_Hsx_{tft{He-ZO(W!CYVv0Kvr{4Ymv63tfMHanZ
zUF}Bu77bl}6z95|Crm8nTWNm=`LY(Q^P?b7j;E;Oe9x4J$Ke_aQyK-uS`27az$T`=
zg6Iv{uqUO#uB(b_bttdGWa<O`BwZgmFh|`1Pe7ZGCC+LLxJqsjYCY5I(l~n(qT6=-
zI#8j9twa}I{}kRrOnf0|$DU{5^gOmJ0R=+fl+UAv3KmQgeIQ4=^)n3@TTWMOR<txU
zGy=c(7=*;{wB_)@^}R&F4o9L~`787ym)^mpza)jhl@M&aYO-t;!_%ga8JMsTAffqg
z!9n*~+F_<~5WNvO;XP8)19gJD6$$K#(Tg;)q{ITMl`M&Ox{trg!AQ+R?c_6dQFGW3
zq?A)3BjRkK>1~dVf`r_U$J}k&q?8nS)pJi@QdV2w)FNy@T%<G=n@s2-?u9`GS#xU@
z>abH1;KVl6IwPH(LZ+;Jw0eQDSores6Q<fS@}Y(>Inwa19{!zgX-UZ@v62oeERn$n
zbxsm)%!?fi14SZn&uQPD0d~Y*VCe0JYLjO<iZVOuFul?HkNw!IpF1g&lHI$TQ6Ib-
zSgm9=nize!T8<Ez_lkHl_<cuxELuO(NU$x5LuK9|>QN7;RXR?@Tgr}2`gs%mU<H->
zpHYTd1mIk{2)x3=ywlc;aSw|kC=ds~3c7Rh{)ss*Ej_(vJ`VoUj4-V6t0W(EJWq@z
zmJ^K}GscD*37MR%0jabc=T0#99M{1uTMNyCjH$7)W#D)frc_oFp$B{)IitD~(eO!4
zJLCbb!h3gAqLVt8l#*WO*o$`Ii^nD{BTX{wXs;*w_A8iq14_zz1?;A#HD+lop{cb_
z=pL>aJPnJNZ9c1jCzmJtX~+j+DZOq^mq|M$)!onGpE&nHX`CUi$V+Q6TOEtO`1^K2
z3*QIl-`nJ!tIRTMn@*bNph6A(XJ5Fu`BbMs`58Kb?nLH1GvB_-d@y*;b6)vgX6>Hf
z5u2<_cIZ|ClQwOWQTrFOZohcNgKE~r!V^EC$u5=ymvx08O(<X+8lJZhqA+bnL3x{#
zh8{F$i;2944fuc^2AG5*f|Uy`Ikx(p6(fV80Um<BV`d5R+&$`0y4mSKStf6&vs=O7
zm)-_}%)vnLux7q<Z9AL{612#9h*M)e9j%xk-MBV0S^mYwKE-f^F_P{((3rBFCDJ%+
zpJq!uf4n)zc%I}Uk-qBPtJtwp)q*h#6+TWXk~!$Y{Pjy`v{4vv|GaOAyuWmq6Sz~7
z!8+&}oQ_;;_V`gGB2SW`A|CL9mM1q<cGACpw~Z_cOZ_%&sv4ro{q<sXqQIdQNydNd
zI9fRa!Wf@2aOe_rFfDj6bP@F?6sj=>N1XDS>z8b#6b#usKF-xqr_t>p0x<_Ch@XAL
zi!R)YyFg2Fe=h5-;-Yi#c&*IBOggc3vxvIR$yd{~Z6iZaA=689tW|b*q+*4Rm)B|o
ziH(N#IUI$TM7P8gj8xZ{j?4rc(5nwi?ez64d9e5*9TtZ%*+{MTEu^L2X)b=$LwDP=
z_+HEAGS9c~mJz-jFW_dWHgdQ$1FZG1HxAPrlIuD^>B9#nw>}E0mLdC%R?MG`S}I&=
z-EC9LYmLzo<zzco+;|mV`Q?6|4owO>g+u$<*&xs7lO`0ui#k;5_RH7cZRoDx6GX0N
zN$Bk`(XE2vP*tHe7KrQ<AhJqDo=A6V2{Ud0U&1^hiD7(!<pQ}=40)g%D!J;2z3)NY
z%$3FU?XWoOH7-mQ>@SCN)v$Fij$1kpMn2N7t|t}Qd6&k!gJz?uhSX}L?KOp8>|>O-
zFP2Bk&_m|^PgiW2%V{YjJvW&b3)v||X?@S4)oJW;vnYNBQ~WSLUQLnwq!<K@SyRHM
z-TGz3(~f>-bR2%YItC~0l3TuAoBdor188Xw+!N8XzfwWA!fa6eH2p!+L7#yhSyD#~
z3nrFD{?&!fBqm!*6~VSbFU7|~8%Yl>kaPte?(TBSW(j8dH6f524PbWO>{}I7l-0Z!
z2OcMEV0q>|8orzuF(j<v2;KW4g{GrZ^7^i@u*p=F6T;o80K9EtzPG<0^Vp%<a^oc@
zemfpup=1N@>9~JR3<$bD#o6wTI<CP@Ldoyv$3(|%d&ccBmVFtr6!`ccaxbp%(&d~Z
z&DM9<8^UDDy7pVLN)kJf>KM;%gGI!u=VK1D({e|=Y}d3_S(Ys0<MjXs9B@Q9Olar9
z9$%2QtA~B&+lNB5t){4jcaU6R=88gnCyw#Qr`br~rd^Zwv$+DWWSw*e%qL|-G@P~c
zMQk%vspn0zEb0eOZ0_A(aZ&ktAhw&^&&16;dmLk}jw@wzLb5lXuWm#81+}*rM>iUY
z88<!vaS*Q#%&1P^ArV{D?ku&DXAl>vZ<~fkMn;dMDojBFW<*mR3K;kW2{?`qt(u*9
z#>b7bso#UzWAVe-ZdQ5dA1rM;DZ;+-RVyRf+DdN23@0C2wu@3`pUBeQ$e)@Y4uW79
zXfUI`yXE;sR)jAc67t(LXKz)G7!mR!yua_Ct|+%FktH8@<WC=7z)ZFXLVnHydBRyt
z$6t}loA-$WZsSL)j6w!>5$N1@qwDU&WILzh9MyL}e4l0>TUlLf@IZPCf(zkt12VV`
zlqc4$HeM@(`Su5s$8~7@{IOAECT01j3-76hq9R+>(_OdwQA%W%HeinChdJj*QU#w=
z@`ul>o({C=l)b7yMQX_}aOm*P%;K4L!Jr4Hek)o9qodC*V-;VUJH0$y;$Z6GHQrOY
zIusN*q3Q#}sE+8^fq^F3kp11=xNjR7&7F{iwsbE^9SY#GIOa#9FZb}*5qtT1h#ct(
z$iD7+yHoy)n{C)e4WF%FvZ`7h^78Q%%zS#<dSIQ^G`I}!jAmhu$-`~Q8#tP)+LX>Q
zFK~vSpXAAlIvgNlSfVYb%hlc*&w%;9+*<w>M3lfHYBN|QW6s+?UEyHxw?xfG<UaXQ
zMG-7wf$wc+cQ6pNntcMF4BHrrDzJAM){j_&XT@LW^hqr<x_pmPON@35T0X?@b~`{4
zx0jDEuoVrus^&sC`j=3?aBc8G<W~~PiuxLaZT>lnAnRfH18TsVh>&c7JVXy4sP)T!
zAZe(omsOwGS>^(Lehb@w&%*VsA^ChBqFr~xf3YJ4zq^opehogUt=bS)J~JV}u!hpe
zBcx?Jp(xigH2a=ACH&~@d#PV!&%x>IcZs24md`^Krmine&+yQ_HGDRTvMU*9ErtoL
zLp&r7Exc+~I6Yh)eWdDj0gFVQQ7FPV#)jX9!FsCGVCJYo^CXr`?cC#J;vsbI)**gR
zb%j$F(VN&;<&Z0rja`u4t-+%`8)|~Y%V6RjE#R`()ka++D*eHY-Rw;$=lN_8o9GVr
z`pWZqgo{G{JH}R5l#Cl>T-$8la0(&fx#v1Gj;r^1{i9~-=`b!US>@}3z3sg=6I(MN
zmgp%iE?ymF7^l465*(@5`kGQ*!fjw&9KijB+{P8#SBP1jNpLsVuNO!jmqG5h?i~_J
zHc4jZw*Xf+)i_$Y><+I37_c|r)?$@R-n#m=SKT|!zW(0msnNjC&Yv&P8M&HGOX6E(
zzSnNxt}!i^k+A8qp<{O2$c9hHP6wQ^JQOm?Z^dO$Md}Z4_7><Zrp?X*(D04A+mXAS
z@LZ*SafTvs1zl;=rWJ9(6ybi|cGJTHeUMst{-R5+J(z5*aNr1>AD9p>_HzQ>e8qcJ
za5b^6YjGzVzD;XA?KvMVuEaV5P3`|eW9xLRE-XwkaQY&)G$CgEiQ)KS9=JxE&y5xU
zZ)Nq5;Hf;qsHouif>sg~jEW;$FUib4vT4Lmw<j1hG1|p#G`GDnL|_13IgI8ljy4BR
zbncC%i^S=}z0G_(tF_lNXEe<1ImYFHE2#3z^$<kuVEseim-;r`^g*C>+SKLg(k2cU
z6nEXsDSM*FzV}K-q*p9?xo7je_sXYF$ItT*qNN)=mvIK&k|3HZIaBFtB#7uZf=JKy
zT`LAh7p4lO9naIEp7N96@rZBtMAm-}*p}gW`Qrft(q6%qxuW-dq`)2}r-E_yP+8uo
zw!DFE9r_^q>@^|P_k$E@#p{6=n>|WH`SkkxwA%v;NMS=4?6|_mW-ZaMDWPUQRTk4x
zlg|D1tuGMq#;TLv(BE-yQq|e^>LH&)m3yy=J>n%+B$LtE_CP#nF7N#G$;0;J86dEC
z&xXecPX~JEYVH_yc7T71>@hDHr4J1-)0x@rHYTev<EoyusGX=@6MFJc=%?eERVdL%
z>z75@{6WhywP8!CB_?aDe6T3?7AV%$tI3`6mpB1aYU1WI!KxeL2xdPR>IhEcRey1)
zC>VH}Zk9TO^``#UYxH3NejC{up>yeEU`Dc03($}YyB{6SF`-4gK07x@(jzl@?ADIj
zcZt~^^p?2zK};eol^1@yB|gD))G_2)cfJ)_)1h+w)D?B|DHknyIp(ZVQ+^>H;ral$
z5Cw{K`_(?jqxn@I1L2Cp-9wcVB6qrrk;;*gYv^{|d;7(`zg9PZck~L475W~>3YsJM
zxlzhoD10V6+NYO}(2**DGC@CXlG|UJ{mY7tV`K95k@gyp3*e*^Q*-mX#7j}}u)V*W
zrr$<1F!w9(rD5$&eCVV4<xTzl;P0>0Y5<*t&C*PNKKdO{ue=9<OP^ov$pR}0^Ya%;
z!>reH&u$JZs$e1hz`T51?f@_2x#B#%;^Rm^Ygh->?b%YWB6uORW6JuMe10nl5Ok-(
zth)8$y=&4KJuvo%&tELYmTbSnL}c6e-<k2qBfC=YU!YW51__LlqN=4}fDamtJ(->-
zllT85<SM4R)*Axyybk1#Kf3+JZiy3MTq)i&dd~0vCg^WL{L;64z`4>ync4pj)=-}T
zz@2i#CcE(eghI6d^e}%1{`i+&^amy3-j`71%wcTGrQZMX82Dcv3$S);9qatUi2jz^
zZ|4}8xeb8$1~xr9dw%NKpC3M&m&43IW&3Mx{%0>)MgY3Fd{}2<_McCFM|&jlZ^!4X
zto&>s>(<p&<JJLba!j9p(n}Tk282?eQvM`;88ypFyyRP^*$aR?4U8vYlm^NCbW446
zy!T=rD8`c8FkpEl)VWublTxbvW7y$+n1<8a9k2CF8vsHi`Y|7ViQpBG0Wey3Lb=W{
zv(nhED(U#?-ZA_?7?tI6IfOF`Qz)QQk9~MO4s>wE*Ja}$o4fy`gWqDuA^`Z|Gi~+x
zXMpd&u)S6VXl+v?sp3y&{^Y+84m}`~YjtB*_x_Z}PlVSs6%fiyF2Cg;z5iy~|0SyI
zs_i4y8d^=l;dwg9>`ORxu+tGKivG#~!ZFOg`v(ovaDe@XI6aU{HnQB*Z*bG-FI(le
zRragEWhbSeNU40)&gqY<!D%yHUnjXfp5k%HKX@i?trih+HzFcJO$~r^1)Z((^0h9W
zRdauVIsSoK`w(67@Rvt(GmFM2W_4IcPY=4&Cu>fh(|}Lq{bOz*=P5RT;f7H<txQey
zeM#4A4ZS7vtiauAlT09AD?j=<l2|E`s4Mj%sH9#9x~%>-<+qIoaELyrF{(+Hf21&p
zO@pgl@0LDH5Iw5xyYIghx|Gy=3D?z{U5bb_83l;QNAu1z_zS546|vH?a>dIrR$H8%
z=nFak8G}!%UAK2o0RaIKGoBi7T|TKPr-|U;V8<k!Iu7lcy`#QN;961T6hY%9A?v@i
zUjhT;u+nBiHT{F9b)lxU_5d*nqYCcszS46=T8_=tUcn!z0%=D@R)f=$nNi(C<1vp{
za%~4#A!o(<N~{qKvgGMVSf`$+%iMw@7uSuNgDSYYHKeP9{Ac^NK#Iujz@^e<IrtFf
zs(4Hx4#yf=L$KpmN9twqosgWKUfDveU2eP4u^#x8<*U=8+7YxI$2(d@Mi+6-K|?T0
z0c#d*c#bauF<9}e%(Hr2%wn?Yq&rd6<Gl7M!ueohL%bWt9*0LEs#_^f7+33NlCL6m
zw%3?`iSTZ1DNR&X+Vn|w)A`Fvw`pNJIAkNsv<m36SVxNUq_A+QVC*WCD3lTUuv06+
zsE&nofzv=&sC=dO$ye10RA5X@jAz`v3Np997ZZBJ#>wgPOs4`%PCfms84{#&DsbQ)
zT6iJNNYwR?-JI!<YjW7447;$+T_hVhg%TSZgztnNUSO#k&>?{nD4dhV)5{BAAk573
zwBhAu;ZM5|-}S~jJQR2&sPvO#^7kGotw^+7&LmRF#;<+f2OM&ZGco{V)@Z5$>b2cZ
z28v@AwmltDMqnJrEFONg5}t%g6stTS-WW30-UYLSlxwDn%X(E;8no7QUi7}l_B!`8
z82fOd!9cgMvcH;=l58>ZF(O`Y!f}I~fM91moTgvLW{=5_J6cW8d2OjbS7mjf8@<0)
zz1Zke?~64yF~(;(C|A95HZQ*@=0%@=+TG}*PCHjx>C$<y&Z_nCk<+QGk<rW)`q2Nq
zUtYoHXr1t*M_ce%c0xjxw_c{4&mIAQs^E-43AjkZ4C%Zw#QKHiUsH^L^Z6^Q<Yv*_
zy~@rwWRcANRMEKpnaPX17m4_wC-_t;NsrqPzczQ-*gQpheb<H8^pvZmr<3F;L(9!d
z5-OZFh`Vn)ub=j>ZhSE`lB=}dC%dorjQ7l=L<H*oW4_s($G5JI;x-8jpJ#y5#^gl;
z6XU{8vRl|8Rk&{rf&8}5MJJf+0NEC8!)>Px2S+k!|A^L@(1sf9ZRhMm_Ky?bai(37
zPf<M9#f%}?hijB05VWup>m*{)cU_p0>Il(4D9;fy6D_=pUi{#xmCUQwBID;bb!w~=
z>h8owzLq`jS6c0t-~`lh5-%Q?oAjM~?KAbwj2~0wz7z4%bsHyQIMQPUH!Oq6{>lY#
zD>5*GPO+5MJhpDhtV3tg(ZRKg)GgXZB2PvN?-M}mTi8;YWSflYAZ)r><C8l5_wn0~
z<u$0*MwyMVomSWS%G;szCj50S($hv!BeKNNyyY6p>fo`mb~E%T#l&hbis5oYk%$Dg
zVy1*pA7Bgd!35vq;7C=1Yq1&G|G*qz(<$yUO0)8Y#%%z{Tu(2>S3QQM3OAq!_&bK;
z+diV)u-kU?d2$;bL%)x22JxH;b8u-iS4fMj1Gj)fHovGO@$qnR1?DC}<afTtmFOq%
z+rKQ~FvxleBvMDxZ^}BYoQgr~YuCoprJ9AD7?qQ97}HSioQ4!)h`W*j*t5pr684-g
zHO3}kd&myl{WoN&yJAbkuK%oluw{1kxmz*p&F}{Kg~M11IkZ^4^vBNAAo{bZI*r_O
z-y0Y8YzG3E+{2SyiuJ6!t>X8z|4J_N!Mskdk+3)buGB6WqE9n^sf<HGbKJpA=PxSk
zwJ^UG;iSz5KWNJqZ5MY~=)Cn_H;Cl@@p0;X?#Yg^u}t&1d<Rp?rOBc`BjIkV!fbd}
zOc<1>aIp6a_fSYSl#*;usZOgi#0dI6(Ca?wn5%0vnQ%+Tn0&05=m}cI*&6gnGrMVd
zvt_}2s^csQ>&YRN^!xWM4U^fVJPzKP4J{?&6Y~eXFeAuJXmgN`kjaqIUf;CW=i?pC
z6uzkrJ_JO|gTPnMp+IBxD9x6>s4&Z`4xciTn3NUl9anNQG%ve3JHeqRn4*L}k5e(>
z;Pk6sf2PbcAt5YLZ#MtvYzKX6vDVN|`|z61I5A;|jme|H;cAEpyOz4JmG5Q%;|%}_
zOB96n4-`3f%cAka-wZ<$=9lJmB%8#oQ2GI`I{^M2`-Z62!*h1FJtFhN{-))QZE1ia
zS6`&Yu;)|R)~34?Oxy}550MO;Y*M_)Ox}=0*&jI{%<lQd9Z-lo)M6I1++R@r{KZBg
zv#6*jsbJL>dTPJ8VX$r!X;g2&8cS}CcXX(h^GcpMB0aiC)g5nXK$b$C+DHt*2-|r~
zYcDZEK>#Bhhv%+0Y|Hs)GAVZ*qeu?P1#i!Xi7Hd7yc3F}XBjitZ3!8&pk#j_FuXx0
z+W;cwtaog_4FH8ycfyYnmIHrVBscF9h0nFCzolalIXyncR#(g%jk}1NLqht8h2qee
zUg&avX@A+tsVaG8na(@%9E+zPr<<mr%SbnufrUbb50)#sRn_;F2Q-wmR<)nSmRA^;
zW`H?3VC;$h$H#v4uIb`oUx)>_ENv`V18sB5Oy-}J?gg3&t|kl42b4=ie6?T!Ckz~>
zvf@1rdXOwGLY+2wI3pPQkOTCPqMV7VD%N3)JJS6?&|dw-{{~h^0#4<4MFt&hEx%1P
zEfWN5vSk21Kl=o-D3Km6vVTS)9E88Lsh*c{x}2_8l-R*y@AJ&WA=Y>y(Ircsjtg3D
z+u%I9T}!79ZJM9KELXju-#|k{I>{aKYsa|*MC1s1?*oPgsrKyl7vG)j!Fts%BqW?(
zcW$$e6m>=kyBu?y5Rk5?Vv{&8^<_F%Sg<GYQ;59|&x$meo$@%GM{jW%&x1TDQ*%`q
z><i21JCn5Q=rc`~V5i-cGaHi#?NBx7SY=7mYC~FdD^NSfV9kC#EhcW4n1fu{TzyKn
zf}g_(_RfP|VHrPx$sc@A5<uGqA4M}EhD+j%`*3wXNALC##Pnzx{+(TC%W#J@<G7Pu
zkO#f8QMa_UwNB-gffE)jUhPhxhfp-X<-H@lGbr0|s(Y;Drs?`@VGT=xsiD?I<@~vg
zWlGrKBgt2=3-XEX`3mo*sSv%d^qZ$ArzM3+ZSf%Q-Tkp`LaGa|PtW6&J9K7UV;vrX
zyJpL2RA3(yj8gENk9Xy@Ua!ln%i|QAXqLUR46&GoQbh`;l8dpl)-a&XR?e@r<4r7V
zYvy!B^7xY<xh|s^WF_XS-s|ow8$9F)XS?v`je!kUJKPXI7!GBJxk#_rzP6BP@P1~3
z<QOxP-vhDZt$+WO;3ZcE7`MNtU&fncoml)#Q-1!Ag@T^Mbn?*f74J%LA@4(4XzA!m
z*R5(I$|DG9-5m=pXZ$kf15kXvPLrOl=d!jmgK*KO$TC0(!D|auKd<>2w-U1(2wC?e
zE9q5oBnqgAYKTC#W>>U$Z<r1GCv$>RSBZMVxhZg0N8;oc*q%`f+?%Wh&Se}Swa9Cr
zxyLhDUXfMJuqk5R5=@gR!>)5jZ&cdj7OGk~T!>=6ykh)i&e>spiC(KxLYehQai5gG
zg2)Naz|X|9OIxruMq)Mv0l^kC))<J7zaLZ>%12Uvd?nMt?wN&STbEXjN(Cga+xS7k
zgOeMsii!soT0zibaXy?NDAb{(T<&@>h{seLCZ-j-hvgwYHuYoR=vpX_m&0aAGS!Gn
zvFgTfDr@K-)w49qMae0If~GxtZj=I8JMiXh{!Ritn53Ec8O?=xpfP);PzBOcT=|@Q
zt3AD`xFdaG1dK&lx}I2$IFVzMQ*_L^2##ua9K1`xRnbv6_$F4Xs}SCH7@++GJfDhN
z%fNeSq{-iXv^Ud`)zx$#@S3TmZnlZ@&mYXFH>-@T=c&yclZ$d7=?v>WSYDiu6jLo_
zRL_7;O@s(|wDdvWhB*GhxR8^RBKoU?!H|Gw9$4)+4>yMjb{A6xET-J&4*`HnXmJ%z
zpTJ`_EHBYoQQQxkYBt%y7vEc&td?nduVL05dAqMHHu`J4n3}^4G8B!@@~M$0&4o7^
zm-E^oo$NwSHgnQPBAemj&2*})ns*}G=ZDIHJNkGg1yP-Z?fRWGmeuw@dQ0m2Z59Rp
z@-@RTuL=g(xiqy*b|-Z_BSTKU;PhmeVWGmqRgMw#Pb#g}i7!c2CVe?K;<6ABvA4A9
zPqY-S&=EPv|2UAhzRFJigQOhlwj1T%R=T$UYRTr?YLZ2pRH&)tVX2*6_{6pGg>H}S
z+~vqO%65WMyL$Oit41NY48;{?S`RtR9%uEp4MZ`qUSw61y)YHfF1=mrz_h!n+n@M@
z?ECj&O3GLr3e+dJ*&;m!L>X9wx`eWJ`&R87!*$W}rl3`d2r;*b&-|5e4Ix>~>+OX5
z5{@Ed^Os4lZzO211JIP*!<tLUJ@C;Fc_4#{g*91~ZYMW}2scB{gU&@BaZn$-7VQN#
z=o($lp}?wf?GhuSd{_JI;P>OQ`65OLdnri0LeOM}YF!q;LQqJE66*Fn42)|iw|Wt`
z9e4NhQiw@BctJ>Lqike+w`~PRN$FD(^rU30N^QgMVJ^%Gqi0`elWizD##ul>zzu?0
z(L$kiNjUK+1v7Z0-E<y7y>kn71Z-!D4X5foDxFn~jEn*`<kQHKePsTM%ust@6_mQO
zH=8~quDxM1THYW<A}>I)HvaVe;}{lmqpI*p6!Nei)i~j@VLQdhKv$j{>5J_qZs}k?
zoXjK}T3_p-t&Hv<Tz(!i^_0c@h+LGB>MqIzFsA4A;mP)RRc@UZ;}v9}^IpM<a6v>+
z*Tv3;=&`qT-{whQ;=}~#*1`lU7|X*0WFF)XT~|AKhem_$nVLuYd2$+oAyv0Ha>X06
z;SK>|jDwY4-zs7!U-nh#4gtR*O-cZry-on@?s%Ro$5e}>4eA)dB+$gzqL<g13)o#Q
zdelmKP-70MDMA!>b2-$YMOTR|h4vvMVk}X2z{fP535uH}<L?a>EOw#)*1EV;SPc=D
z&W2lo%cdc<XV!-x=p~DQq}az-DdKR}0hwQ>G4Xt~++RVp1lK?IGIe~F1?g@ZR6OR9
zVph)ORR|H^$Hzy_zIPn34xGcs+0S)v6=+1xT$G%lTSM=s^Qg>W;bu)gjT7?%{3iQ@
zuYPAY@bekiLQ{np?j?{77Ok$VusEfXa2ic#y^u1&j%o?DrZY<*<9$8-Q4Poi0jdul
z+$B9m*ScZ(Ci6khtAj`iw2G~at=Sz60h=ahBavseV7RD2yC62x*Y}H>#dwWXo;t+c
zeI8%@=mZTqIXX1yr1!Pjx>KG7&u-kS6hH0F(=HL>vpjd$&mXKEhKYoVFYs20{o2fd
z0l&F=Reo;6W=MuREAnwH*)8I=;pVOu-2r6V$DML!Na4}wh*ZW~Uk1{Y3Qgve?Wgri
z?D9zLsNDBr9xw*8o|o57<Zo27rX@>@3D}qAWj}4A&|`<27M<@-1`U|HT93ZAviPB2
zob2vmV)A*iJ5fZ`%>wG*6WgPl{T^3Pc%z#tDz7t!f@kG)J`cG0dQ~+`F0iEG#H@Hh
zDlsCk-IoGEU%^glEr_jufKcm?pM?nNg~x?H4LUm84fFPR%f4NR0_P65f1h#ZwWQ56
zG=XIR(G4#CNOhW>blnfqpnZ$%y1jrG7hNgP6U1gVK>!g=`%smd2=(<E$4DM3^temp
zTo<>h&142)))yCPF_>lK`GvP#bhm|tUV#gRie2h2?^8~$@wI&pqCeLmSXNTB`qIPC
z(z}fI9hO_$+IbL%;-$ib+2iI-IU#JQm9I1NFeU|L3v^v`GXP@S`MK%r#{5avi~VDV
zLATF?$8Gh`ucpK{PE=+~RS3cXZz&h{qA#`M`6G5^3*~P59U7<P26FzjlLQ{fypBge
z^ym9L_CFGF$>tsHns-oUDhd6kyGRem72Z#_M)Es&54e7OTORQC_J#;Fn1(zEc_1_>
z6qIutCPJSg`eH@1oe`8%_1p);$a}lltVmZL{n36dYuKT86@8T@3^0s61zvoOu^jpO
z^{WW5yo_aoQf;Py=$Aph#n8+m(sp-~;^xpf#7we!_xri^L>5Lxzw64HPJ1Lsa%^}Q
zeEW4(O%=|4?)l{uVTJnypNL|>D?W0MqH<I&oZ1PP>uD<W^dFlk1MYt-4uAoPXYJD2
zZenDEKnMCCK78!l#{4@(2NWYAk+7&*J74Q0cJi0DtSLvOR4<Wr>p}}3H4v&{Hn*@Y
zc0%KTSn4h3%u6sm-0*r&ig4WQFh^|P>62SP217bfLWr?!L=D4qOdLPeV@Mm&oZr3y
zpDSq)TOYMQ%u&)}1qU}QP8ilX9NKIv!~jO;B;W~FQv6y8ev$I@Ikc5SaAk<Sx7xVo
zhMWEQ*NCe|Uga-B$Y+%8-~b*#57hVH%(C_Q#*~(KHKiU(FiHVXvvu_*5woV;`Jf|e
zyaI?+MR83wHa40RfZN|Oe7FZ{F~7_T{uMQCdySDTgM+BHs&=Q_aIE#p1MXuMB8c)*
zZoO%R3%n%feAPmNNtl`Nrv+P^^2Q&5AnHDPu`{2Ggca%59<5`wPI*j5Gw+hHpBQaU
zqdH%2JV5@dB#hb|LtU~4@I52>51JlmIrMQ-fg7cP42zqdcYxrlctB+!HQ?y_IC4C4
zZG6+SK7M=ylYUMNeXzz{`EZcgCnb27=f70HT_!g_q5TCn)#6_@V`4g1Xo-O=cEtQY
zsg^67w*$=~6wr5b>?OYb0V?<$astrDSrQzmUdejuL*QGl_`6yz$nM*_zZ|*WQG4L)
zH}*!Qn{%JP-^RH4ir$A!5Tbc*uJB-HyHnWETtxEE_OD`=12K@@-Aj}76(mpp*7d)(
z*T3NgfTOQSfKscnC~lg+Ory)!|J5n5-pahe<Q2d1Z~yz}E6lV2lb=3IAo@#J{xiOO
z`SWZ4zyADrA}ySo`EoKnxdqh5?LTP-efsBE!%r@Y6g9+e(q6KqzZP(JcrS?WQUhKB
zi4TyPkB`@V3wzI-v!HIDmiTk=#t?eK1MIyTf%8u;`Vif@xm_2B0q4GqZ2@JN0G5I`
zqxl(768SrqV9HqNs}_c@^lL$X)_?(+!6mHq)H7D*iVrV+xG7SsK*n7BEAO5&0ia3$
zlr$jKEL<QGZ$9Tmefz)Y%B6s*r)~kQx!5w3{Q(yKmVf_yV2tJ4Vt0P#!TnQHes>nW
zaamZ2sEo$_UwDeS6o9jhyHW*U{12UybGd}crt~`AUs^*r)V(|KQ1)@h0Lx4R_dO@1
zHd}GQa^4hNH4o3gBR7|#l;qz><KxH(=xj<|y44M!gGbbM>nBRsdT|x20__#y;k{$K
z-dw%RT1n+}nivU>%yp+}O%~Xny?(SX8y?=)_7PKRy2dL`)`vh!HZ<@9cdrh#?_ar6
z|6pis48VxW9~nG9wc~c-v%2Ay@fx+JFoqMa8+bj52<jqhDPhS#>;3VNnXuHsH18Cl
z3X2E9Zi@>Qdc!4hb|l##V%wR|`@v(oi|2*%uU17IiHGXCEdL&i4-w(xhELTqMGYEO
z?u<VxUFD=Oa?BqROa6q8<w$+BEctmYcYsKLwqi-LuX2J@q*#ITJMPXr9y29HMN_3D
z`k5Jq1#-bj#$bvH&!KUktbXZ6F8rhS4c%WWKfqsn1L~vWB7c7<p1XT@+vvA`E|(sb
zx*|BqahiaWiAl*@_MC)g&!D{sYS&8*k-BAvAtY5dWkvk6rer%Rw{BzFav~?&s{Wjb
zou16&;)_&X8;y}!PfDB&vkI5<*H?LrR;z1<1>SQ&!c(3ikYH*(RSbfC&8C2R#Fprq
z0r~MO*%31#1^RQD0MoVd4QE=I&CWASvddaKwM(#Y9wauwKLvUC@UJ6IjzqN37iF*I
z10h3eWvIxpEUVIYS%&?gs^&Oh0gw1%=HZNJt49kfP7f3iLQVT*0%W{rnv9&Pg_A&`
zV{z8_PyskL_Qi`AD<D*0PsR;=ikLbxr*670(8;W!^K1TD6F_Q~wD~z_&|oQTT8(_>
z7a(B&qTj43r^pEZjNc4Ki^oyj+&h5|6p|O2E#qXqU-o*tj5eEP4B;AZ3?yNg%W`mn
zv<qp3?|JGNe9nP${v+yx`SPWW4XMpbbB(m+`C8nDN~FOU8+`7@Iw6ouuD(LGM|_hK
z(Ac&&7|CyX-q;H10dso(?jtzl;RPx^K7MIwYZl1O+gwjQ*y+1oPzYlXDtXLR6j>wl
z@8xZro@R@qKqV!U%ERrRGDx?(nOQENdU7SDGa*MdYws)tY>J-cGs~-elJGv}AVprs
zhEnyGsBj!6H?Zp*$PWz1At__vO_1frFHKLLd^vM>aj~;IvfiemK<r1*JPjgJCq7+V
z87dY<hmi8Ig_&(o<#yc{u^NmtVf{eNQ4Sfi#itV85Z_9Ic{NPd+EhDE*E+Rc)IaFY
zH5(~2QIH3_OdL${^YdE_j^ACeZGPT0K1IJem1e%W_34vZQ$s}ZewU!Qzn}jqGIJoK
zZfUM{x?9XzyIS4PT%!eja<V=S=j3JM{X+VKYRGnWHf(jopx*KO?jk1^?%C(3NujcM
zYntjS+iyBEI%7*B4=sP-XQm{Vb#P+QyLp|@e>pwg>B!bF>uK+N`4n5_fk4YdYc7zP
zcMD7Y#_yTe)`s!@36l1$;e6rbz*ptnz8*$d=BG`T$Sg%JHQ2uFLrzYP<H;gPv)r$^
zFEi*isgmhpxPU(j%NE)V7A-+H!dMH?uh^f>T=aaOHLH9@8K!GwVjp<MyX0WAAGK?l
zLD#hIpxveAkQV4hoS=FleDAakxhfZq<lAM_nJU<?=qx(6A}6HSpWPCfNkWGN2OD&L
z=HajCg<8Ia>ASgls%^oOWMmi*U@@W=xZK=sQ584czF(fY$gR-faz7z4Zn@3?M)rYb
z;d`IasSQ<Ro!(`-+JRq@htBfxY#XxgZhGHcnsY<h5XCP2&T^o_=Xh%gV>y<=BSK_f
zHePpZ)n6L>a`R|J0OjM}E>fnK%P_m$ON(Pg85tXt5V4iu9B}Zmz0Tw~|H{EZA2<}&
zEX*z}n3?Yw^{al&0B=H}J7kzWi8T+|aj#QYNJuw6NxMj2P3LLZ$IB!g0n_<3pR=s&
zrvow&Nw@JrH*uv0Oq{Y|_cO3GDxGl!jcQFMl=-ew5EGwIRZ0naPRpE}@-F)uK-Y0^
z-qf$Pg8|@oIk}Lh<8o>NEiG+VSJym!g$B6wGD*6NG2x|?ZpzJ=gW0s_*t?_9sHN7z
zP%W5T3)s2TYhb0Og712!xb;}!^X(lSc)j41v5gHe5qY7gf>|HWB1fA6ZZ4328S(Xc
z_JsDelNGiXTPCNO^d=XVWoJHbITybGhaFQhFCTr$zSt$HM+4hsxOl2as^ETWB&uM2
z8m=NQalvaGTI(WQS?Kg><aG6;UHaP;1oXut{s({IIalw7@Al-xIs;PBSEx|NX$!JM
zU{EE;hE=GS%%Peb7KS-G9&TztiC*(JcL0Y{SMv$*<Hzh0GcF`BG_kfa@9^HYHZ|F-
zaM?L)FmoHGD&B)SLhOBVqUcr5=GRz&+pc5RJ`cBz?k)Q{aTag3PdqQLcKR&aN+N@a
zUh${*<D<v7F+i_={G<&Oo4GohBps0A39hK6jm;MnG&~$K&IHhf(EGt`>kjggV_oCR
z%gwkh&S9KGUUg-|@J>B?Ii!2js|62quAUjE{zsIeydTJL0^N06Uh5yqqxyDk3OC^@
zuu;^!NzU35Y#0WrvBUye&F>Pj`-=euyIH;q^5r6dfpCW%gHgoArWq0jJ=ZCy%9*Tl
zX?SG}#1(!}-Jv#GAYP~zg`@~W)fyUPIb7r!Kve4>;7lZSL-&P)a3;QdEwwV_j=nBE
zdX4H1fZ=GdxM@`%zbH2xH(-*?8!xrr<rm~KXfRA3^Gq29%Iz6%>7W8C^&!ZFOwY0Y
zaj%t;BCq+S?Ry0y@;ln*BRb_0=d~>@E#k@vlt(++J@ebO!BEYj2Z=^J55wG@EZd`i
zZL0GS^9$;6HIU-hbG+l;;gXt*jCP~XHL6rrVnDO8cRzsAzF>_z`Wt&+!j>BsK+4k9
zsc<6dzq1N{O=f2FL8byVPY@9uv0>fuMMsX|Z=-CVN8^Bkri7H;P6nXDZhmR6)8EXb
z2q>s~#o9O7QuHocs(3A17d<VM*28%QuOjM+ZkG#Hmc6Xx8jLpCt=q43=#zomAM5`z
zRp;I?lIrh7#T|na;V=wT;Dy6zI5(CKjy6}TUfQwrtK#v2awe)@N44F7@{L)Wr_xz|
zaff(*<APEg^KR(ZCM3J_$KtqebkHDeTN{XfVUdw+jeo`T?*!Zn7w7LXEH(&74t?CZ
zAcreqOR$2AqTZPT33xwl%j7ld7dc;B$BTRnHdL@iQ86ludjE)SfWDaz%@$o~xUf;f
ze~^@DaqjzLX(_EIvs_x%{M@`Rdv4JTnQ~!z^jgqb^r+yX9fZo)?+^UsfUH-C>hw^D
zQBa@-((RuXe+Idk2vn|F{LmXW&@Y?n%jXhx`+7K*oZ`MmN=+2kL*8ekx$>bafeW>o
zPUo^QJ%KRO)|u*~`7YiV42_QNQ>E*Q6oh*+o21R%h@&CM7gAOG@S&ePmc&#32Wz%k
zG@km(c+W6+y^HWKn@qx}kzc#|M+#V^p=RzpU2xhgcF}exGtVSBm8y)`1}GMtMVU~*
zV_ruT0kIxOziMk|6VvwBAa@})RR@P4)rK2SREj%D&D=Oz*<NPQ(jzTn847C4KRIcg
zusZQ)(DG76HeuAk@7d;;gDgg$-@;qoT^gmWHhHP2`Rdgu2rv>i<q!<T_vf>KKxZh<
zPK-W$FOHU`banh2Y#9vJ&WHi+0H-|ApI7{@h<pVY{PH=*fI~u^cK73>rDuw-TpQ1#
zMg(vaENN+I(jn2V5*O3Auz(y&f_2RtzwDgTW*`MTEXmU%g`qQSuAWu%)0-^epg1pw
zeC-5{9%)Mz$`K#^yeC{P3xkwXLLnF1Ow6HdPkEeebj-}n({bdV<NuWlK$Wh!_)w=d
ze$YPl+8}TOmHZ<}wr@|3kec;)*%@&3j&Q|Ap~)^|zY$c;d~G^gDidozS20!8asvsR
zV^D2|#>!stQ@)aZQJ3&SBr{7a@L;s<que@C^%J}7hU#iJ5d=T~2{OV=gXdhBGK@Ix
zw?QjGNA311F0v>&h_|NZbAzU0k6N{VD9G{E+InJk?%>SLDwiL9fitNF)4Emr`V3E5
zE7FH(5~Dgx;5Cs>&IP^AG^sgQi93(F$vudlu&}MNZEtptT#IRiiVr=sR{z}7(U&Qg
zbj(Q1ZwOTiHYO-CmEw{!z+>i5Y1o!dB4=na6ss;TKTG1fAd634R(8GR{?iAmg<rX_
z^D>iU1a{J3b~}i!$vz!IM)DA!%vd}n_jcr<rT0Ce!Ou>h^`VM^wEhhkPp+qnQ@3HU
z;+m5AV2{V)8N0u;i>-mtt`pxaAc)m0G;Knc4T=r_wwhl-CgijVH$7_!T^Ab&Q~jXP
zIRYFFnWLDL&6wu&ayXF2!#S==Hq=}|fdYR$j>i-kM|RkqDhjk~q-h@KmbK&buUaFZ
zbldz~sE(47(t}bT#+n;n!8AgZtv|HEtffj%#oh*CrnFl(-%kaBMGG>04+*<{=ume_
zNtr7Z2RG$^+6<R2VHzj(J}*$$jEnD16Q|f!_|>S{+wcPpZaC-qxijTGYloN%GdFEP
zTz1)XR3tes`2TSCmQi&z$^LMV5Znpw1ef5hK@!|ug1fszaCi6M?ykWDL4&(H9Ngu<
z$urNLJ9p;ZkMD<ft-V;AbN1QYU0u~(UGgigLHx(O%)q`wh>66==5C!k%CW1Y-_|ji
zInUJ>gKDNJ;)PL<tT{lsQFI!%y2*(${`=Fx?iH=VDD=X__gB{E@cpMl4>eP(RREyB
z4erj%XMWVb4mdz~UFV7W*cvT>ptG+Dlqq3G3!@#9k~1ik?~=Zl4Hg_zFkA%SL*mja
z6+_3hmxm^qKAz^^7eD2?)o;6;SB52;+{jV0(y*Tl>y<aBHS;ta&t+_BnP8rnoXTmX
zP<)hCz+L$2KY6mg{(N+Y%aW1o*j=PuKUurW0OSGZ)D2$%P|+qgG4HA1%NzC>O7Jsn
zT;1Ft+Yn{MT|X}XF7(;>>h2n^&G(L(O`=rz&kL<OH7`RKj<{^YXdwz60}vIXc(ZY4
zN;JdPZ>LQ2zYcOgixX7@nEZ{OaY>B)_}H*ivNat?bG~(#a2zY!a6!qS5w{2f#m94V
zK5-}e5(H$hlp8qaYmFjGTq}o?zq`{6gNOO}()d-RYgr%2ybgLr@p0*>b~XAUBe8pw
z&+qPKI8f`|5O}-des}wwCxnpBJSS>Pv3_Y$mTA~dNUgIrq&cBDKjLM16Xl1O41;BS
z^3_9I2gCQ6^a(`oC$Pn@@H=etLfS3?_sdD3D4CZW{x6SoKz>FdE_MHE&|k<n)*pb4
z<R1s<XdeMZm*~z}#^(L&<)`1_;Ss!t2(Dh1Dw5#^fgpFU+xt7vO0D-&atzm@a+&PO
zSb}+AB%VTzaP@%_&92=TXO(xBDf2GhnX7uO8wRK1Yo&?ioYj~6>k`fCw)loyqd7{d
zFpt9-d@9Kpx-|Pqr-@>BLNPHhP6Im5CEygTs+v4ou0>M;o$#UVck4Z)dC)}8vT>YO
z>XmCDfzA^MF2!{n<ZaM!KekL%U&z!{gcrl-{w#D=qGSPt)2v+uge5&(pU_JTUgLUc
zTHlq_*Vy{T$`cInVkAs&;^b?x{xg{-_UB*OG-{R7bj|2UP1gnRe1t4jt24)~d{$F6
z3PEG})HlC4FDxxtcKuxb%Yp;-HeBl0(+QrNhgoracx{!vW97`v)yNGKC&vA4!p(<b
zXJXb2t>OAOv*96|X5BTv9(&gO^zzpnmv&=}{N-lV+T9n6)>h}5C9;n|8VXZ+-LT;P
zk|UIR*7L>l4>dp+1>gjjvHTYHG|NnHC9)P<y`qtRO{yVM9bU1Y7xCWy_%ScTP?2;n
zb~4@Ja<x?=P54u`H38%T>SEDX7>-?@!3h@(jcD_*xgHwQmgn!yolybs1Ew`7SD>0*
zUCcb(qS(plUoFUl4S?wc>EVgg4KOYHfwMQl-<0vUIgCZf)5=&~dpd*S6=CG1mxs>g
z*veB6%U1IBTm6EfhGLB2;KD4^l)vyfbkE6IRm^*<)ftR+K-kSRS<K4=80gV*0kAts
z-6Lq^PgA8Jf#Tt|`>|CD8Ho+u=ml2uUzv?-QHC_zb&h9xB5Y;a<Z&<ei}HRb2lo2|
zWy@kEDxjsd>){_gqEQ({RGWxdjWMCqwgG0*`9NNbe3JfOc`^3xTd9nW-^z+;8QmB1
zz;uu_E*~ZVtI_)r9GNtp3gKq6p?nw7FG1SNT*D~me<iw<=rlI`%6(rF38(43$wdbw
zOKIE<e3x5|dO1i#xprz;jUphnR{NIw>MQtTV8T}Jn*7l&JDhUA$j-!gRmLu9=}a}P
z?s@_wuY2s@u-Demj4uh`0Oj4a?k4wj@<ztY!XCB0Ha|baC&}Az8Yirr=ks?iY(zJ<
zcoZ{yFfL!6FW1AolV7~jkJcl-!--Pij^C@1cRkUrk6NG%>X`1zV|1S%+m>in&pWQX
z51afG>u^dBE*i$XoN$(*&$D9qzW>k6)d_U9E68urA6pAPDA+ATU2BoVLoC?uyxbr3
z_1u>7Q`m*@1V{h}z4fTo_hdCM+)i)^2(`nBhl}fe+kv4V4ve0^Pe8tkm`yb;QR!);
z+AUHgVzD#e(F>&FU*hWCW1YQnJxFYAso5Te-k~}?_c8~{;hXGVt}mBWaJw-9DySNR
zdDwhJ$JnGKjh8R`2Ln;<+mOz&6uPgv&fk>$>yAtfFgV8UV+Fs`H(DMXz<rv|lk)=r
zsqQV$YMj;dXLZ~)yk@G^6U03qE?tsbv0hyh|N0UDvkdC*%s-;&Z{P(51?DQWXD#ky
zlieFyiN)&qlYPH~;NB0u(8qlQOk@9WtPFxLux2pVK)C-|u>V^;3}8t!e9L3sdH4iV
z!^JhIG9+5e-kP5;qM9A0&5ZCr8izIz29PZbdYv<P|3i+&pNBz$K9HC00!A=@tE&Ia
z3-H<-B2vIkJQ@t*at92Fo?rk{+fzTwbnG>$q=F{o-w0U$Y}OQborAgyW-xGglh^5L
zcYCQzUr(4L>z*<u0sr?V)+~YCko85A2~5BWUg;B%q0!NgHhKFDB-!SlLBk;ZO^<(?
zy~hD)yOFU!UbCO0xjeA{Z2F&fKk0$!Jp&3up?`1iAES$S17qTa__rzZ-&&Cu21XHD
z^~Zw$uPpKR<N`m3`v2?CyI4ew4CMjZt@)t>TJM2hXwuieh3^kbT)hQ={R+L1g<olt
z=lbd!c%~x}0MIKLz;(f*fGljZ_j^y;%I=3Ev=&;+r8kW?WsftY*#AOGDxz0tzqdw)
z;;&qW4=ekP6u+a`0tN`aB#KU~9jn3r87|@fWe)QdD(!#Fkgp;Dg_jX}OB?Y9-1IZi
zNT#Q9#H5$M>E1CJ`oGQjXWUn>K>vdP`ae13U+x52(15p{tjM$d2lv{a3IG4z|A8%#
zy={yS0C*wKinaoQMwykWnkuF$kg^*TfMor5imdUzLJA-a(!S>E<kfTm?g}~!t(l5d
zGFyLt|Iy4F3F>!wjcrc;LwzuD1>1D;Ml0U}p!5+DVM4;gC(}e5bq}w#2;Pdr<8zWz
z4+$7Qi8u~i;QVVF0R2~_fOVqvj`8)ITVzP(GHr8x%jKf=0o0=oh<C;#TG2D#fmD1w
zjdrI^Aia*YNT*P`JQYfRrP=j3@rnj@Nn}5^Z?VymSO5C4ncp0Bo(m~M#F61oOP|So
z7rFbFUfh+Lq^{rpCYx;mbB@Z;I{m3ZE2#om2RS)4CS&&$1=P1%zko}708qFxIV;Of
zF1D5qT)6VmB#<H>JplZq_(f^)u`Ih7=0C2L9KZzmJiaQp@w$SdzE`a``czAvrK+YT
zuCk5i(5=5>jdTocxD8lzQ<IZ_rLq;v{&)nT+DGD9q4h`FIgWU3OkqDE?9-O4`X+|c
zAz$2X#RB+Y85yf<latp#esPG-CZMj!=~ixl^iNAVXJg(4?clUsdf^y4zHkR^>d>ft
z3y1fl;*7t=ob14{xw%bgzG5;AmBYy;?HPTV<X}`@00rFa^IKcuCfthT8#@T^?Q=S6
z^LC)m79~ZE>O8hf0f%=@{7Er)J+F^^!5QT1#%o&F30RE=cZBiM(T$B!UM?)xjl&ai
z>nnwcTF<q^DR+cfI#cI6iR-$)E1;TU;Yg_v&kuI{&PUe`FQCiF;r!my#^vtCYnhPb
zY0kJu!twYJ>Yans4jBe3$&{ZdubEDRO@Op814o}x0I1Us8js&~;qaur!BTz5>(F~r
z571CwF%U!X&K-A_TutN8(e)`LuW1#BX6D<KpZW)+)8!2TL)k)$RuZtEa~s{z>eP?k
zM`%n*kaps#H1~@E=tQN8?Hv&cqmLrP;)YQ`y+H&l7M37mUCbMB%LV5v0Eg)M#c(1P
zb-QHVaQH*5<KBXXkUWE_SP@I0m~e8cIP3yhMKS;rNa-$T+~l=s<X4b2wDmSL;o)v}
zH9@h}Z5lX>(b7tK7V}J~DQ;LVR<|zf-ofddrMv<vez&;ZJBzESD3h;pxug1R)Ysd)
z({}>YG*Jt(sxhZ%Z2L|OMwtuPfz}dRqpw>4m_?Hnt_BB3&0GVRV(jxnYY8ATmJ;+i
zA(c>~Xdy1W(`FwC1to(ow&y)s1oiZg#+SY#Cno1t1VfU7k~EK}ZzKR1C`XG&@db%f
zO~_2Gl>>V(%Sdrv*oM@UT5$#%u`w4_p(jEp{!R>;AQ$>R?*qC_-=B70YKj08FIqaa
z+PBM2`;Q8BzIq(C<yK~f#(Jh{RB<trf;C(H1@9TGjv_*wQ8RA3x!h5L+NL+vyT7(p
zr{q_M+#Tj4@Y7l>*St41G0-!+wQDhv+Cu7oS3OJi2v6p!6XGC|_#$Zf4%_8LaV__v
zVw+1`UsCe2oQ^azT_dGj^>=r<(QYyS(hyaY>-$17Yw9zI&1IFNmuNKp#fPK2SBB!#
zm)KIbZVhNW&Kmp}JASP743X-;jmp?dX*|sr70Ceb{{;*+O71_v7l9nV=e_i<nPwoV
z6S^(UCne$29e_pAdHMZ6!!I5zDFy2A@fKQDq(anSSQoUfWn}2Dj_D{=Xx6UG&lgLV
z<J8>GfkZvnox1CB8<lCN<MSw01?)RiCo|yQKl5elWNDsodTZ1i#TAq@WbslP2W?OK
z`UUxY`}S~kasuGNEpG60IUSOI3Vk0URRTnonayTC^@rmm4lv(DDHy>Mu$ld=!4QGN
zRBt|N42mMSA-t6u>(H^%Zq(eF|5xAChT~tpsggh^{{`V8dp|~V=eROwzk>3fo^DZu
z7g4(z=G{lU_XHLEQPL8RVFyS_BMpa37mK=nVHk9@7(yNR%-V{r4i*%=8uiEMcz8@^
zy~wU!kG;hde0=vkR~j4GR|8oz_U<l{X*{Eo-F5(M9uE7<(c{lgoc3lbD0kaG#3Iz+
z(?(kl^%9=AEGL*z>*}umE(}-Mt(>h=n;pf6x(1T763qPq!-K=aACECdCYJN4_JcBP
z)xTwG*WQ$EsAfl6Z~~AA2mL+Z1j8?LI<7iwjgBK~`9bZ*)6tmPvoqdQ_*>RR5t1Xr
zmn#+d=ohDZ3|@^$B9QG>Rm1Dr$8Z`qH4A~j(aqD=v$Bq-y@^<Cn_zypZaPb+0`MO2
zaq!4I6OvQ&%q`?siDgs*yHvgwBDyi)@B+>JSleYEVKTldx-uM(D+TZhBO~v<-FLy>
z_e}@r%5epQQ;R_MM(Qz8UMKdhM6`=Vh(=7PqH3@(URQ*)&)$|+->kUz1il3m6pSVp
ziGR_68qjqz+84iE3=%U2rMrWgK}#viPdmSw8508zIi?9{OB#g=p_i{X>nXYBG*(%h
zGf`LPR1VzS^%?v{-H!1KlcXwL(p&>ME$g^rIZf4?*uZ<1TgrX}k6VmqctT?gILa`G
zrY&aaEI;lzLNC=;PJSwR>}YFUeVDT_8Gtrxuqji_+cywqc}PzuJaQy?UQSz*K8dV<
zcZj<i+daYF(3Pc%>fr3H-MHh+?(FZTGpJQnA{%L9$Puo(-!uo!oQ4|73bpjK8a4NU
zAWUUtH}_MfI;M57$#`2ugvC%j8Z`;+LKjP;LPi$4?{G_^TflKq5>l4VVr-{4lEtR!
z$!!x>_=l~D{Uc7m+H0k&!gxlmuy(u*roy%{r-o6SCI#}lFPI};_@TP7+W#HjlhnR7
zG~>L9yr2!*-R<Y@)VJiSH@`j=a`EG6a2Z;3!affS43h_b?gA~<e9WTxut45_^lp{^
z@v`@kslDM~-xJzw0{-+i9lG;y9zp8I(n>qUb%#5e<2I;2paUD^Y}J=GD1c^;x$DM{
zyXzEPBUN|jmcDwIux4bXGTD4$1EC<H+m_l29$4_4G_ylDy_BO)Xc?aT)tUqxj{Qp;
z0bgeaMs2?0?(_zp0C#9d&SQTG;&lSouB~NRH4NPNuhWXd2wIEnLdk6_`Jiog=6nCx
z#;iK$VhSwU0_@xD)9s8W-3}Frx{N4hp{gI)NmV%>obqWsgK54Hx>{w=7o{32{UW<|
zWk;IU99G~t#C>rp4`$?7vJ9<WYvmbZ^cDRgT`eZO@1i;=eSNQO<7c`X7IH!&T-H4e
zjGA7gnhdN|O2$?6ZDl@}v)0GS?MXZw_}is#W`~wyk8%&-KuBF+Nag68@fc430Gq8?
zdnab=G^eyj>4RZ`F5_zIc&uxN1U9g@AL2@^Jz$5Gx=lAPY_Aoo86a;_$z^QQ-VGD>
zkmSY*e>CK69=`|%c6*!0T<hp)`cZwA%=xjELle(N23*Bu<WBpBVtwJmX7(*uNnv47
zVWjrT{5#q^@kVrplBS7oQBy_8*172o*9om^80A4Ts4}YgQF(jFAPO;~jSG|&^2<_{
z4v^J|H}!E?$95fq<<~^^LHjJryKAPPyF^F;B^yw-At?n4vGHkQ-vA*$fn9g|38zvs
z9ePQ6<wiQGDq;w*y@)&nVMOAM73K`Tu6?lm%~?0$X~i6v?X2o7r-g#aE7bF2ffUo2
zoE))fY9WTP%sYlh_xZfDPI!EtHy`NISVjHMe>KAyOQ!fY>Z1uOtt(YZOZ8#`Fo`ng
z*~Ffa501jSh&X}(Iz`9>5&<Ftf=06gamRe_)>bid>8z#O#ZH8;FBnPjg{sC#%30w!
zdc0n>T1t@6-QnP@Xke;Nvy15i?F<GRpd$Or9nDuaYvW6G?*SGgQla^U1#uQ;7M5U-
zCv|m+Y6Z30nno<zsofP`mNUawK+u+_RRB3u$OjPtuGMwee)RHZ^lY`nt%|e4TxqNF
zVCncpVIro@c#(U)crzC!UAxU0(-!KF#bV|iEFA2U<-4fn6zmm}N7u8Ogk0}u6tkvr
zsuLDTyuvS;sw3@8Cxl&Ja(L9lf8IalW3O2RP~u@;!Sd&Q(2w$Na!zmdH2vJQ-l0Nx
zk|A5u!?ff?z2I?>G4eEgy^`58$U{ZRySWs3%WCyC^IbVF*Qxuw_DdWN$1FZn&Is0m
z1HuSQFr1&$Lx1Ai%LqFmiJH=Jm><ouuBUKq<FlLoPLB)~R111g9xiq!Lw;Jh=jbmB
z<%ccFr@NWB4_kI6B(U}0&NltxE}HABs8@(~5-NAzHD_uUOP5A3ViN2)6<6#(ALAZJ
z8c1)<dQCEtcZ9)QU2rmXnp~KQHXqr_jB+#@frl|1Zs@cF=)fJ$<5!Cxgos5^P;B1q
z)g0nJWNKe-jVsD=p~DNTER9OdMMl8GUNmcF-}|t~{D_wBwdLhyWPhBO+S9u)NVI`x
z3R<YHqE%$xIs*(2fh=e{_Qf{2t5ZH{y9~M3kL%<q4nzx!3|7yFipE6>%epaRpq1r&
z2nQ|`rEaY+1M2*1l#r|3k4GCFZ6DIer<C}5=fGSmzWT*PYvvR$uQLAPa0at?XNTs}
zcJE)C0XNd>N{~WwdXg{M6eqsr%Dq>z5MyJ^7J-Fmq?R9enRIh8{Av^tt0FVH<8&5X
zGS>ZukywkHHX;nx)#FsA=<fSTlm%9wy5vAcV9-PVW;UkP<N8htG~3!j;zqfVA^S&H
zkF^`IcjOr6jGyM-QXvd9e*R4r_?|5k%eJS-e3l`3jzfy2gO@8qgW$2kw{j<K&&T1D
z*AN+NENEmL4OZ*tqKX3}u_-*+Fv&<k+dIdl?&|MFd=k{f+L7qHZ>T#EFPTOZiWHMr
zo2~-#Ae)*E6&mP<Fl4mLOVv=FSNlW*@3g6A^vEk*qON6n%c@HK#}uZ23mTRYhCYqb
zk63+GEZKzhFYX@mj}vNUy^3S3W<4%NJHg>=Z7TTsBu73oDwyeRW9oQVBb}`BlM4!h
zHFL6sp~BkJ6(pNeIe?S8`>Beq3fkQ<{Tx(E1Fzr?%^^Bb>0wg|jj8SN!t!xAZr}=c
z!WVt9bTq~PaJuN*l^B%U$u%F>@KS^DnX-L0=B88G%QiyOVkjIdeeJDPSrYF%K6-=^
z+Xd=2bbf(PS=u#Ji%^8`QJxzK2_HW-6>TVVnUBpqp75TTVqmX@L<tqGOfL2;l=E|)
ziqRY207QS#Qbq9qMISaMGpC06={?jOBnFfO@$d+Osi#p({9~a@{zf{oryBFR?xDi0
zH4+j`v$KrRKoU~fhj<5>B;C4<Z0@EajF4`Hz~IFnGZ$T+PHg)63gRy`Dw~6V>RGb-
z=8Bbpnh3XkP5Vb%E>{Z(mhKb-;L)-9RQO+iXIokRsL8G+r>r!(GW&KPZW%A&>4kw4
zc#PT?MqK>1+i}(O=Lr*1Ouha?XDbTha&|{aD#OKbZ*gs6vppQ~%G}%K2KfLx`824j
zgLFQ7tDc?m@#27UgX+N+<Q1>qvS{XhD%VHzTIm_uZP2|=^l)(Q?ydPWvqS`H)ropJ
zC+Y#3u&@Wr2RkGBTK(ly#lJ%i##SJLa%f2_)Ht*a#gibnG#Wv{?H*4Uc01%9Ksq_r
z`2hy}DW95nsF&Bz0N3SILD9D6hBQ#hhia5m{RqrDX&&0}teN0b5g+Oe_D=)^vr;gf
zcPJ=OAz=5UTNZMLvSs-*d_uo0hU)r}952JxegG%k-UH<2Y-B+&;jc^tFO8*B*!?!}
z{KL5b2&S7WCT2zt2L(a@SV||YSEBhtb}p%<etEzCMr|K%vKnzXju}Ip5Wdoy+1jyI
zuzo-mxw3R5>pQ_AVb!cUSnwNU7K(U*X0~dFZyzAX0qG=iry8<72H5f|SX2k}Da(k$
z9FyQD6?ZVjycf&$7&DW3EK}(qJF_k=oM#e$<C1!EI`$#Mq(%dMJn%fXu69UbY`E^p
z5sOg4lL6u$!5@&wB}G@k?a@alW09@k&>gillt{-A0m#nC%P{rO$6L-IFyY`4%+#SG
zFN{SwTn@z2kOcj~+_;Zj5CS<Xn1<NW-A`7+Z{0V2^iVgR!GxMoM5!B~<Y0za>xBFd
zg;*4i`U)IqmfU?}4K;E|9ZDM+0V=C#I$%LE_>1U+)9Ce<1-76c<o;Ci$3|WEM!S$*
z2(Vg3&zSHW+FJ>O`fV?i<5qJF$M@;0h&ZL3Z6x9q^GL48b+K0D)UE&zfnis*0G=ED
zfOt2t#Lu6l2xzr$o5O9m>5QM5np$9gYn*YI%_`AOESZk8cdIb`ZWDntRr;gdRIBA6
z-@w_*Z;GmPyUwBwFy8(^!N0E28sf2y_OJAYxoiE_9+?Zrg9bs~1V&}_e$sXbuDu9B
z;Q#_ag;`!XmaRwn7HP}-W4~b08~@tOo_yU+iEx%?1dU*R<IE+r*jgp`?^uAHI@XUr
zk2RHU_grttp;Schh%{l(6U|cX?g$`$kOm?uxtsHWLZ=5hyG1ZanX2vj>5$`zuCa}8
z!VbS!?F~hOS722_5N=VOv8LD2&mcQfqQuk9Q8qA?S{ZGIj_;50&30N$c}Rc*U@s}+
zJ}BcUp-B;OZ(ux7AhToVl#j6P9ubB7YZiRiEfzu_v4ZE6fO>U(n(d>r@(_YG!Z0;Z
zGU+_{rXRH1VFR4P?HJFhzcN7K93GnU$(EI|jETcB<ZLZ#MC`1zO9auVR3Z?vzMq)s
z@p=Ta4rrhIa8ad^1&SizzT3<OdE=%{vW`DJK^z@himc;WF3fGYll^4my^4alJKqr$
zHOg*sy{mI7{65yge!eq8gVXi0XR;nLYJodTdpKU-sPQ(6jV>*MfKl<Y#rIaKqiH#~
z74g#D;iQ`xOPP29=j*Ghp4G^VNiwAQ$49gP$GOjku+gg>p2lCJ=>Uy`>s8}$^%ln7
zZ0q0LZJcosq@*Dj6JvT;cH(Ghs`qTm<AaC$Ogzy{LgF7HC>tCG|DM3x3$u`hKV1DG
zTK$o}4E};IDhysd`Z<>UmnqF<n${{ZF0?(`%E3NvyC>QQ`=8Z2YZPJy#3@YQicz#m
zkE<dh>mm$4M3WQayID;dysa)D2gC7=q-I<Pi{{BDhh~FLg|dN8nv*TNIzIs$CP__`
zM^-@Q$9-J;Sf>STDQhWtj;>rrLgO#~*6?w9vv!=cN)bm9_46;YE``Z#6H<ICbVe|D
zi{wrYE>$6Y)Fa1B6O$MhO5G5)0Hw{ZgwIF!(|tmhbp;3`@e%@Qa!=F^q><9@5brjo
zdlc59gjs@98f`wuDnSV*1@5@^ih;cWyRrUg9U#FnX$*&;*HYrC7m61R2GJiKA$ei;
zeM0IS9rZUlrJiv1hshnHQ|v|(q4qJs{X`M5lDmS<o$3<>(HrgC^h`9^={QRrpAZA|
zH}u#d9&BGk(f3glTk(oVz|u*Pkyi<sNVjsw@nRG++k_lVV!FZlH1s9JY~2d4L#Yu5
zI>c|@wTiB;%)MhQnGs<XFWM;cX<ztB`GIt?U-75HM(Is}TePjM<D@RbV*Vi7L~GM|
z7iwctXhSk0_}x+}42G?rI9KDewCfL5%Vc@NQ)KuqzBx|$!ES%c-1H%^K_R+Vd4x(*
z$f;OsKK%?S-fN!i7*c7Qwm!2!KbR9!=|F>ToDxp3LQb|j!6OlbNezpsgonNqfDvJ9
z33JU=pru0lBaR+sG1bZcFzU7}5ZGA@;O%$(?jOmig?ZjOT=r=Jq6S=4!~$SkAL30u
zz5Y`INsYvdONfbkf7#t``AI2)Zz8g&$iyEN31^Od{`qCT3YM|?drC|-`BUHUT6AS<
zgJ4MzKSczMb{VDewO>EAIV|JEB&t6Y&2<1I5m130v|M`#@*c(d=z=vVc(m9&JvaAx
z@sq)>Ko`R~2dPhsHRvR?+!S-@KEd^Evr{)nq1DN3wIo2acj82`^+)o}MvVieysL@E
z_dK9BOk-ubR*T+Mo!UjiQ>*!QY=Ds1LjS}B;f&CfoJ4~GiG%lgV_fz#yZQMD(o<&~
zTV(wBhQ=p|2-xD=NvSW@uy81fd*@fGMOiXHyq&UPuLn-DI)*i`3|a1j7;EOHXyO=&
z6glZ0Qpw23bVjUT$z%s;{sZ(|x+NFXN&0uLCn5w&)%gB9Ult`(;RRQ4<<&LNDG6;H
zhoA6!P*PJ*p*>=gA|tmf+r3|&#X5F)H*S%!5O1t1L26AC!dqanrEg<PTI-yMy3h_}
zrtT8PMk~>sNQUVkW!E`T_eUtoOTNG&m*U>v!aIBz93OQ=t(c?ka%?1Bq~V6_)`s+x
z7`eP;kti|KKHv?VaK)h+QDB0(m+)XS*+wLILMt`bgFv(IHc;#gJq}(rwN}Nb@atuO
zW)wZJ?420K)Sq%S*zR8_H}B8H%1_2ZyXUhlFB<>wRgMo01^w=J9Q{bdOkE-g=X}TU
zo*YM_u<nnTuq2P7QO{q$&06gj6=x9s92JJgeO_%mT(D`E$M!BhN@eKd5PmcnQ9q*>
ze|thyZrjPj&EzLPZtc&f5iCCjS$!#pLs^~_ER~Bg!_Ahnc@p&FxdInLdElmQS2{w;
zgIo|Hq)JZwRlfJ9R^2@x#@$n8seUm$r#QiQmN+FO<b?u(2q_80t0O}_hjzoS#gKN$
z&aM63vTnFL!NcxJu!AY(DQuPY5tJ2VDW&Iw0$qTp^4Y}5K}bEFW}s3<-!bJ`f3n@f
zmsVjL7+4#-bvc%|#;U@vj7|m=|3U|fe}%KYs+a;oYu&#}zIeF|de=e23JrCz8ndWw
znMVePKQ>s>nD#JL7x?%YAy9I2FNSUp58d;7Y;klOAsyZ8l&9h>V{;Nlmyz=FCDJJ1
zh~E@=H#i>8TMxf9IPcGCFMc8`>|bqv(Ee>Sit*ND89c7MJR&(q$Og%kC(mm%vk{u+
z9e{wKKsj}Sz8x4CSRI=Wm-RN!gjlc|v*?1~<3+2H9>2qM!Dy=z4H69J8><~l7#lRP
z*bJhnN1Yzs+_2lt)kSUNZ((pD)q$@QMk6@Wc@UC6ooeFcCkHXj{l4l73$43q>(dlA
z%@TJ*?91aoxA$tyUw}~x22-9}Z#j&oYcf_oqJs&g_WI3t)7M{5Aj-=?hdmQd*XVIm
z(e^4#e)jO~El_<Ui=2&y_qk29*pbYUDJTc#9<@gWC6eM82gNKHPt0kwYmwU!oP{z3
zpI8VP2O%*FwR<mG4V=+UFS*KsRu&n#GhBE~$W^k4pXpA|kxGiAJagqRTTG9Z0Dda+
zt&?Cz+Y2aoaQ7y9UO+Wb3c&?d_uymCn;38*mSDsyjP$7qeMxBHPk7KHg`$e5XvA)_
zSa<YokzqNxTyE%2`8hiEZ24%P%=~)%=X$CNF^L59@jt3L!hd8V*|U`N&%XLfB%47b
zvTh4jA8D{XLChCyk4fYcsJB&sBN_&dQN4jppec};K%x#)FzxY4hZA0MrJvl5GHr69
zFnmh)xE<SF$h5IC0!3|Vwf*k&jWYc%^=CYPd+}=?L2-Jqg$VPcJr37=OjtFMCF!md
znx;J08RB&qnEFl1^3u)mwd#<z{M2o`3O9YjhrKllv-08$^hxbJl|sk?JX=RMYvicX
z2-<0Qr+phqTpaN{-3b_LOO#0(RT9=Xmv3b5L!}7JKi{$??SO~vY4uTP`AaM4Wj%BH
zk=-`Ut!S@8OpHSZD3j%Gey6K{moh#OvOg#rX&!bOle0-${Ixv`WQF_9LFV==_1r0D
z-^w&>fIY03+KA8gU+aJIhitr(#06y&nLlztgxpoz&l&!!mk920rdxl<n#7L}CM!at
zLFgjE(ElSN8zLMWreSvA)gcj&>(3e`d87czk?w9!qn%VN<TfV|Z}g7b=YZx)G$yK`
z08_h9G;YCm6oufvf`r*WJrbMcdU|+2?rj4VtOD#TbebI0%=}Op^J~-#?=BXXo85IT
z(P-EUY^o-6)V6-9O}8_h!a80o0=8q}+gtLXfCogp{--y(Ns;Ow1u70MFwuh6Tz6NN
z-H}S%6)~tukXTVwB`&1Q3#XMY0qad@eaBY!?rg)Ft*L<qqPNo~VAX@pW2&k8X$lJL
z9alx8BI!aq7Y5A8-S+b^!!-NEQ*fnZUvk#5wUY(Mx;w|{%jLF0Fs7?AQK?C0%gr7*
zExR8p^lYgI&7cRAEhy%N^7s+Ymm>V3_Gp;aB9mJox=oru7(AL$?xujs`uTv2=_?To
z1L|rn6%nkLjp81T#3}I+x;X5lf&QSpoa#q`FOqZ2MNoTi>n_l`*SxLh6C=pZ0$65_
z-TD*fm>ar&AVS|?{<LG=IzkJF-Ga`D0yDxa6`+*P>L%=1{|%e$nuY2vdgevcqHm;d
zQo_)MN)Ys1C@$`eFWXmkS@Nd@uAe`CA@cB<yeLg0E`d#OxP-1B1U-uLBu5#qR9_}K
zo&^@gHX6juo$m4#zHdi#yS?vw@)^c;7%(aTBx>R_Mc^;dIQf}F4$Ze;=IKY?T%e!x
z@xA-~<^V$(Ur`}r>fY1KvUcYY)@#GrO6}y^31>LV9Xq<492Xj6C6O4(p~E#E)L=%r
ztVAFC)=ifuqNIrA=a=C_|4_5S@RN3IM<J?fL=4cv<c`oYtgS=vWq4SKKnqe1Bn6z6
z^71klbS-Aj56$lI?uvNL$gS*zmBYV;Oer|r1y49mzW)a2v6_D64HTF3yXuyWoFCdO
z-wvr!4>$Lb^I!$9iR)*kq+yGLCQH$VEQjh4E|>h^aAY4cG{72QQX=EprtsoYirf2O
zBAdQ)RH}7cO$klV&MRnJCV!!?n!f^manAe1euAp2yqSVzG05{J#M5mD{(GVA+b*zf
zu}_+cMW-RzE+W&m6N&fmOmf64P3aroL*r+fn3Kk&a!pD-$#iGKG`KI~O%&_q6#>&T
zhPC0BMKNmJbj=M4oQ^TlGTh<C5`4i#;FtpxEzC=NLz=B15q|wDmf2x%2xfXPJ(Hkv
zv+y#ClX%^K-1EO%US<enKPX9=c=+~78=u3$VbTRqh!ch|W-XVPHj>T&Q$fkP+;p{1
z&zkR((Wn~o>7z(F&UCcl?a^JB>NwI_n^LKw&}85`>A>aj@1Ehqi33O6m~akDE2rb>
zv7sSY!5LWzcFTDq0|V7cX-ih50Qx-C@`f>ab}nZNe#3rE1KsDdpl1`;{ZQ5d@{Nmf
zoKL0-W*Kbek0UaqUdNNQg#D2Y(?L<0vJw;|q;E8V0@Qa>J@=}ir)T;gpmG7JNZ{As
zc@rvV6f)+kK-tWbj3)^2XYH2BAH<zi5@K{%MC#3!11GEAv%|lBIjnT|agK~U-0V{+
zK00pM<S7-aRmuVWvm*=3wyb+RF1w?JfH<bgx>a(CFReqE+TZfxWMqB?rHAg?#0cbm
z{{2(P#4Lu~J9`N*+(E1QVbS@U9pLWPRZjIi%t`u_B<|lu-F~#wp6y@fQ{iFv3L=s%
zT;M06S52cnCwIToY;G<gRo?4HwG2JxRy@8kc>%F2JAWM3KtHVF<>OIm%`lKyn;v!#
zA~M_v_1{|nY-P|&=dCwFdL~7Ued?o%ho5)y?EPY7qQ;u*E7DS=YzI;yP^^kgsh=}e
zo41h_qS<D;t81JrEUb)g(ytA9*gcaLf40l!u2u;oW@WBC;q#LkU=+K@oG9BuS7xUB
zL0M|Cgxtp!8tA`Bm|v(IZvz(9)%pA=B<cQo%mMJb48s8u(=@kct&+~B=H+}}7u_iZ
zNctJrwyVlWWFe8D03oR^ttYuL`m#$tHaIFBG}J(7hG_!g9g>a}dwoJreYoA09^}gi
z*w1(JW!q(i6uYF~@$`ZNK5_0VJS-sQ<>(xX`lIgmM$fChFGg_0lCPZX)^iI;dpz-U
zNZbuv0lZBY&8&@dFXif(q1(u1?NO3pFy6iwqs5~iMR3!@&E6r}o*>;s3=~rsXvwH+
zO|zG|1giPN?~F5Mm?2y*FhgNXOJnCq)xWL_#q|so$`puFXtab`2&D>o*rMngJK|?E
zwZv)nI;sIQSd%}}7UR39ZK#^@ipLW%OEcPP-~#G!Mm>8AR~MhrGRc1o*@3JjiU`E2
zD_$3dGKL_y(M9&k>hr>3mClVa!JLgUS$--$4$4+8-8(@*Ix{nq;e5Kn>}9zZV^j6*
zRH;F>S#NF<2~M(t%`v6XcxXtm3fAIP0?Bc~cZe&nnlSvilbVR-x<~<3|H}l_hs$5s
zJj`46W?*mh`uOpzG`A*-H!zfTMIIpd5K`VV+lusMNDR)u#f|Kb&Fi+>jv`xfV65%O
z7j}SUPRAU*5(5<WaytQ*v8-P6_e0Vi1kjD9tggHElpi4EEWdHTYN<dd9Ll&x$}!Bf
zbC~m_VV~#gN^z=&27T2LJOH7<E$oqB!Lqg0Y>Hvf{F2QgNZiftF1409dqxpdxUOrE
zWBUk8y=>WYmvT~kEKya-@ew1eib1WzZG0RBiMLV!E5QjUuen$Y>f&`r!otQrUa2k?
zYOWbK-epj)aha#?ohF%S5(=pCeq@8%E&`H~Tlfopxu9SLxBa>>lFHz+rxyw-eB>i&
z^}=R1y)ScR)FqTxBI0uxM0yHn|Cr3`OdKo6<7tB?0scM174GHw`dYBAUV~~@NAy_{
zh@@skl5;+-k^{1j5a1-kv8S$^MVGC^BO;Ja=E>m^bh|$VM);S&O*h#GISr~JsCc$n
z!MIDr7t2r9bJTdRm8%yHnloNE@<$Vpad6DFi{}T}7qFY&9Xq$T=yD48{a`bhLJdRC
z<f*|_6JI-ShD#C>60$hoHlHXvyJaMe;n3J~8@ZQKC>V1+*xZyK$2I`+1Tao{Y#tKp
zxy*D;-oJkjSd*Xiha|~XDYp-}^bg3E;E{29JCWK5A_=(9ZbN=U%Q+8PueKO6<1xe&
zayaCfmLk4$wnjs95O~gHadq1ZEBxGu0I?k3d)+JuPDX_6BkyErtN)qc`>z;R0}tsJ
z473f1eYT61!MViBN)tE?dFbDxMTxcwyF;rHT8mEs8r;~^JD8J*$~gjSoUv8j#GBh6
zU&0{yb}%qJkVy%*n%}WU#SB1cz0;gWcDV7;z}yy#sdHUf8DFfik$Mo<s(1b=eoCZB
zUx=hL8Czcn_PXhK7(rHOx2GNjTg5kiLwLJqAUFXq+S&z0G#l9cru~<MH&18F!(9X@
z*$7fR8~K$dM`Kh+6ZyiNQ6&kpv@hHN*I6@?1?ArA#&g^-9zP+YJKo4u=W~@mLL(Ci
zkaB}<u=5M)?1RAX7<t&Q=oaluldY+rEWf`M^r4@yiiv*V`n2#Ugd@m=w{%RuY?&)B
zd5_uc)AQ@#&!}h#j&Llk4$V}mYrEb?QIO=}%Mnri@P~hP;TkAE<nq^|FqZ-2QWItY
z3ijT%!Q^TB7$NSBxs%&C{1J>SG9Olm7<dDqvVsu70ZSBE&hO7!5%EL8Ytr_lWuF1j
zF+}x&zqg&*eL>dFgA*uFTxAZcrZ(y?8G9jyRvVvQddvIkc&YbjT5bGOi!eChU1(?m
zF0#%ycrq6P6c~+Y<S*_YzSR4DyPUr(y_OESFPi}${_;mo>tH^<t7Ah;1StGUWIb^F
zh5D6hdzn=*{=gtHB3#GR_IdBqkFivw(^of7ZiUS#%4A>w$TKQ3G^FM{mW`vmG<PF7
z!P6j_1PbMni(cY+&}ej5;Rl~1Y-rbx_G%=8@-Cr_W-Xp`l`opoq-q19jVW1W2nc_z
z67mv0;0|UX6PbVciGRcF9UhVzUTjjV^oynfptN4DiuRqh`-;`yQ|sGqNq~lZX(iS=
zzwhc9GCvxk_8&o!>qr+AOX>|80mFd=S7opH`V^A~FzxHP*%4aSXOwH;TjpPbBO{g_
z=WK`DQrA%10Cfgnz~MeO;uSQ$KKehdY`-`50*5|5|FAp#&#(V}+LQvYM;#xj#{KF2
zA9DURtbh3{@D2=ioNLVn6DGO~Q@Cren?5Xx?a)2B4{Vb6m5~4Q@{N-50lyqD9wh*V
zR72tm&I)B@7=YRFqo)iyk}u}ZJpDDGfByC10;3ly8Vz&@TJ9hN2i&J{?02MLQ5@8B
z++psYZ~mo2|J6|eaUXD&U5M9-HyGYl3_<_TkNH3{rN2?IG2oDA16c9z!T*PwY`{L3
zdhuVc|Bp9B3a^ubUS<*he-iDrWB+la|Mj6j0dn@63@X)m%Gdt?@7G(C(SN7$fB(c+
z^3|-UP*o%MZ&UH#9|I;a9pXO>`oGa5MF`;Lg0F_T|Mz3)*_`kGH%kBYIa7d-S3%v7
z=&OjX@r$h8&D+0FdGFKy>oB_tDZVO9KmFzwM0))h(J&f7kZmLsd_X{NDIrOo9<6?*
z<L}=b<z6NpNdG!tOd{awZ4kXuoHcm+uS4~fBtm}Pvn8(^BLCAQGg%ipUe>zcb~Nzf
zNdY37(lIQ=cw3j`K-+5Af9=HIr1ua4j8y!@9!^q#-~~V%%+DFe$j#h*gu|C^5&BPD
z6V3X{2si`2+W-690TN>@1_*<(^Jh+?f9>+WObzNF4iI5t9I+|D@P83@t(H^(?7o&e
z4-ff258|($7$5*csqMGT#{9qL@pK*~`_0olzC2>^D<^ln0k>>*vizMNwjkh+h$TBd
zB4x?&k2Usx^ob7#;3Yx?R_;IRnT+V#ir+h<h6at7Crkoi5wS6yw%fSo?~~P2pMGqO
zr7(vjFm#&CGl^vBh>7&IdzMbl1#JKr;+WJ5MpOPU)(T(KEzDo{m4ClJ(*X??e-L$l
z{q7coGS}o-3M8}U1|qEAPoPn}H{b<RKOjzDs_}g2EmpvtDOG7Sk`l>sww|x?e7ZM?
z5}u#T=dLqlcAoeiAdy6FE(!6c5#L`#$TkO;o%IKXqQe%<N|2FG$9G@LyTx|PIWI<^
zIcSxnJg@srGwY(*UhHodrMYf<MMNx1HR-lSweZ<=1}j)TJqz91B)?MkH070wDfqI8
zL9bLqhqjn+C|AoBCGYQ_qv#c+!Sb9WDGsvPI-f4(wA)I4+Rf?<MgI~tc6WS49)YcI
zZ0-)g_{(tdIZ40rSQd<LVXM<8zMfU5n}dh6`ZhjCH%S|t`vE8W8N8QGipkZ;xo<CL
zaqLE;qg_yr>{m9w6ZLuBjKiXkT09JOHg`ZPZ4;I+s|$y<FK;4U{G((phm%?lJTcr}
ze1E+FnaKnu(`?Vn+&MhY#~K1IRaQOT=E-UUi&LX3Qw!c(F`3W0!L#=fLWQQ>zq9Z;
z8)}`N23{7gCwTbhTAuP5H~H0_kN)BoNPxvU{d0dY0wGZz6Of}iEthkPt)9b)*{6=f
ziMTI!yTz3ZOm=Iap{qkmVYkpPzY8#^RDguwYVF?zyY$-Vt{FV;*NX(ap@}p}V|{(?
z+U)@Qg|zldrYg4U_9*O*y0VyjRm&C#3B`z+CnX`#8yt*@tf;u|3w7L^zqkv-{Qfkl
zR63+oX?48iKhtt`442fa1z5<sfjVEFl;fOsMR%I5a-`uR7V8~JDw_?K6HVs%;$bQk
z=y^`I3@iP;{h`*c${{d^(FEXu&Gzg|EzP3~2^A3c@3dR&>NF}H%*Lb5pJdV{qa+p_
zpAZQr=zrzK&Z$)LU_NP?jdxkNxfR@9aI>1nE_V^d-HTh-y1AK}2(I=*)?Z3VMwFMs
zIh%M}4zZ|_25@`eK2Wo)ZJFjQ-Hfk01Db2y^C@FSpmgUJb#X>}asA7n#j*Kp9euf4
z3MqmymzB{{D)-Aydb6l<BH?dKPlY(Vf>hHnU;_qLD*;iI@v)-7ImFlhJQ5*KJsU@+
zC2sG-nlgh6WkBVcp59mLx_MHFC&NmLXjx%NH>1miP>6OGmr@}hH<0y&y0C97PS{SE
zHInm@y!8_fRncB{b~#3g3HyioFT2+}FHa2CnLLiDc52~-yl#(MKcmfO>D9h90x`k;
zow*c}s%?6GT^*kI_;|`?8nbm;t>(s~L{3<(08S>x-M!<>N;{qXu6DJP<&D=<C_dMg
zdRx<4?Cx@F`#X3nZarZ^<K5y~<0vd{r;+}MxmK?`JAVF7LH?H|>%nMCm=GqXlVxs~
z-e6FRbERxWdSldB=F<b6-46P|hbvk4s!%?Ok!-h5o{=FTcZRp8c=NSm4~GmE=8Zk5
zf5|pHadr}Ks~XrlmV{Cp-G@|G#5${>H*+<l-l9Jj_x28d8{gq`S$wrRS*mfZCRqMT
zdx-8^t$jGt84*%{RiwPLn{_EAb+(QLY&(y^6IEsPm)67bA9R4Acm198+2`lP51~o;
zSN77zyJQi)1FNZ>r}Go~6TX6{y_Tm)cO{C6IGQOe*n+K;f_(n55ce4Slbn;Ypo1-{
zAG6lU3yVp3<Es_Q2uBDVj*Ir|I+Z8OzlU?IRhA*}1vx|m{WIzhl%5MSlEdD-!R`Jc
zEU2jeefN8xoUd;)5HZbd*88MX3L%{_!OliM(b%X^TTp}I3R*IZWzfmAGn6CP*}nSv
z)Q{@<@D-Pep=!O>7*wl2uv{opO|JnZmyYl}A3Qju;tXQtb)pQat`3K4!Z(}!QS4ev
zlEDSto{r1cJvdpjv=@T~zA@rgp*hXY3`AK^)vr2(Ye?N)ru<;H-rwKnY&4TQfA9)c
z=-_mx*Q?&t?rfk{t9fJ~Wi-pFpNo$E4e_qC&6c^aR$(5chfbnpsQ)`O>;SY;^ww#m
z{e_Wp5<OrW)8AJYDl?D%-8SBM3?QAOcJXO;R-4R@V&U&VY>Wf4=81_J)T4F1n`LtY
zUVqJQtyE_0%o1RUxBWDt;a#s^YTAv7baur?eb9f@JSLM75)oWQy|3>1V`*>gYo9G~
zz~Evs)*~;s6G>1`jzsHBpPNGx+XoBx^3_wIa0iQ?+IQjotiUblTc$V*ttE9A+cWv&
z?Nn<i7hUb;WX9Hs4z0-$gj@E4F?jb!NH28?Nr<z2Pmg@}>T=8I?s=MqI3d6Wab2`K
zR{6}hy?u4a86I9Hp42~2yrKuw;&yD%2_}VjJb>5LT-&;$5-Ek7gv$zkvaHpxaktN0
zpUB`^qo4GtXK$(EgMl%ZMa}Nu`V)v=Q(#3{biqxL?&Z)#5|@fZlK9u|0!>l|{&^gH
z#;vj?*E)KaKaBSyq|Oe08XMI_A!Z5XsEwrGQJ^T)PJwe$xr6ENlC3U~eRA?zWSDvs
zEybTL^)m$69eXzm%Ma>5+tobUoMN|Sm`3w(rxf*kXO{U($A(Lk6R5sJR_-x_fJGPq
zydxEk?UsG*5?goCefESV?z!vwg<1uTx*(6Lp57szv;~`!eSyWAUKp)arNqF}(9pm{
zwOkzIF(oa9_u^(i$a_;XBK7vL(zC@`OmCar*4F+#J^I3<<Lzli8ru`cSAiSp3}psw
zJWR|+^HsiTZhwp@Y{u{UtxifbDw$liBtt#j-H8mUvdhcuo`*A*8Vx*d=UZw11JN=W
zykTC(Pj|+<*T>%2Y)6+r{9I`2NH1h5{SPcn49G0ZA82tw3nOWap$TE{5%4)|PH$F0
z^DV3bsICb55D*Y7l%;+DI4<o|yh-WLmokU;7E);3W#}GR0BEh8&OxBJ`diE0Kudu2
zTD`Sn5`<<>r-8SB2se)?r0qwCJ0YDw<z2_&48)KbY}@yUy+2+ke(ta5gnQ4!?a;)N
z8<43jO;H%y84;9h4yd-1b1*g9LoZxI4eHZE$BW+ui^c}S!5kOAfBkWvHjBBxwBB8$
zL(-P@9d=5)ut4gdOnn`|3c0A=%>-(EH28&s0nGAjbkkX#qbt_x5Y)ANyS5VR2c?<D
zgb$#VojgVoG*&8TpzMsy+yBbQFr&X4Zjm&N5cJ@gGEQnJ_k|WpV?#)un=K|aBK0l0
z-*^;xXmRu>7HBVT^+FK1BjDJo*NrP^Z?qnRCxG2=UPw<lVJ^^{qGb7Hs;g9!H_*oE
zI9o2*r*VPG|GWC|tl{|WVqHn2Zn@+BWZ}CfEKKZ_UP}yF958hm8Cj@^i=7{gZcbZ8
z7H!bq5Zj&kFMVf+&1ZA9A>T_vd-r=lH*fDVdP`>{NaO_SJRdu&(cxQH%A{et?AtXn
z=9<&p4d-j&a%AgkMm1Q~+S&IomM}S<XLKfYw9t%I!B35U8is!<el9?89ZKS6Ho$_k
z%5h$H#K)OJYCaC(q{1S#tkxRAk-x$Q2BJ$!8;UOK?<=v$mVCXDjUH9$Fc=C&mEI1x
zS?grREIQlQ81SClaA#H0xECu#9Zh}sjnthWo{(i^ZqXd}Yf?TvcZDTEu4WHI)bABu
zr$lOvmu2De9xz%b4z$e|6=fJeG-^;wV+FZ?1Z~9XxTz1lUrg$MO6>G%hgxh<#9}8u
z^9mV)4`Td2=x6Qj_A6t1vV(2~CpqOHP0l9~Wn1HQtNM%yD7X9F14DpZ>L7xRsBGy|
z&_6O2pm&qNBcQz_c%kPzDc=Eku6z<93SooM$p|>MIGdLhseQVBy4jCs&7bRt>?Wm<
zhJ<=6h^So4>2QQa2H^Ua29mdBOL22^X}8;cT3jg>0HbWK?C#EMJ(w=}&_=hn<sSju
zts7UVf?sj6{OE9*_|D+xxBK*T!%ZjqC-QOt*nn@2&1G8~8jwOi6pp6<%%Dj^-azmJ
zzq?SOy;*;UB#tvxY`?SA43rcQDpa=c4R~Ez1i($neNGMX)?9FLALy?~;*PnIb;42o
zA-Gw}K<;bVWorIpqyiZ3D83p^3SwJk<IitAYc_Rwsz7s1C>u^%4_AV{Bpa57$3!Cm
zO2x6{Y;12e8iHY91jF+XU;HYx#GW_gKY0oG1?#Xm)2=xS$7MtCq2KP%d^Um(9MNbd
z`IgitN+g86GZc_5oo1#4uw&naWb|0J$c6&<<If;;`Klle#P#Wtc%FDwlc6PI{tbF!
zFBrjI%3nH_^nv95tJITKl^Wc){ZfKEqGTLX?QIw|Yer7Dn*-xA>pUdIVK+zD9|e6x
zZLGFxjkgD$VR6Qrs^J3W5fG50EaV3JXgfW9D{%wG`wdlc13iz`DH-m1Zi2-FyJ@xy
zpv2=MyXI6CwaUd4z9~|a2U|)ZJ3KTXv0Hs}(y7zH^dI{6Yx8(9rtq!qQB#bp(VT2i
zBS&gYXsC4#BL8yhnB}+t?hUoe0zBU#0jB8I(syj0Iy)M}owe+Y{QLDC?{p28#&S9Q
zL}-FBU6VEU)9CT~la}`ZaJqb?f%yH&rDJ31amyB6Ij(2~Cu|1D<fxJO&%G#A1UmaJ
zajZVo3xY8Xq|3^+fM^5_MnagyGB6N8cNJ3{BgTzPPAeg2XJvJ+&E?rznCzLqyji+~
zZg$k57NFq@M=QA;CuHRP=xgf$)K;xDNo){mvNX}vjb*pagxyB*sl+8;3Y@f5T0pq2
z`lYK!ZIJmzW427>kJg<n<wM0$mr~{bdTvsL;o-IgUlp^*WC$EkQHrRUjEvA|Y~kQm
zq1MqJp(4h#FSqW9!GYEtrWCA+TrHIP6uA>UF8g>Q<m%zkHYE>lFf%*rk*%uXH8>tb
zHcIK+65-wIwCCgTn{*)J!Trvzmuj>8Ym^of5^%P)IokRH$rMG%Dn4SY*8Fm@d+p@(
z{WPMT?e6@Gy`&5QKf#yJ9k@JL)OYp2L$Ik8<~T<FIsrSN1&2-Y=z$-Du9&?C$BhFY
z$uy%^`}>m@$iI}lskO1THc3L7F{xoDmiowYn7oF($ul!a{}n<GQ1AlvbQQZUEN~33
zdf;MWWg0-?z9;E6vlkho!Y?Q?ZMs#3x}-ULLbf`&f;{1%n_u=5I<k$c?IG@H1cBrF
z)eyBe`$Uk-Qj`N&SC{r{fpt@8!Ju0Qmg?Gs_o0i4`Qkr^a-u^&gtBCxr7X+~l?EgR
zP0gkHD0q7MTYP#KG)OZwvcG|Pwec3}TaMs+mYS)pdSo40>zLm}Yri-lIW~j$(mV!D
ziMFJDKlB@#=|g}|hMHxcj)+nBrz|YoW_=EKO;To9I$QL!>=1FW==+kI>`)ZV(ea-C
z?OWWv+9q!#Y<%2F_0UC>4zFnPK4If;5f!%EFXQBa*W~iga|-@|wi?$9<HHFd#d$Ol
zCp-{adN`g<0BO=&-r45$|604wpeUNPOOTAREJ-8>0f~}xTG9fN7Ri!9BuEfgKtXbl
zj7SDSvPfJ&lA@A9K{AqaUV;cqhC6`YTVGkP_t%}8>e`v<?e6LBneOMD^Gst-2k+>V
zvh5x2RobM=S)QHsiikoy$q0cLw?L_GpA1~AkcL#jk?sCP59K*CE_0O&rCXgSfiA1p
z<}qAHQ;PBGN+4*=t7G^%HxZ0K|J=uG&u*qQqGRwU3nL@%wrRKC1K}qNpk-#qetNoy
z`o~54Ga=mx)2!0s&$IRSOPfAY3W_`u(~E0L7PX+OU1eNIS9UKezCy;bAbuEC_&3Qf
zsAE4cdJ890f7gu9nMF)pW$<!9+)lr}+#JR<;_1QL(W4zN(zcM`tzvD{w>oMDDygt{
z?{sO&Xg=C+nJ|0k@`Jt#mpn-M+63{of3-~}A;O%il_mro_<3CG(i%a^D<ss$9)QRP
zk#KRvow5*nFrasQupM~nz9Ht-7D*REWLo3(Yt#3PSBS441;P_kNn#I{=)t0)i32km
ze8&nzD!WGBVlJGWTc4JE#-g4Pj-=yCW5yd-HlG(@x||F4%A!GN5&IBkg>OvXin>!B
zE#fuGM^v8*4wJUo$jLjO9l5t+lMRzc#MG2*&I&Dr5((kG2yCSQQ%s~wmaP@9hUJEI
zd1YBst(t5+o)8m6yobPTU6MdCk-J?TU$tz8o_H6V(w?VPWxrk+P}|5+D+lE9nEd=3
z&$Sp6s;&hh!Evfl*cJ|eQ4Prw06gS{4dd1I;QPWAJg@AMS*1Lg#r%Ts{FAtKGNiEj
zX~D=T<M$8xY7P!O0=#)Pbuh6Wz<7H;PaxIg`zL7d)X<o$q;9fGu_f+CS7#Hk$tM>z
zmA2F?hvZv6NL?*BPFUFV0uNZNGw#r=id!@{#o|o7e=0bNACIRbGiL+up4@Lq>UU5w
zB%8!WxBwljdbVh^z~(*E__I@AA<4<Qb<_!#)U$nt>4@Fj4(-O`{ZHa9+BoZ}^gpCE
zg7I;`g`zv=(ffy_W<tE+KT{x+@H<l+8R|Do1wY4MH(3{=-}36CoebY!dxMSB{Z)M^
zD2@BxmpF?}feZS<pA-b$%n`#<>%DyaHBw_7Bv@EklaahkKL0tF?BaQoq*>`z=&fs<
z0&c|(4@XHh3L^7#VEwNQDeM+IMyQD?M;moG-ufdw*ulDHWf>)pgAvM!-LkW@^X&l9
zk8+$e9B9ULip!G2wb5PY9^FAWI%?JnJB<(L_@0-D!`<vg)W_u*ME8ItE*^eMW5w^?
znI2YthN!NPjkdL=-0_4?_nfYmy}Yf$nas;%KxBLMEX1;7)ZRI^8i!j+%Ww^xpgd{m
zh`S->Z!E++Ft?8mT}Pj|mbVyM%@r_bYsbatj4L{9FYcvznn^ohbvH{wnM-~ULlP=K
zs*=*UlDkEFQ4;#&WzJ;tHib5SpiMmWN_N&3ZE7Ex=+mmWGZ_r=c1hRmDA_b@G7-E5
zJ@S6o8-v>&9TDBLY=YHx6XIqzleUe^fGc*=$JEjZnUqt!@k)+Lp$NUAJxSPc!Aa8;
zmop05g+p17#V=37R62n?oeO$##^&F|?Z(U<9#+#kp;Ji$l`2=;*tkpAL@NoA5w>GE
z#BQqSCIQ3W)I;wj_RDWyv*pb)W4sftsmC_R%l$>B{gVt0YFjH?*4z6ap4HB_p_+=<
z<4KjXi)`Zda)AcL)_~DNvxiO;G^Am*p8m?YF)@#_;NJ0qP&lf~8#*j?T1g{JhX39%
zn3M82wF=jF_hyQ+JYDQv)}<kiTr8!00(k)@OG2<YlYOPd+4a?w(kQXVx5e^FCO(G;
zkO$)f)+qr-)m)xTg|^j^V!dmtG3OPV1*Jk?@>8c09tJSk0|=go(AkojzW&N-3#mKw
zCI#8eFzHduI+z%49Jzy=P2oLd?YF^=hrZ{5OGZ`B=C%r!B=No5&b*05z=yYSHB9R5
zbikP;e1h|o)+hETsi)T8{W0IV%T!S`$aRkFt<9P;2v=o?{)q4fXg)68q(e^E=H^Ms
zmBp|8%Yx=hp617M2^=u0SGZyg#f;MzPLqJ<#vkp~9F)$q_#4V<JUS<%L2ig^I7fW!
zi{uz!8BL~(({XG<W(Y*Q@Tm|e0*}pwkCv?LjAWQQ4rX$9?^aj0f~`^?^!N4kaHTPo
zQu6lb_uY8cIcZw02*;tgLr>2Fscrd$tENMZaf`6gognj5$M>`Xhm?ui;g$+~#o;0B
z8Xg;pTc8s9F~$KbF`p`Hjw9HGtc=Ot9-0RYi!081?|<w1yO*V5Op1Kg<93@6GnNoP
zQuL7m^%&2!KzY!<ZZZ3ydgXn?#;yeVc;l1<oWZpjqnbDbW-v4=YH=nz(1bC#>ig!$
z{^!K74Ud((2;PZwemdiYcSTw?tx1e*$USLzlWU*FLMn)pSAXF&R`>pdVs5!=n$T;4
zGyFPNieIyBktzCLiNi%BUCHk3xb2&eHf=oP(6!eKU5L7SX!MKROqc!*{|!n9w@B3n
zECam$K>8Yy12fXszFaRN!WBIo5Y_US%mVx3Zp=F=($QhXx>G7-aoi`v>0Vjkt3i7V
z3YgXNX~nXLO1&jH1Zp*XBj&t@hV{m#5QD9Vx@!tw1erWB64`K$_K=BMZjLm)RW_-N
z9ly7qUvlvTnDMEzT4}WtE2$GbxaNEZv}sk??Yx0<>duJy8UPo)^dAGrmU{q&l-gIp
z2v8qM3TPTz7Kf?fByH2lf;j6a+`y3m;m<sBCojG`G5*Zc%sy;Q-iGGGUoeVn<db&8
zOaN!Ap)WZ~*0bLWP4XaEEqpPr@0vF!a%uQnz>UvW#y$2zu9t`boUZfiZk_8mV5>Q=
z!u0F)ih>5oncAX*@13;ou69_&@tB(@3VZ<VNVpBMSxxCzx>y!S`IHYb=<?kErTNIT
z$l$AYqG)fOu{g8O=0w5w^k4!CE+drM`Y;O%3yjKE+t&HD&efbR_gWT``qAWOi^u6!
znK6!eDJuN7g`>sDnGb>Y5SrL(T(q%Mw-FojV(c)09~y3sXb}lNmg=uNZZ&Oh`+!f3
zsz;soY;E_Qa*ffmkNy~|Z!;w*FCP6l<)d-^=CvqT>LMMgr#sCs(M@u!ZoJN1nyHAm
zJ{N@^Kzf4=Df4T1O59^UzIN@KZAcww&)M#;3P;II<d2le&!FJN=aj3J9_MFEC2ut9
zuG1DyLRC~il;MvwHxv$GFuf>j?`Fg^T+Es>WAO?aNy+_`fw}CQXgB1Ov*kE_(hBHE
z&kwA)nxg<OXi_9IrVTa`nbj@;S+<6RZaGcir(|*5yUDSai|ojxa~gL6co2pfr@+oo
zg#;`n1x>t$*m5HW9MR}6renopLK2<JCX|gd8^fy86Ce7wUU;cL__P%&L95iT`+459
zJkDAgWXK`>l(}kBb)JQKYvB8S?881N%{<IihEr+9arKRy<GoC;^2ec{zb5g1X|ZOA
zFCoCp^>4eL;H|?h>yR)y54xWrN)yvSV|UEe$Vk3EG%r`cUMXo1xM1T1V|`hpG40^%
zzBSc(hPf~J_@~+4m`eQfz!~m9v=Yi1${^&ATDm~ZmGV#`vdo~^*Q<9JGQm`>t3mn>
z>64-2a0Qbmh0A1ZQGEh=Qq9&h=C;l!dAS~AS8Q5ttlw0ZgNE4{m&vcYq^1|9E}&-k
zY?%<+xREOYU&wcG-2=nTPZ>{28!FvI$)&)YY19*}+%bXEH3073MAUQvwr?Pd$3YAX
z2(UL(s4TFQP++ME+5G#eG?-idB9<3hN_L87t;60L1C!EJgEu9?u5!19h2=3Jb?yF)
ztejkPMw)OEk2dxZGT^o<=vq|paqJ3Zoe01n1wI)xtaF^q<hN<WC6qT=64lO^c@1}V
zPL^<_hDW6c*e;zM#-XEI%mV~n;L$z>DjW1<du96hGq-u{LGvnp-=A{@Qc|9~{oO<E
zgS~Iu?T28$K<;mJb5ypES%a&6N+%16VbHDdL{Cm&b;terLak*UlOT(!3gZR~g>d@7
z_W86I1Pb+a4GrWx(MUSjjR}@3CeNRc!P%n|VbiWYXq>cQkWFYSN+1;A=fZ5ht$&vS
zueLJlS;}(%R9m;ojg=Uurzs;?MrS-=83;J7Xs7nzd`@PC|8m%f`aJYbFTTVx=K~AQ
zt^cQ*$&&Nyfdy(Lpk?GqXq52hu-wzHwd&-cqca#ZvKuExMkI2C4)$}LA8|Y$GKl!i
z)w_XY5Coh-`aXT$R{6u`C@*AvjrVPG|KiGri_5&}q|uDXzWE&E2H~*=BSMshxk9QB
z3Ls{EQK8A0z&P8hM!$$5pzXZE()sZU^2qd)c?-ThH#Zks#>B@!<eqAZo1wV2W`mCY
zkM!ko<|Kw|CMmN(D@$%hBb3?B&Dj+BZO~dN=0qYS{-u^#!YTkIJAF5r(flMewEPN`
zbN%Ahft?MUg;o+4{2O1%e2E6r6FxjzKa)PIwb&TjJ#d-Xo_%lJ@bv!M{xZF?-KysL
zt70(&0+8X_cXbQDe0$nD_&nz2jyY9HNBrmb$M?*-#jGTJsi=(DOAMN%`RS=IiKL4W
zI?C_)SWyM}@4T&O(S3Y;avg>ja@!1}S3SLI8%!nLiyqB3tv(9WxuDrE_eM>Ou*dDw
z6k?t?(te-fi$=p*iL~rYyo$m1N=CL|mpj(p+V;gKLig~ff0cmb1^^O`Tnuuxe^S2s
z_a7ll9T;D_4EkRF&g+lMzYpojE<V_Bm6((z#>2yn%7Ya|W2gZ&{p6J?^at5|aB$Jg
z-b+Zp@tK|j%qHmu)z$T!rIPp-KC?pdyGE|s<e#vRWQH+l&7l?`erHq}%@U=3hbRXS
z2Vu>0l09>@|E`Te2gd?U+I@K0DMlTN>f<r~J@HtX5E3)|XhNkf?EhXN0zkoCY5ytI
zzy7eo2cX83fP|>4so1~90ZwZAEm8kbFMk|%kOH(XKNbho?W>3UFClP;qE`mP-@@2C
zK(TG`b%j(ev7o<21LQca|JTv}($fD!InIUPQ#oJY+of#f@7XpwU_|<zA!4MJuG~2O
dQuq|bnR935ZTQD+jy*JBQ&v!yFNK%|{0EQ*(E0!X

literal 0
HcmV?d00001

diff --git a/tools/stern/screenshots/2.png b/tools/stern/screenshots/2.png
new file mode 100644
index 0000000000000000000000000000000000000000..e94c3d354e22346a5c88c7d687fd586745371a88
GIT binary patch
literal 137064
zcmeFZXFQzU)<2FALV^g9h?a;pf+TwH5xsXq5WV-_B1qIkbkX~m(Z=W{2%>kQ6TOb!
zncu~^+d22SpZ}ZZ)&KLn8P_%T?6TI{t9{qr9~I>#@8FW*qM@PPk$NqzjE08ohlYm9
zje`MvV_Kq44E(v_C@Q6jgM%|Mr!b3#MvW#VE~4tDw=sq7Myy8KYQL&xvGSg!?r1vc
zwIn7cdiF<ZLv-=1Bg1qCO~R}I;T5$IYBdkZPt!Up$=h{vyLaZdOyD1HJzYqpC+Ia<
z>PhzWg;&E(d%k{Tzl<>|+73X&z@hg0Zy&<1@x<|0@mC4ZF$smy{_BUYe_l}f*nFAW
zfA8U{SHiq+hno{Otl><)PY{o9@G3Hp{bOTHNk23vyP=;q|Lb7DET|Rzb7{FTtR-*!
z<CHKrFnoM`CR{eSy_cZ(bEFfV_)gb;ra>{SCfqige*O<@MZ;*k`x9Z>n?GnuDRk10
zcd^=shrTjfTzco9sPk>-9{nZ`zOMxdy4m#8|DjvOUvO`>U?D^Zur$rF|6yt97=8Xk
z{r{cNS8M0Sz)TCsY~}pNvHWof{qUnd-2BG|jd!WhD9Aa=MgD0J994h;Y2xhvz-~-J
zoCq|4EO{mWNEYEVV3s#%GtmEuZo+n$IKtSH;nx2oQ<xYez$_W=-ucG{?`VY4c)2aC
z{!w%Z^MF|je>D5AVtp-?<N&c7m5d(!lNk96V*#_27XMSu{Owq07Z*tw{Zh^PGm`mS
zd%isEN#e5o=7*kAmi2GscmVWWd+*QLKY9Oct~r?M{47_m&Li<;wlUxfy~5TlbaXR?
zXtTep!4FIgBL55TYWFeR_m;vb_*{nadV72%!yde_9D(vWuX*jZ)3aXeCs6-|#;nqQ
zX#1g2rVW2~(5o<eG~-)=v>MEjOZ7g~3cCHUHT;pOzRzMu45ffaSE`VZ$Nowrm5|Rm
ztYY7^EB?hW9k|*lj#a<j`>b4VrT3{+)cL`vzQ+r%<Lv}CQ@sYCi~dZ>7lz->Cd#ct
z?=!1z&YyIL3q1al%!EMz*@EW+n*07-zNm<>l8HntjbsG$oBjFm4oqOO)*Y^zuYBs*
z9CU|KC5PW>Me$^J(RFhi@um@jncrnYvon@CS1u`s^ibqrZP;>mp?w&lHrRA=cBBE-
z+}WC{*_@~#2=pJM{R;u+6#U5g=8*9(4FBM%{~J7pqLXCTX&(Du@1^Y)I^%k$dn;yq
zYHVlf{cm7{PN9oMb%)x^J;|gjx|N14xLh?8z|=kp7RZ%bjaiHq3Rny=aBXS@{;3^>
z-xE>a;1#8?p$q-}OK~TE^cy#yX_w_meW8QtRJauPIWPmu3PaQ?ri*&ix$XSIB>`b#
z=Kgxrk*l7u56F(Hd-Le1hB5E?`FXSfMIYTW$v-zF^)DPkzX<NO#Dpim)AcU+4X}Oz
z&%>@1fwTA*Mqim(^lI~P98&n*p=u#C1+Rjoh4{EQWezvSG9eVW3aFhns`e<_LD87l
z%e8_cK#-rdI{ZnM4|Krx$)K=b`f~}2{*KE%9KdSTp_*`$?vQ)*5%6~@Ol}K5?#B2;
z+-FYQ(~gtLkxzzvUl#N}jbDLxay}FP%bcI!*%`eN7d-8v_+4{<V8Do^6tMVNJa@9U
z?0de`2GxR(=fbR3fLF`*N4B-;U5fx0Cq{ja=Yj!tv&j(0tKZnuX6yw_ll%6p|E215
z8KOO3CHF}P<KAD!`gQ}@UX;}Rn7@xCO#Kzl>trzw_hG@7<HhL#)#aJw-DTg)6Un`^
zmCQ(o#g5?;BgvNhgIvQAv7p<4Aj>zt!|L8(d;25JYgs0aWeVWAI!qf^c>Qw#<N#Vq
zshz=zt9EvL{N5216!|-wsr`gsU+GsVxl_?UR*n;Zadw2H;&&^)nX_+d{DSY?Ed8P5
zWTpKmR4Wsk;6Af9yJQ48Alwrbwlm`h%X_raZ^_E6#!4-QA%S?LEXrB0Yg{&o;{kpi
zhdpGApb|;}_BRF=ZeC^ZE_9e%B}W#}75D+fw{QKiTr~gXXN2bGOl@VICXs`J%M@_F
zKY06Rqw6RCZH6~$g-L9_{>{ghqj@&58y(2hc9EM-Zv6FO5C5a_@2@!6fCg`F6fykp
zrz-ikCt){YKtWSRk{P}FgAo62Fq-@U{cC6U>A{n~Y|y{<K}dO}C)zSw<M00aFMn4X
z{&v)Wkdl)>4f^mW1ODyly(BtD-`q~#3zL6XJvBM7k?^sxKR*6rBmH#>z~-7$0<4`I
zzs3KN;{QnTr)d12RQ%ze|F4kZ0~sZD_rLaeQ^dCr5~j<OWvcL8r_}*1xXGPt|70Ow
zpY;(~91FPG6{!c+EYb7aL_CoQG1K=&T^ywdcou?d4p;g!HT1m^!u}ZM16f*?c5^XI
z8ZS+IbRnwwiev;+f7{`H^nel*P|CP+%(hkE?635Pya#OhOXsyA19D?PAxlP5B5pne
zOy18DBTsjC#%BeD)(;-mzH(dXO9vG5WSyr5O&BR_N=1chp>CC7YnVAz`Us15*-B#o
zw#gh|xo9L08v>RW+P@TN6qRd(Zo__-iT0AR>J2poU=tAe;nQFz8vH@Xe@U0PCZMwJ
z9`>=>1CDg*x7ER1z$_q_mo*R;!^Kp7F7eaN!30G@Cp-=duK^Rax7<s$a1y+7ldKon
zfb#kE{Z_#!U~QNhwS+v6wqVNH(jml*P_<n7<d^-XSUEArP-~Lhk#VE8hy+f+73uy=
z(+2n&$~m(6sw-vYgQusbAQ@iqU|G|D&4!;I-CNW2$EP`-&1V@~Hy5^@7kKpM*4<uc
z0}Az<h#wle?X9aP760}x^h~E4=IhS~0UkL4ZyIhIbK1t(mb!c{8$SR870sZeH~Ro}
zzNf%+`W2)G0UXD?@*tv&m<?z;@RR*+u9>h$T!jzQ)e}f95@==aTmBqzU@mLw?#NO<
zKgE&{2h;rS>-@eC{b+^J61i?%u}@Z*r%K=ZV7MolFGi?9S6jmT5xbdUk)A;IBoJA;
z0u0MBFEMP{e`5dZyYwiBjLmc{kJZoO8J{z`;ZK>8k%f0=07(K|UmY+LCUl$vT;p=F
zKd2ydJR3kO6Z=#qR`wut_#1SsFFgR{ndkomuATRic&f&=NVlrAvpLggwk4F*5(#jN
zRip50C+CPLmURpTR0!~x1Pq!mTlzRC)Jhav-ZHD!7h?=U0@6!Ka%xMLvd_&Hi6?5*
zV#0v&06xg0|9bGk@agMM)JCmgV{lW~s`dG{NTzpCwTwKq0`;c%w<r=nj&^}NH)AsK
zNI>kSJ>=QuOgHPi&s<3Q`pigJG-6B#1KbYo(aV1Yd<4LUXzB3NJ6oU!e1yf$xCW1d
zHNb-y((B#`{&qnu4!H%YdgZC%P4L*vWvy=!Q|s?`loD`f4hcg{021%wt+YFHSdNrA
zd?g7Tifl@gZc$601Ke6nal84}a3Wgijp@1xcEtx8B5yCOrfc1gx91LF#Iu+4kwPOy
z`bB~G24jG$CjXUN>9f|LUXn(U9{7d2M0oO1fpD=;nXbQ4OqQa(=`v@JjO^4~=21M$
zdoeIgghdR;x{iX6s*aZNE7=4*godydNj8jgTwLh$6A6chej~){g}V8$p)}Dz+@5|@
z7!mYgO4H=w@_k5CP)9&~H;I`#n)Z&(WA5I?jWIYjKDnJ9WgpRzisHWe)?^i(fUW=o
zgYA0~IN)Bn34524U%5E5fp{xM8RmmIH?Z-CjQdFiADp2%3Fweo>Xez?&3V=GrYX~}
z^u7~Wj;pF0Isb1i&Nsl7SW3Q<QGSx+%QK{0n3_~ahliloadD|ViKtpWZZ^N|&tj3)
zGCGITy<Q=vTyE_$Gm}o%hVudO)JL3FKjEed*+dmKQ`&R=cWGX&=-B&XU_JZQaCs_I
zL~`C8%bY|q&0&d91L7mKMKJ{&t6@kCr-tf&ZmJI%k3-hpU1e2`K)UE3&}SyW%LhDM
z>cnbdYPKLd1G>C-B<dG;VyYDD%SS--IyVLb&JK|?sN)@@MT(@m7WX8YyMsJ}(m~+7
zl8~2{xcFzv-?bWD7X_0%x^bs?yZS9`DT(rg5Guj)P+IACBVt$_jew&X3SMouU?ev-
zW%4UDu&fe22fXrr2j(G&9|K16yNJ+_f=oW?^VxQ-i5!;EQm`&d0k{&}Mcw$;mBaVV
z@qXW;-c(y=B)#{@3QGpy>|%Kk^!Ywa7yNv1cMuR1Wc`_ZswEKFmU*lX7sLs&PP;Et
zFt5%u0J$3X8MpaxRB6#0+XB1=vfQ5g8v@72$1CKoXk5o&TVrdZMKft40lI}#)y@U-
zK3#WSfka`0kK;(2z&4L+15a^A;8clRwuRjXCueiPR6c;UF<5hW_sKcLtXm!_5Vvg7
zm~`noxpqRu8hq3n>W!)yf=9&3<E1vE7<4221FscO4`4l#<uu=+Vcb;}ehg-F^oFYu
zD~p)!O)2A%kO5}E46swOHzZOIa@}E8V>|P0>xg%?xUvNs0m>d~MVUSqr`mb7+Ma0I
zGOEU+`6D2AE6xhkSqrIt?Zx4QHW0t3GQ5Y8qSKy$&d2kVXe3^fJVNXyCiAh&MAO2k
z_OxFZwpi>fcADBkA8YwSOtI1qa(TJ%)Of^s`aNK`K#V$S9Q)&oY`2Gn+lN2~={Kb#
zIGu$y_)7KGALY0+vjpE19SM`I)o~w*(ugf1DIRgXRlxZ{ui(LlF@9h#;B$y=OjW18
z%h=4J{BWp~Bl~cVQ}Idp!0_<L`uF$zT-*t-)djz)e~D3BVlMi+Lw?GWG;OJLE;R4k
ztI}E0Mp)H&-a!y@^|bC3(;HxrJYWHYJtxb|zsQ4i3y0;jL&_lM8eiz-oSM?c)vGUL
zmY)LQj?0*!_<ftn%Kjlt728uyR-JNar(+i3m_{*QKaSdiZY!HbD$JUSPvhHx<N$LN
z9(bWbHQHo8+b6%W0WuDN5$Bb0;(kPsFD5K>&88GQK!Z(&!~z;D3NH`3UF*Kb-maAS
ziqZ3RmAv(MSxG%H7P~v`!-P)-1DR0P<`DD5Lx}NQu>la8Vw{>}huq64iE{78OXkHc
z)5o%a`MC*Oe~q(z0|I5dE)cj0bGS#AtE{~rK6I*VQCAFk#}N8mJT<w7Lnhk5I)y0@
zG6InzQe^9mTc0Re4xcJ>62e;4Vw%uSVw&7uFKS5ifzmMC=MsS9UhAEzTY2nX1oNFo
zBM!|3+(tIQRKkEIP;#bgd3TT&NX)2gR>eZUj$868soLQ6s2qvhi0Nrp0$Yp&pWF5u
zjy@VH;_Oo(p6xPKPZji5J)P0LH3IU+udW?md#)c7KCooM&!i6R3p52c4ilX%8i27c
zfHZ)!lGdp7aKlBlt=Y<IfZk^hu<|gm&&eVwO_~axK(Z)3bG2sSVzsGEl*jIS4z%P}
zhDKei%4zQ-FkJBnZ8h-MCGPZUD<cW+y?ntJSb6Jh&g&z?j-;|O_NzBkH9}+9VN5F?
z$M0jAK5G#SD1K6{U~=A?)QS{WPx3xHT%CNS%i9ta6p`q@9|)0M>8MV5{7e`;ukpQ)
zJPq(r%vpHt2b?dWXk{$Y8LKmrhI4?NPfZ*<>-vXv%4f+xR*k@>&ur@sVlAQriHjm~
zT5XYXw#-u(oNs>+wws-Lq?`J$+~k-#Jp>lIu0`zeXe9_<ZauN4T+JEXoFNe!ty08v
zQT^3cc`2p=8q0g3Q~bu?Dn`1<=q*d(`oM9e{k&6i!t|G(qp$hRghG0}^&znJNe3W{
zQjL?&1&LZGu^Ewy?pbGNU2L+vkB_7}JJUxx!iFD@&_1c-a@t>9T5@CD1KaX+D~VSp
zHD=ko|M7Uxhr`4<8})eQ`Dz1BU9hvoGCvIgDwyy|X2w0h_)x#Y6OWkPGd%^w*N--B
zLI^MbmiO#ODk!FEAh!59lqHX7nN&2b_ZJ(_<Nb1C;|+-qyQla^dq8nk!)<nO{a%e#
z%i{Vw^+(g5)jC>t-v(+O4EJ|1st3i@!&ZlMwFV$g>Dul10y>Vj^1cNQ>!qXbY17$=
zE?XD{_Q=^Fyd%f^vV<m*+y%Abn5PsPwF|7}aP&~xM#XxS8wvl?eZ6wR#>xBU#$YN0
zQe%hDyK7aevDzX3Q>+$;aR+gWjvAc|Nd^fPn;J23=O99P&)28r4he`uqHN#SlcPMv
zI<4lI<o@k}wh}>15@Yo@O3i&Rwvg&X1BQ+4zPD>b`3)yaNn{)rE3(bRkskOqiGjG9
z2U}A*SX}!*^uwi<%(3nR`O1P7n7}Et(d-oDkU?1N{f2}|UG-dP#~ZE~^WosrTP(x`
z!ZKGev&vZd4!ekeqoza%huo&jUEe{yyQa6+%bzDJGMd0D;rPK`vJ8sW#J0mEJEQu(
z;CUs2Loib%G?r`|$O9JiWr+@tm<J^?zJ@TJ;zq2Ob(7nJ<utylqwDi9om%~hOb>?Q
z)TaRXmb%9zVd~t|x`%y~2R6}FH=&*osHs0gD@2Z+Q^JAc4U>onm-Z?mq})6am$yLd
zAnl7(H@L*PaV^U4$!O2LTjBHB4vuT;TnnooR)lCN_ynHls3^XjRHd-ryL^Fk1oQO8
zJG;LDOj`9^FIoBC&H#wkYsE$E09v84LIPG&oq9`B`So)!O3d!i^xDP>D_$k2)xr(|
z-S-lY!CYbnQ}t25Dp-*v212!V7N5kE^pt|5Z?llM(fL?uDWbVtJ)K}#a0=>RLq0^i
zrmK&4kUVIWm%kd=)R)r{tSk{-kU>~mPs+1zHDv)Q67%00%6gqd)?q`YBf%`&T2_}$
zg06A%lks{ElY)9x>bsZ`m;gu_xowo~>Rw7SejVw&Pw^AXBCb}Gz%lOR^?J%!Tp%3v
z#1A(<@w6qx9}*Sy4u)&BI<GKiZkz-XQ_-pm5li?0!RV`Ix5Vhf#Q=d|-1)6Vp_v|+
zFbfe)N2NFN{bK8qJSjbcsu?AR*=U6Ww$8h6ya!et)k~DTYe91wsf->&{@T2@lw>mO
zG~V^=htJwoA*$^Voka(IAfAj06BA&%*E-z%w2SUk#onFcOZk(2>BwP+MQ<6kbSZ15
zCy#YL8!9olJi8Be8!;^@b0!hNi|O3(YMd}oT~iN_c?Pu^)?4j5<c7v3EgP(WYIuHm
z$gGgd;>EDQT1Re0cDCPiPA`SPGK)HIkLzkI9^@!rmMWWJ8Ahg9Ci41!E~iva50;9z
z+zgom4HdcuiWc%3mG$_tn*??`gEDXs4g=kMDxbZl{Dz@gY+B|lEGkuE^KRz3kVY5^
zSN0aEG3|Py|Fn?D-s^8E4s*BjUNFUJ(Rsl0A0$87-HMF!=zFXpSb3P8VVyE*JzJ}C
zBomF5QIWR`HMY^_?fvlu^|*2d&+<CM#!sAv862$0E{5j+;Yr%wtj$#Qs*8Lw?mAO=
zPx-;HYVY9SIZT$pQx7iReZV26#vKjGwD_q0@D5@$F60yF$sDvu)<ES3?`s6k!9}B!
z@yj1jB+==sx5{u>mziaxx?Xv`^4eJ~39UwH{KcgqVwCH?x8wlVi$%=Uq?me#^+zA}
zejvmvRzQSlq@r*xl?ClNH2BBy%1O=#cvA`@!3z54`^;ed_rx?fn_u(agr&+|X9Az5
z31>wyktih!`PLJG)P@_Y^M4F^DL%sD?Plga<sJ-1i1r4_`}2G2f`oHOLxR_Gs19-}
zAsJoOs!#%M+SD~0Z^wX$5Yap_PfV51BI_lDYkilmdDr{$xGY_@%>-05j#O7^awJ0U
z=VS}667zZqVynVcigl!*(q_X7&q1y{VS|(@oPHK*w?M~cDNoGCE#J{a+lIKs2cCXX
zt5oON;1$NWwO<YbTNMj+Xcjp?{6-eZLFD}|iKcKqo5y8!K%#0I7kgben7VWqdaxih
zm~NP}6eyj~(B?G))dEc$_C78K!4gE)!qY2ao6;=uJ5ju@17mT{boq`l1%63OhCPF2
zALS+0el%^oM$*#KVH@#^2<W{mBh^viEoZr5R<>j{a#ARG_Q|Q1-DG`?l2;GFZ${Ez
zOz={%S{I-gqUj4Kc8T*{wM?EqP~lAaprn95s#Sm=E4s$xxWwL>Y?_5)#yk~z|Arvo
z&b6d$0IsjQ(A9ocz>1#8P&o&{ixtmz^>SLnkD;tLJ68K(PzzX+RE%miYeDse%1oLQ
z2Fw$L&=oL?ad<}@Iiew`Hi);v_zra!%m_NYZz>N3f(zkdvE|cx81l9SbOjRg{cU}L
z&dfdbH{J?;aqkb-NBOJ@{h;zQ2uW}75IFm^yl8rVN_oyX2B(Z`Bu>DbLC$=v)L6Ta
zHDo-r^T~J!&bmy#`+lm0U*3N3li5=X$akteFHvuly_@nc-@A@NSgWg^rR{zy)nDrs
z)*eOEF)>LnM91yxyL6Xd`;Cto(s~(5a7J3>TVSe3!miH}dXkG;*2F+*7m%JHWv7Fk
zEYfks&#c~<D>UtTzRf9@P#<F4GHkIM(zNCJ&gFuM98s9Jh%|u^%)eFd2AR8J9MdnT
zHetw#e5xQgol8KeulmXQWK2^I8AR|5+E+Ec(j|h@ZqzL(54yi5UCyCT@)I#5Vm$Tj
zZKMh0Nyvb|^O!JIhsWCz77f10#ywgVTQU_wT~qrtEm~^T*WJ;0Q)Ca6ey;^Ms#V}(
zc4ptSMH^Js_~p!-g;UzMp)m;qy;us2cB%q9zfrxXHO$QJFnp`zaM9rj{=?fW3VWhw
zZmZIf(t&xODlTjKFiBdS=QGu8E<*>k;|5g^t3{i6D~5b2I^svXZ)~~FooHW-!U`}#
z#+krV9>vnaY`FWrI4Q_Dz|{sM!v>R~aqecY8i4MXVD2-^*uR|`%I8BT(dMZ724oS~
zwfIYm4L_gW&z0O?sd;}wmy-ssCn)eQ6(SBBY5wJmR}3Mi<ac`>jj3kazoBh!aIeG}
zPBXO#k&gDjuT*nV&K;*Ckw7JiQ#xmSC-*j0c{*Ng`Ex(NNI;tI<=D*W%`4TZM$B05
zi-$mh6;_on^<{{2)lC$I^<NX`me&(8h}Rpn;V&v^^_xyLSs6d5N=OVY0OHnnJvYUx
zCOp1HP>SR?1t#X4)yN4<@^xRU8c}uOy8<m|Q0%Vi4PBImhTRyXtbp9q8<fxodD2te
zET!?mxlwZhgqcG?&HMu0%sOLq$=#L36W=WT(2RA<N*bJBGLR7ynXd?a613E|m_6oK
zeSz$B7STvI#p;$@CGe)JJ~tb|GPxt$y8}lmX+%3Kjd(#VtLTianHcu^^FzB6D>?Y;
z>>j3(R&LR=RXj|nEFb$U|6Dgha%wzv0Xlm4!%g@Z?!AJqiTJ674A?_-S+VP?BDr^}
zP35x-Hy6jD75?(J`+6iFcq|7V=KLzIo}^qE3w(2MST4W4p*u1w21vkDb*_`uXib%3
z0_wD*$m!(}xX#!kUcKt^yJiD*xRDHMTG`(=u`*F-=mXRTmr7a>z+?{vJj&byu-Ivi
zP-4f(fOKrYk3~ZVAoxUAjO*;Gu<Ix&0?JOCTn<{-vVSW;D)F)P{wLfCMo}2w!G5>&
zm~e<((h%k1T_%hC+%^V!8U5+9DhFRxTX}`~TeP~~zJMmHZ)J%5SuMua=WYIzmqNpC
z@>CB-xo`J~d8opvTjH*PTt~H1|C*vc$jLQ}t}wyEWnB7(og+L;SvxGOK0mR`aJeJ_
zZ27!;Mny%jVqCn$)>}bczT)61)$*NyitiW1><{F0^~2=8iOwL{A5a)Nf*-qizGb>v
zi9aE+;>*>ce3gTQjBl|a+}#Omk`m5S`$eddb?qEZrBe8o#em~pG=Zg{t`k^mG(LvH
z90<p?A9H^B4v_&&HAz@7;ff(_Adloobs0otDDik079zbGCThvyc2HEAmGl|gIcC?6
z<OP>dV!pRywijq6N2YVh-#O&H1?*CdTaTs$;*cQsbR<ja-tg#1=K1>^s&sQ+-jjaQ
zGV@G1C%vq0XIj0%{%C|Q)uJ?}dO4KEZ9SHbf-DZ**!w%v4Q+e1DcKx2o#j{U!orOb
z8MyQmu5{Gy(7jD!fzgMdkI1`~VrobxhO2_f$qRF8#`?afiN?mCyokHcZmh(xtc@6T
zqBHVc3U0NEKur61u&z!@1t<}C%&gh43Dmym3)Wdn&hOl={wzN<E<NZ<x!}mHmss@l
zpa?Xrc>`zVBJ-$9nQ&k8^~nl2*YX7LN<<GK$n<~$F;<qnC8v}nU)>C^yLF+m92OK<
zacmAKq4y|mG|p?lyBJU-jY;T0bnFI7TQDvVHxg!`NImB+Qmfs~q!;Qb=pu?6V?u`w
z#IeNbPeXf1SVwNeVT{LV71Fm>+P)b9!B@k%ri&|7IYa8qGPSZl)Y@1&kEO@*L6wEa
z^za52)lJgtzj!LIYu(~Lwcl!6BzL|gLO|qXvtfd30ks_sspZ3-Nj@|9SJDdauHrK*
zpfp0dWC*qF?5~J*XOcjyrIZ+bXzHTcIQLECyAjFS(w8yx1!x&ncP0D9rsT7JmSF_q
zI<DK}!?Y0&Gw@Et8XSmwaiuST{PHQg((wfQpoAO=oqFRZ05)LCRZI1-DV(j|7`qU~
z+EpEGD(lZyk*J0pCdNfMl6)DaugUNi?E@{o2aW28DO>Hsdj;XHg_32ATRg5?x;&Ou
zL6C_m+4yOoQ^S@t1RsaW2&6r1WKPlht(>BgxrD@x)2G984+Op308n`dmKGgnaXLhE
zMjSul5ZJJpdvC4Wv^S+mbrWBLUaft+nx>ofgZ$U4n0t^pIcoLSdrF^`QmyU#xLU>n
zUFA2mKC4qm8d#)fe0{0Jtrxd;kSncJARadT#vwK;c11uvSDu1`>?BVRapuU6&|n*`
zS3JQ<cC^@n$fd8}@1Y?Wp3gQ)Ul&M>lPA_Gx5|H*fR4F;73)y2*5&V~#!sUTvDtVD
z^p?S=wsND)#EEf9(`Y@`muE!A2J7LuiuKdy=-ofMQG}OgXe(DTBK(c$!&S-JX(mu`
zmUbO*{P|I9hn`L3>EM6p9-*SdpY6=#aKZ0N206pEe+z!2$h;vEa5FH_sBH&#n2R9!
z8f<ugE@07A8xLUP0aBY}!`)HflY6UJwA^mJfA)I)g!zQfY|VyxLNaXFK$3AI?5QES
zyUE8ZEP7Vn53P)kV&pFcF#ir?VCnz>bMfj=!mH{3H>~_yG8#wP)M_#QKQ<5ns#<Dk
z|NF0j9`%aRXu0*a(cc_h8|J@%eCq@Wqn#QHly>3$!x(OjfXAo*|Bo(|^tUg^1OV0$
z-o(7*Z(zC|_U`dt*(vNs#E|gJ)s2kBNaBimpMW|AQp{ePyTa6Ax4zbT8_X8A)7ye^
zjOIOf$&uVrHA^<SEbjHiJp8ZzS_CA1kK60QNj&N0-c>K}=!I`Z%vP0<VBpkRVHoh7
zKC_f)<!Fk#lYH{mv9GHazIC!(u|ue-3#h8(zlQ^_>K)l`zQhsuk^}twKbnhEqXT&1
z${RMde-NKpcL2iiNg3bxC*FP#26#);*JuLy&%S>f>f0Vr%W=Vv7$g1L=>KX#=ns_Z
zNu~vKs{+x1f1L1}=JA6u71K-0d6PItp3~lb;*vVLbN=bY@i=pX?+L4&PDAl{|JD~F
zI*_T5{1(s?4N$r17CG;BMN{dXN%t)pwxhkh&ZNg}%T&&#t#G&Lrrkj4hM6+8G#alJ
z)ZT1=v!s9d#so~`BfmtBT>P)n#bYX8DH5*L6USw6q4DE?8|7-_z5f8Plh7dRI@2bL
z*Oe&9wpC!yq)|Zj>eb2e8Y1L;#9Fa8Y<a(3#d_L2;kkVi9g^dY)BEg>7(utg*Zol~
z7}i>K^4(opFMS6NGpG1mc(_soywyLxr2Rsxuv8mD`#TkdD+!Oy27lD^(Z3H(uO?qu
zbL89Y#p6ePtKa-2pfWSFjp&@#yhhvzO|B|k#>ASxUHcmM;@ONw);VTAJY+KYaBw`s
zyPNQW$(al(+7c3PbGR|S2UG|4Ry#9ll}FQ4NQMx%e=#}1T|x?`9RXlr#RXzG{UZM!
zeTCJeZbf5K%D&j|1&kkNF*J}f=U(fPw4?~u=MB!AF;gZK`u7?|-tk_<t_PiaxP2Uh
z^mJ@-QBLA36Qo#`o(x=;$_RSQ9`$+m0wSMRwm)bkC>P3N#fMt(;Ml4@ki5vB;dh)V
zD9Kn?@MU#dAw5oZ**a>vLWj}Nu>r}vR!jbIx^Fsj8X~9!Y_cDbb|e-pP9U`%>m5!?
zA&y~}hkWpbg`IoMWE{P7$%}}$s~}R=B3=^p&MG$Vj{6J=bRyEji1?R2QHWaKBS8d6
zy}@Zmd4BxP;CF==4nOT++6^Y)?%m;+v~mT7YZ?V`mti>4{0KRv&u%J`T(PEYzkq#&
zwEVL2A|pvKSK%w<F~!e{nei4<D%bY-r{O1#!@DHf1(z_yxKX`q)zEBmbvO&S){J>H
zR8zrl3+M;VI%JtGBpFHx)81S&sj_$#*P-zYoS}N6-wAt3{cFJCs9EtwoKC`A{*u(*
zsa)5-r^{;Lb~T4zXB>;~&)tA$?QCY&1+B<rKF1Mgwd+yJ62h*>3(*_HX}Pqp`bf1X
z*Jp#ql}#o1)-L^T;`%;KI5oL}veL!NuJOp1vA;?xNSe`*7Pqm7MpT1D`Tmc%V~+0q
z<L<qv+XK-8li&GV2CB_vBtyxEy_cu$qgaY|W5#bY|11x3wI8gM-K~{jB1qP(o=7t9
zJU>5bBH;9yKRPZs^U=I6?jwBaFMNq4&#E^I1NMhFroXnibOh_zLBCN0(@|kjP4V&`
zOz3Naqr^R58s`$0s_7o`866%9M}_k-@3WtL1Q+uuSoci(M`Jc_4V+BZyg2M@g1fT#
zYU~^F4Q<R@YC|89dpHRWn!3~OfYb`Z=xfaMPyp6#<GMC25q^*+R3N?^brL$xX$h|J
zNmk#SfNIz84ifOvy^c@QhUKD9?wR(MTaQSiFXAT)seinUrIs{gty!u0*{AvDsosv7
z>|qKsX06xG!1`#>=!x&e9fenmIo**ok_0RL8YfeWpcsuDxU_qvxfLu*Dtolxdnl=b
z3_F5_LeO&hw5}FwH<{nwVXTR^s5SJF8U0oTL<6B7S`Hic9ye%<wf3$#@Yz@%H8t}+
zI05QQS`m+aEPr9;W#rI7U!-#;W1c8}>9CMH8o=j!tTp#bqW;lQz;{)e8mXyQ>#nvD
zM6@C0ccx`;B;)*Es0<XR3)D+ayv<j7VlI#9`oi$V9O-Ddx$VuSp>fc#Ur0qeur}k5
zrM*7GDCvV*?91ppD$I@ek|kE|5u<!xb?!qA0dmIM$+u<9dMBgBN650<!#p)5Y1PXC
zuu8eM`dtany^Cs*CSDxb9^1C4mCHIw0v{nbhevc?IGd`6kc=EWb0z|&{%L=p&T?3p
zH2fSj(G*=a;XC?0I~P@rJffEILJFQ}$NO~A0o_3=_wTi64u0QZ70me@IgW&9g!n$j
zqs1o}7g+oe&i2vpdqGl;)0vfXS>NKPY29Hl#{|b+g*&S?85A<Koz}cF4y$hl5jQy1
zs4gtZepXOTGnW>_PFItAg{BPl{i}Sx&hWrwBemKtE5DrTK^a~oLU)8{K;_#3E1xs1
z3r@c1Nrsb4JY38??5#hUm0w+OKV7zc$ks8Kg$WaIx`^JR`>g+w{mtmp)OkxI@sHC_
z=T#B{MinB2%EW1In<<-=v7o{!ID+2pC-E7yVtj<xBC1ED29v(8m%hNePGr4%3{((4
zFtfS>alvmo7XxBqeWIS4yfX+CeDJ9url~EkuJl5+RwWK*bU$@G`k8u0Bi2M1!({sK
zX?oOYzWDMB>}7er>L(J<iZqonkd+Q@t^I1+^%XtuZx(p2orTQ+2sk$6LvD(I=6W|T
z-G@~l$q+o`1l;u-R{%-4n#^9&Se9>O{UVdbu}>|E3(ykvD(Q9!McB9D7=6+YS+q-!
zD}=(>!{eT5dMzI&Pm7%zx5ui<jJsHw&LE-YZ1BY&h5D9rn>v>j2CX0NHcxkb8BI(!
ztPBh#rQma}ZJI%rnH_4?MAAnlnOQ$#u11kQ7;Hc&I;wggZk1Zjog&un(aQ60Pdv_P
zG@au0EVVq+$)7xw1Pdw&1%})gwBPt%BoukJ(b==}t1VT?bGpZx?|u=u@J+=CP%eI0
z7t~F>Td19xIA$Ie|H3EbWe+)&EmxlDrneo+e}l&nlUGHdRrYuDgOl>jaz`0uZ)3`g
zj0%apIo|wHXPJcZqDp+3-9Boo%46ue7h<?9lL?!|YLL~p(>f02V>>nLWdDU}#C@*N
z_AGqnuxp|=O(V9Xqi$;Z;9W?7EE%$lhKZzg^9!<Ws$P<;Xtlu4HUe|iY3--uStaXU
zZKe?E*YWMCOT?XlIF)5bc_`S|p!fTLzW7IC<M|eEMk9KBr>{98am+%s$?1l2NTN2|
zWVZHuHbGg6h^EpnG7TwnQqhy=3-Zw~v=<o2-tJ`aaDm5*v}|iDN1@~Pi;9m~QE-tx
zn${9p-ckK2$L2>fOxo7>r+wUP#}XQRSo)>V&9W(hL}ZR>B(r^0do^B7k}-t0#!Ek0
z!*%*)>km!Oe!OL=vC(Q@SSOl9)LYcWhB`*yR{FJS#+33SA{Y6U@d7Xl+p@F2rV6C>
zIG1Nqm#oql_P+bZGCnd!4rd}Sc=D=U?P*iQJ!q97KlKFLMs;g^WsV-%G&rp6Fhx=c
z`ef-lXR%w<;SB4Xk3e-{zaBV0@=)E-eAw8ok`vGF(o{mzwjrs#v)GJHz!-dbim+Vb
zQt+=0nM(w6M8-+@)-bu3b+J;6b<Nnm-t(t-f?dN5Cz)bdDq1sdCXL#j+YiO7PUo{3
zA2z&Tdo2`<63iM?D^h8OEGcF73@%U)Mk+TrF12$wH@%J7sB}4iXyxsjc9$6rcP#Zj
z8!OGj|F|1^asJMZ_S=OztyK%OQ}tOcgeC_cv6S+Y$v#N-;ccVXjWPD1<Ox@8xH@Hp
zb3V0q>uqhHomyX|&%&l;Pr1l`D-9F=gjv00<F&C=wZ>E}FIalsL(?{(hYy}|chg_?
z>`;CEaH7DWL$pJZ^Ugr4ocdr*r9&)<B}?qnv(iDGGOwi)A=RV|m&B-iBl^`(b<-bp
zNL|h-IX3I&pXR3)T1CJ9yhqoO#ZaEFTe9D!UqzIo@k2BF>9|S0F;*gyznY3id10Z1
zh^cVuxwrcwnJ2f19KFvzce^32DsLc23G-!ErBuw5WF~_kZlzQKt*0Ifc~wLvlZ&3>
z6NP*Yx$=q1^+&cTRo+rKeBP)M>@+a`YX7|Clml1$u>~kQHclqR7By_dk~BsN(mI<b
zKcGz`BRd_f$_d`f!q^;~7GB=YwFTo2(6L{aT-&h<qm9=QTtPejXjoBg(nAd1ShPub
z5-IN=YNSk<aMalytzBBSIg`QIY!{twGyYT$zp=r<uE8+H4GwZT!6VtWqnB<tI5=RA
zsW7W?onTn8D(CgtkJsBjt@Vs0e%Os1(x+#lKWaL`Q?Gc)CQwJACiBwR-TKFmqWiu2
zs?Qx$`~}Xy2M35m=6C^Q;{`Sd%{n&h;!<)r@=!YQZGWP1quZ-rRcy;c3LUDw4t7yb
z6)ZM8Yvb#j^rkUR)b3^a9@T4SG?5CjnKUTn2B|qz8w^$?)sCvh#Dy+{*jM9j5m4RS
z-5?u;oxzBY%Y!~YH7Ba$6jNi+=SX92C91*`(mE)+U8Xm|6-G9UVxeuIk8Ip|n=?Y`
z?tdL-p<z5`N?Y0fx_cqiqvw0sekUf*+vFV#eN*)AGTlQ^!J9zkn1dgD1qo3^DRmKF
z7KW@*mR*uIU)64fHsMW=+Qt|smo020=ce}#*{38A=Yd*a*sh4feOPG7u=Yh(WYT1<
z`iW6d{LXN5e88TKVC}uWpI_r#dk0mqgvX&&<p;YW@R9CMyL4VI^`=P3CyiLJ#$`Xz
zA|2^|2jtUfP^f3*G<R;+(z$}PP|b-_M|sRsN_q>Z4#7q4>LopRl3058xiv8^*ULk>
zuk?%cV!;T|Q=$XZV*k6c$Klu34TC5RQ&RZl^~n(oVunxLdsRV>(L>N03g^)5arYM4
zSx;n+_YJiV@?>o3v1NKfvh<BfkjMm2!>PClpZd#Lb-#<C{g4{hEr_c9Izj3p9UoGp
zw;s;=OtEtI6r4mKK_RqOa2Ic>3$+#ZVi=XG0v#uAk&Y?mI+XrJrOhFv&Odsd|B`}4
zzvz5QgU06pkG8^|3Nd%H<wHb=Y3s9LZuNS&xjI~LGrq*oo9}p?5^%l~X7#cA79;E4
zmpR@j@GDi92qo)IZ|w64h-1;6%$5WyRUl@=O9x5vsr+gcjqqqYV{!tD1Lwim?gq-|
zWh!S1CbEf#6HlmOn(U@Odq3E!s75W6ge<l3`}cM9AIc}SLevb&p2{6=tY_yx{8eiS
z|9&BRV?1Q>x3Fz{1}nNsmsTykBOljghSO!XP)en9-)=>PHVO8tr6b;l4V-`^=*qA9
z6{;k`m-wrH=_WUPm_|tGp0HY}=-7h$0r}m63h@_u97SM31%*x67hE6(2RDauZ+ust
z8u>cGV~B#TN@~cnP7HqiQ2n(MqNLM#K>Q^`${|dsHmjxjvGvPQt0Y8h(&Ls7zuYp6
zPnG)Imv)4Drt6`PFk{ld-<c+Y@XpxFt!@pphLd$JK7a;Fr@730bGH_5wqs*lmY;lf
zvfOI!89gH>qkf%ra$^v_S$2)<qGP7qvZ_0G-8DzRyKE+nJL7c}9AsIh>Jp!~Hl*n0
zdfreIQ7DKOOAj7cNF7zK;JQ>iA6#C|)9$LUnTDLjqM9|Ksel_iCS&@QZ#`Aq3Z+En
zP;iJuRXKi<COA6Dh*Qt@A!3an;d9v;pxtO-$t+XXXpf>F{Bq<oQ+x_k;?e|p7XWDh
zX@j2u4I$DEsD5lJ=S#OO+0=V&DS|{(m<BNn*3QPez9^0kdf%rqb0}(xGvW=YG41T_
z>L_SZxmU&fa_Z8LP1J0f)}W6}%9ARSxjvo3+N!qh_`D~h9{U+LGZ87bo86fPH>=>i
zQHg3DT6hSRi==VB7-S5Sgv@<78^~bN;CYYlO<tAd>+-#8&Oc^J`#$0Ik!@X%>wuh3
zT6UPV+$H_H!P%B-?Qv4mCdsrK_s?e<cL`cty4Rbz<g-KOeIM%&Q<mwr_m32vtv$>)
zr021i=-)|N-sBq=JI{&R%%+s}Ca{d5EX^HN&)NQ*WV)e48*vvoNN&4Y71(eIfBHad
zfKJ*`9Ta49rb0nr%uXr?<QIpq3sdY08w^6su=CNt&pG=)k<%Hc7M+cHpk=<CbS`Q1
zW*fP#WCxrBG^bCM*Fjt5{XQB+P?nqek|-nn*st7S(E<czz_ji1`zF2Kl-lL$OhWJ)
zn|IEWEc~5r;(X;x@7XkvQapI|Zs3R@EKqybqE-Ws1jvVuJJ-plGK!sst>!8uLbO}e
zjkrj@Y+jfl%?GkMF1jwdB|kQEtX&q!!g=@Q*YzJM4S$te&dF-^uRH5bg=m%7bZc8S
z9Fi6pw?m^kLYJA#?z8BW4NVL8>xHWr=))D;f8cp7jY9NCQ>3k^tOFq=!^(k>gQ7D7
z%(9rV{&!=0Faw}?UYej+<0ooUDP1}{iOZ%Zg>z8wHCL26T-ekC`DygGjY{|qgW!VF
z8-Bzkpo#1|P$}rKMx7wBvZEH2Q6NM*(LD&R_vvAFN$`D&niF<3*!E%vd;$>loFBXW
zNv5i|#&0hTOs&%#^{OjH0Q=Fp!K*U10=2kZF%Y9twa{3TOJ3<>h#WQ&x~Ti+ZC9?I
zNW|w&(92ye%}3#Cw$qP7I-MjiPq0u`J0OE7Z?1Tvf||u}?!EF=Q%h+>!Nql8+%<9p
z-JD{|oe6E~mUAb3^?XI-oMLy@J`Kf)PLJKo8Wy`7O52?-1aDO+0Cgp?Zo1+N=YELM
z6glTucD0D4q|8jS`Q@Ozb(D>F%fl(_Ccj04LQVKgZ3^TAWALUA)4#;PjfHTb2F#C4
zyh2@tzu!GJnXwgIJYBVH2Lhd_7HRgfHxpI#m;4U%vhP;x4<_T86)e_P?O)V*Ulhy>
zq*AHr=^?xpNxiH2HVUN=M%9oR*6@++j=1S6=eBV*U(NoX%#XMTw%8O!lm$YzzxNxd
z_$I3&UU66#@(Fkntj^T>d>NHd^T>2L_-X%ZW2Oc<7l1tze%83C+j<-2GkQn?8NJJ8
zqf1MSoI>PEOsHGrZ_JmHbkfQ$RFjvJ40P*Ir<UfPxvXb19-j!Lu-k}2hVs9%0XeLu
zF>AhZ<dHFw6Iu2QoZbaE6KZ?of=@l;H9N5~J~>U@L`mO5rMX+)k>XRMcI&Z)lRRTl
zsfUu)P`wh?NvK24z$+v&mlB~V0+ruPQ(kr){1k&h)Eat#1mVf?1^y${<R=~-6aATj
zf>_uCenZWa^UL0I`@MTBvQt)_px?5o$E+BipVVbU&uO)xDlccteUlfX0|h&_^gCrD
z&(^;de70aAm|&~3fHcA2L)^}t4bZ*$HlOCBZe?MWm?zS-ol`89*6^d3?R&cQo^?GP
ztj<0^xqL%`REc>N?^ngOQ1lu)CJ;<je-Yo()y5}UQy@<`N$Je=X!=F{>!=OhI`;6Q
z=>{IVqqh=uF((sGjk0$ccln%N<_WJ0^3kd4OluL`K7Zo+rRcCn@rJ;h-E{jwfUCmr
z7s?o@^6#|(C608mMVyTfqQ*WOb~lh~zx7b8BFYvm;;vCMUMCMq=feQX$$|5a65;hr
z2cK<BEMT~6bS(772RV3XAkGXSKI?}U##=eVb)l;VRLd?a8YHUwPCLC0>}9F~4=Js$
zaR+|j)cEE{qN^8wVN6c&<fun;9}CYTUzOu#%OhI|r&BM*e3{(PYbB2b>q4s)Y#)Lc
z?m>gW55l~-Rm0M?!;To1qeb(5#(U~WAf5V(;FnJ68>RG&z}&8j%}wnCxkpGR^ZAxY
zA(LZQ+%U*<`%Du#Ro*cuWZz>^N>HU?O-Qwcop@MHbPJne0-OCOMj&3^X`3JA1#l3!
zV1M~ipTJ@Wy7O5KwJ}{Hv-8WZyfn7p<`33EdIo91yd$(0Yn^h-%u|wNzRE(q-Nv>}
z<V?-cy2AWYZ%RQMv;0?qY^mf|fM>`!2Ri-Cr%&k_5Va_cV&BDHbY=RH#B3UIi!HY{
zb{N$eb*;))-TSuF8{`uDYb+yI`i=5#9>rax#C{xd#LDeTevzkv3UpjjNaCgyX~G2Z
z%AB`m(Zk2IDYFu8jz9W6QS?m=eK`7o)&fmjc#<guq93g0ar<Br_ab@XOyF=m8414N
zg(^SwP+qmc$KzW*A3X_EIPp;rAe(MESnsR%sV+Trp3X;z2d0p!ky%}6F*_^OMUXN_
zG|lwrRFMyKIe357(U##|w93<8@4YL*`}5I6#l>?S@I@j5;#&t>g6I0>xs-Q;e{$V=
z-MR)!lS)Vdq9Cxkd%QR64ZO0EqRxxbYs88=3-d|1?_&I^#UZ!#>x0)<Mc2ZW_m20@
z3(1&LUTHV)&K`{>5XJ_RZj><V*Fw$fDwdz=D`ve%xuz4I^SCT%mVCtu4m)2<zTYic
ztiuI{Y1jYS)V^cFoUpEIGTyBY{p}>Jf1J*nA1V1DB7vNr^sGnhG~*li`a<BBT3a80
zMCw&0QxgL?D#cZ_+@(MJO}XZkGyJWF56UwwAH93x`bLFWEWEefDQaqhCi2Pli@S@2
z<RQ{LOhsB0iERWyZ+e~ng5LZVApCjy1%M9HX=jr;yO-;#<&vH+4wh4h*-<s0;#0m@
zc%=62hyKdg-ea+1-|9cl{r(2#0k;I?q5pAJfhaglEH}cI%hsX$$O308-?(N3k_5#D
z1-(iAb9_v(Z|M&9&pqB;ffN9E)Kmmu7Tca14|uK;0m`@BXm<u|apa|Xg>E-a^KU?O
zvvEyr^>>S3bYD0B%ZJ-47DMCC0F@!#-;ehE%Z}Dw-9*6Jnq2p{<8i;yfVB=7JnoW^
zP2`^drWWAfi_eR#4H96ciGHqMvka_X<ImqZqq#lrcl+-bgQPS79WLAUPy$fTGhC<c
zDeh;IZXBH9&!08Dp!@q6)NlOr(2ESO4(S0nQ>_vGMg2;ffmc&-Q7ZmC&0DwM+=0J<
zs(xVLTpIGK1Z6fRs@);;FaP>&O+Z(_FrsI1?3H={a%vo)^j}D~O-hZ{efIC){RN+;
zRs}GxU|go;f1=yfX&{0BHuUv(gdhNP6AO%yzYf&?GVC8i;0W(g{_*mk4RA;RuBA6g
z=l*^5zbz3c&?EQ{sPNC%_aOia6b-Uf{<`3Q8w@~hu>W(=KN^TiP+R2fUk@%^Np!W<
z?Kt#q{&7>l)i|trX>Us>S$zn@t|*AJ2duXF{IQ`QAiuhp^3(Ot?M4^ARIu>J)nU2Q
z1CWJF_f)0su9wJk)b9%Ln)1}dn7}5dz^xm&y2fFf2v_mlJS~5oEO65O-DASo%-+O^
zC-Y<m&zD;0{!WQ+cvrY3#?BZA0Q)`mf1Y$^^)T?_Zcuu2yW-#0Ms0O<68uq{ztW#%
z`u8W+<g1Oa_37o~f1uj`eiv?Z#Ri+F8~JP~ggv}-NfO1A_@sRFeQH~cZl|aWwSJB+
zlFJ$k2O!PA30gWckku{=T%`g?@3w;xjDHR*-l)}b)H_#93H#RD%W4}$p6WZ)PS*R&
z9j}uVv?=v^KONN@AW1-l#T!>Y<q`8k<?Z-;Mi!k2)J~kL{g)IW*Xc#=`+pO4;SX0t
zyZegw>av)ovTx8;w)uLp3I_zl;BB;Tp<clc+o_ueU2Z_EKD?A1d+Q#()vn&4u%sqL
zcQwE?l9*ZRSzqk%`cT(b+C6$}q47GSILG<1LDLupm6uw(Z+i-^PFMYFaqsc`BRRu2
zY8*u?A3!=q3I!`@P_=1OQ5<i3hmN?sHcPqwHNE#*z|Jr@?0fzk;1czB%%!gQ1CMSl
z!`6_8h60xr5nd);(#fqgiX~5Sk_2iF`Q5f>;Wl9DSms5kHsC<vZkAU4yOSD%m5bw@
zd23&5XEWcm@9lsKJZin2Lx0it`_(*pbpEa=a(=tfw`XDFw&&%e5%#Qu<jv!{+J%pH
z*XL+WRGrmb8g^z~KD}CLrvsdO)|!P(!0DMf^4c8<l$H_dUK%W0X)51SDAbrQ)bSlk
zJ?&;Ysv~2nzT7{07wqFdW4`Re3cV^FAhaU{G?5O*6*Jqh%B@b<kNfA<tL@XFC))KF
zg&fOFajXTrZ7a47Y%=ncLj4&^d*stvdNQ$v4m-OL6$8XqzQJ58|0r{!ELCtQ<2=1q
z=b0-~rNHn&hLn{9NLI?76Vn9W8HF5JjtoE3XI2>~TZ8x@cr7(xCF3&<uD<<Wv7DzN
zmMx#DCL4+n{YK(k);WLRs0*QyHE(63TF<L2PH<srs1fZ=C6e&r{|^||1IAd;tlxTW
zh0vO1Q;>17nMkKS+L|6*2OOiLjR66TacIJqTwBGu6zN3GaB$C%ck1}aqWVa^htpat
zn_TQ|y=f$;na9=!kEK3vPK#{ZwwNx7(?EJ>9M7OZDMuPvC_opPq{*+5zW-50<C(I{
z$uHwWt#t*8dZ&-dYK%%Eo<Q2{X6+w$Q;15XiFRO|5H;lVM9%R0&W`U;Z?-hc0oDeV
zRPI#vLutx&i-LZ27o?xx-S^Jg(v6fWyz^;qP1$bW$LyNAgz~OlU)J+C^ISfWR5i$8
z#I?+d5aBGKdPLSjTY*<$al*WqoQ2~kFqObzjRW$u8qZU3=Ct{QPlJ7jOPO>%YJIb7
zr!Hpj#nJcFsfx(Dy*{BWt>^Z!jaW0iDb&fxx<^I?%>16qyRH&K<zn4}^*Jrojp>rh
zY~HaNL`BMr9d4zeO9wMmj>|5&Ti_wh9l8GrSY<|`75em~3QUx1F=0jXIbCYfzU)cn
znaHwfZfXhHf5h2$6jCJGdSvx@b}=*#xYehw2eoeN_7cQp?L*GvAskuXfn?FhuYH-U
z*3m3yWEmq1s?(zdjt!=;t0(nP`KVXAeMYukq<zeDa{f{sK7yPkr<Eo?V!M;)c%<WO
zfigb<k@zI?Z|!EwObMN30A3*}fGc_DS4@LF*P?`z2xc@ckF)gY7>Mg_mUDoVMIuFa
zJo^+=zQ)mI9g!!k`q$ICn{ue1)ht)ZM3=Kz>r*z%2rB{X!~PcteSaLYPru!lLv4s#
zTLlT0KU7bdD(^gc9Tk78ddWklUrLFg(WP&T5lHAt5!2{Rv1d=17R>*zK(WdX$Nq}M
z4x_$IHC$w#9Z?D#Uv!PEC}nW=D6U>S<LHj?;Vah`8IU<DRFeU-@1kt+R0eEN;Cpc?
zm+SR20nc{o&K4{UPG2N_t@qCVHK0IjBzLc^;W+-4phZJ(2<S5K+1KUlK$hUA54(+f
z+J!i>kRdM5VxCp3dUa+8$c^IvRQ293=r^44ajW>zRKEK^!LF-Ci!Jwk2n8I<tT}uK
z*7H7RcJbDm3|)?KQB5)?^DCgvnT=k#Cq}0sf(ug}rl0OIeZIMoxZvnz9mdd~^wtaH
zxP98b6C7*y9$l^@Y-F*aB(wEXn2#fUmnOA+Y=!!fwu8qPH!!Ekbw!Tw^Q-&4ZiLGL
zDmnwts>-W)U_fC%`K@L;!OaER>}`94A}b*h<dE@td`m7TZD@>{T_YzAuB#csCojtf
z)bHNaSTz_?`1)=qlX~<DUm<yly;Dpq62_L^xR&DS6?t0si_{~nBVibhZCR()CjNX1
z`PzQY+w&0r*u-vc1eu?GGHNx@AUU%e!{jA2jY?9Rcb&;stn3=S5u}A~W~@odtaUy?
z^(wJd=KiyK$1{24<BQU_oe)|eB>_jej+7;gIlLV$LTn#0qb8mkeg9x!yVP#kEx+3P
zpTKJjmet>ISI<&XR7p$N&R(>A>vmWEV2B9Sq%XB+4>@1?rXAa$AFpeJT9f##SK$=a
z<-?RSmOnQlNeVhN3iFB&STlW3{~vpA9TnyJ{eLTpC<qud5(d&B(v2b@okNF!)DR=x
zAR;2IbPe4@I&>-sNarwgch}G}JU8n3oO8bCbDp)H_5J5rzxDgaHL}*sb=}u}#oq7N
zzV=R2JR}scDJpAZ-`2LtEIcG%J(o}rl`&1OFfwfEjN5nniu9FTVh6%&aPPjwY_5Hl
zd6HZ;Oz-vXs&)duWwg^)Ifu>;`|o3w?|SgK=;_iOs2yEr3hnNaj<@dV$xCeM8mr@(
zjhn=lZZUjbYl+fNum9NiUa*H7hS5#4kLQy<)D;FB)q{mLmfN3UkL`C%*^MnUOzH6Q
z>5b0^I_g)h!LVqB_juTsqfGMcAiN%RDYLW@ErJ_AWc+MT=iMO{Tc2AjPnf0?9zGL*
z3LK1!Y<383E%#t&^LSKvTl?-W3?3)mwL}^WbC&FrDnF1Iaj`XM9}c)ek<?_j<XS}@
z{(Kv^LxBzL_JLm6ZZASmxyAf*y7{N(h{bUSiw4uWomqW2xHU@LulB6xT2~Liox@oB
zsxYfbl#@sLePH<ZL6dt&_Zi(A?35@smdwStB;oS!3y;^>)@`D5SJ!tv9rY(%JIEdy
zZ%D8w(wi8pVanL95J`ul58*mD#A^JFSb_1o_2{z9o2vmoxA(7{K0(e!Os*q|-rn(W
zpR~@q=UQ1-k#!nj^@mF-tCP)9E_YU<UgjFPAKx>u-@vd=Kq}GgsjWpqUPnity%3-K
zb5IY|AUis6yRtyzLF;AZ5@VCA^onst{lhm}L+`<9ESh5oX@oNFt*#*p<EDhLcbPs|
z%9zDQTMLwy@wDx0XZ`s6kdWpK6|%;AZ;~U>wn(#joFa_EO21*JRoPg@HM=`<<h-Sm
z7JUzM`pHzIP5~blFBKx77~v}?DueEhqel+jhyXdvjv`>Dsr|{^1A!oB_j>kB4V~L(
z`{bPFO+ia&OV7%<+=T842&mRU+H&kE@mYh4&6&L~1~glRwb?8~%<E4p8N58X(!V}l
zKLAc-6BoGaITXGhcZTD-(m3$$5#>-JyIy^MfQY4QSv+L<QWg1q*e_H3;}5JTRT7oQ
z`Q5WbHuY}ji*bT6nYK%Pb%3$+C@4zF0_QQk0BxEe;ntdmVjM1`v3oA_!o!4Ui@C?J
z6+K=4jzDfw*>KO16;^GLy<wU>d1XQQw!xAJhadV|-wW_+Jj3D-06$|;QG-V&<A>{A
z6BVK{wL(p|#UkAs1I$E)DtD~mgI}<^oT(?m?lIc!Y6cJ^ZDQ+d?Lz*Tbd)ON88T>f
za}k9>GewdBYJPCxd-A9!g-J;0lq$VEqe1FK{iFBL`t#u{y=?yb%RA{dRlv^34N7_u
z*G|_{alXnC)3uHl^&VpzdU8hzA0NG@JJ95+;&WgDNwGf~s9?jkxciG_SCUSjX1mk;
zRCq7rJ_?J<Q9i+y;ZY6}y1`i}RM7=?o7qI5k)dl`+GdmOD`YCg1r#{L%I1Yi)g`mx
zztC;_-Y;~U^Yk^b1CI`ssGA(So9CpkY+&%B^J-B9@y)t7n0E;47CB5n#Uj0GH1b36
z8F=SR0-JM*d>B3jGBB`20E#^IxOWOxuW8%xmbV((yeLDOq(F-#*z8e~;G6*s|H8SY
z(z0XtymWzQ94S1eyF-W8yDqQn#CZ!w=k_?YCwK%hm}?l7=w!aNtBC!jU_m+kWJ+lM
zaDIi$#&q=y4ZIhv-d|iELPcNhB~QLQ*LsHcSe;pKL;zQc0G(cH4lB_JH=~Sywn}DE
zK)szaZ(b9gV}PnW`<M_={PW5@5O1m?#v#wiu8Q~Egl^yLP)HuckluA-sKZX<AZjU*
znD9C${~fUmXz1Zqev6EZ%YlGGxM~Hu=q^o_tvVeGF1w3C11Q?DKOF9y^g%@R+?z~0
z=kvJRv}iE!MwrwsQ4u0Gc6-_Yku+-2AT%cEt~uTgMbP$=cJJA7X4KwDhHj0xv&~1D
zAfvoXUsSbW*L`8isGpggOy})p%;i6i=<fk^-7nU30j&WPYeRRf4@FmIvw9aU4@joI
zd1yTK-Bo2%&_NUSkUB~h_3T0VMX<-MSRi5>>#os7l=Ac=C0g4>d;BGaTrFq8RT9~P
z!@#(&hm-Q|;{OhAqgB0A%ceJ>HF*=`CrxHmZQbtuzFX^fctmWKUdY7&<JPbf@b`E8
zdkv>1a;WnqBJZIB`w|tp^^lF*ivBKz?G9=lb-T_6AxDPu=E7=9%CA)M8UbQUtO^j@
zm2A_xQ4Ztg6Q^yY+xlee4UFR@J<PD|OF`aZ`aQ`DUh9*0pIxuAQZ}qGDi73`*R{qA
z6>-h8x#G+?L-2UCJ#zQWWLfl8E>-^)0?+D^_L<KCgft?hyETZVO7goKnJ^IL_tDSP
zuw}dVrm5oX_NC^Dmn!>=envlk?O?gZDN_pgQX8DLTZd01=gl1bK}wCT7`IWWzDN8m
zH2VEU6Q6kEEX%vJJ5obrcyyYBfEevF)9R;FG_k7o&7|pone>?}n<9a7x>G&u>`d+w
zs14U7VhLgYB7gEuvkRiu=~zg(tRk6=VQqv<{hpIiu8n2)#=R2nq5X8`?3fJ;g%?oz
zG`c)VYgXr^n4hHf<hA&-rMT8}KKIivHn-H?Io&R@qGVei82&={l9Ct95@TFU!sIjR
zd1a~WGJaE6MxvlCd_I{ndqdfam-Scn$m!He<h|6-`)*!%dXI}yyHjo1i0-E~wlS>6
zHo|QjRSt*XMl#zC$!cCD;{DPW{6uaH@)%cE$FW7iW>L?i(7a}kwZ(#J$gyZ}^GN`;
zaD1J^hql5pUL`lH-;fr3@1KzNU^%-EXHNj|x0w{rPCp=kEQHh?>pHB1^=i0H)Mp^I
z6Lgr!QO;hgz1c~kOZW_o=I#b4trU^n=HOHkM1&#iFH!uK6j=bmJ!NXEw&-vc^ukz#
zj$@|Krt+t(u7UIMeu#vi2`EZ2|KP0EH7jX<r8a6L-BW<+iQW06C%z`EQ~8N+Md&*=
zva15!K;l$7xyT=r1@A`P_+F<__W#s@ey(x}CbjsH`1p5yIEBz+Qf>nCp#bCWr(CT%
zZuL_|=Pb$z!^%c^UL^?4fTja{&|k2vsMB7eQOzQ1hB8~Fd8ffq`u{7p<?m$95m(Xp
z1J-)p`2}lTXMe%kRPZR6CIidi+whB;H?fhP^_vE3mxGz;Rp>zX54-+|vITUB-?3cN
z+G1g1xu0gW;_xyPUk4?t;}s0K-E?b!-o<qncHd1}3w`d8+p`~6wY#YP4adERQ6=;2
z^y@QF+7mp~$LE#>WlFO8A&1~pBZ)$TnnENKL!yZB$x1{P6B(HMU=MG5B;dfS^pI<%
zKi+E*vzRW^{x@X%O?{w>k;L}Zme=0Wf@}=3K+AFiiJ2{9iM#7gr!NFaEqgPPmU(ck
zUZc=FF}E&xGB?kN=nrg5kjSN_;%5%(AGOLk0RC7t4&7^fYr0zB^S1mcx=6oXCI-KA
z?HInaDglJb??Xlc7czKfmUa#dEBSE`OjixN0ukyJ%+VN|JbS*LkH3TEfh@N80~$)-
zs}4hV1VF0CL5k-m`l^MS8|N03y<uBuO3ttX5zo{9Ul3K@)~rk|7e6XC*5h?mbeM4I
z@^Dx7Wph7vjid>ul}&Dm=&(s4V+t5Lvj&NB5hq@V^>RQQbog7ko*EE%Gwbn3$x_$4
z2Yx6$TrEk)=ueCA=`hO&K<oX@?&)MgLj_BZmd~B5&pM;6V+i%CoW%*R44P9>KaYKK
z0?X4E#w62?f`RZ`H}mqi+zwZ4$Cs-z_qPC`x0?E~Ief7<S!*sEM7-D)b0CP5qWWDX
zf0f*_dn@v_*eF4VZ*@S2bk$T0+oR>a&lKA^Xps#buRXWC2b&!pHCrLSWP@(3XZ2&v
zRd~@qMLiGr7H_g0nm|vqY<@rMb;%uk)?ug30MW2<z6e@3U146+jtFfZH{DJfgY#9F
zo+YWM7}Rhz`-y||uwK+^5o}Uo%(Or@ioMQ$Ewl`VDNZZV;jy6}H+$vB6t&OLcvmV+
z9_^@tpg@#XZSJoNXLti4?E37Wm5@<{accnFd#m1`klKTH6DP)=ob&8dZ_GJIUkXTG
zdOlj|3aBisqva~HCN#`}c~-hHI$DM!KtMI4U?rqNKmJ|v)SUF(;|v*SJHM(9l!11v
z-1yYX;J{{2p`)L;{oXL#fV*e|IwoGH&34N#V~yuXL#8szAQhacrRpsk&LzFdH5s(X
zI;e`#4efO`6ytQ9G6TRa26QjoCMq7nZISb6LD>Mm2g)AiN|f4?MKA1i-j##5)V=o1
zuia?qBG|mN9|6T#ES~ob8)Mh0obN(f@>-o7fTm!g!DIz^H+^g*e&=r1m$@u_^Ud>I
z_WDUdamW5M>QiFra8Ga?^+EP3e~-2zR-&^VdU`??b#*22#sDExueNoh^aQ`gLxe7M
zxtSY6%}>WH*LF49TWhH`4E<p%A@gk(lSHIUbdBE7XjapI#lN_`mQSuY$*Zer=hnAV
zh3=PDmh3T{#W0k(Df#dK5zp$E^d2HtGA*+G=?KP!wUi+y7@juGT#vvrf-%cZPbayY
z@>)1G*^$KNV}lK7>NU0{;=%iIRE$Gs9jOwMl7!l7O#8sqT~K+qAzAf9C4{URm7x0I
zvZX%Fid*=(KE<HCu0s2&3h5=a7ZTo1qfbvd#^t;G{6)JrdW)EH7;a<W_wZRkiXWtY
z1@I~YF1vf$i;MpNAV!|_ux#>4scd)46cJ{76rGTVKVjd>XMLAjC6d}Tftga<+1aMH
zvZ5*LwvPjm9c-y5DVqg3idy4y7^y|nm?<Xr`5r~HXsYFy&oJ71yVt0D4zvjBjk@g2
zg^^>RMO&bSZ65H@i_D0wJeeYmq<Kyh3?mMb6Ia&Dr1tJD@f7oARjPcO=Y4azZ)>uy
zM#g*d9F-#3MX?s(TI0N~Qp=Z8kiU?3dADQ#MqoJMs<0R;^aAl#-~EYr(|Yp)AD^EL
z@X_I|*#_M;Q?yXYRu-#KlBo>zV#rwQeFgAaJwc}=KBvZXDZ;57z4WQx%bB}Xvc6w<
zocUGZL-NTs<^ARIIy@SE;Sd~8AmdSi9dQTYJ(0oc=i4R?Nohx@r5*2lO;$RIRXkF5
zir&{79e5;+8LhGe%Ogc&^vP?toHr({QCl#fkxx9oB<|Wstad`BVdTP~Y4n;gt2ejy
zI@<AZtf*c&Bq=w~i|Pa*$xG_XTjN#lChGR;U;q;ie4)rR(Pe13lz1+Xyu&!v16FFP
zsq~^6MJj5jH*^b@Md!RlrMla({Sgb0CgWQm3d=kY_4^3W;11WSd*OO5u2N7tp24Cr
zj~AZ_4tNf%MLX3s8cYjT4Ir@Nbw=7e=*Boa`Y$9H^}fv{%75hWX|b3kx_X@bS1kQ=
z8QT6MjnLd8Ami`{wXpq*tmW?oeMEb<@=9hcGPqd?Cr@yRqH)NB{|<tsX4HC|ZP$O4
z81dr~kRKxiS>s*n5kcVGK*Y+O%#%_bGvTcri4Y(3Z~P!;e*NYMCrBc#mFV;lmq2z8
zDczf+lNEsUHRRO64S@Lxr0=tus-Flp>^{RL@Xggruh#m)+;A@3JNVXX1}Et9#m0JD
zkJj=aKW~@Ael-{n(EU>YZjJ<1X#a0vaKaExdDs7j2Hz_9-_YPBaSaZm7QhJYw;#S;
z^B-dO8+T1t-2ebul`{MxFiO7+E5O$L%O_f+8$e=l&DMmGf3Tk4Af`ti$RTf^ZYuR_
z&i)-dUFh83?*NIPOG0_!5|@15Uag&bgl`Ta)1p3*B9lxZyY^dl`txh=sQ|mka7pvY
z9l+@QjHPGKOVDv!KScha$7iv1%D?ySqQ}>(#RgL#jU+%*Uu7AlsRUOJB}574?g|2z
zEy-x^H;MoAvHr|fQWPl{O^N-tC;n|--XaA;Wj{vr|8ZgPEUd2PQrIl`^ohc|7oXq1
zzx0jns<X4Rb)S)S9|>+Ify9`~Ww4SDt`cr$Wlc@ZH9Un+SFclC_c%9ksW`Rfk^S`k
zk^9mpo>NaEzkN5vlsCbwTj(!o{C^MTW8m5E;rz=;UcxGQ0B}5YO$(xb4#Tf^25|1y
zKLFXEL;CxZSUv#fLW$KWenO<byyX9k5P+39{ss>J+LK$%0JAmri<10*A=LIa|Iz9n
z-T8ijm^BSEmH*3V|9l*u*SCItIUlbY>mo<QpB>p&!y?A&7Xf)PU4-?AG6Hez9EXDG
z0Iad}88EEy@5U3LavO7dcIE;d87qMJzRmLy*-01NzaV6PJf;*WABEjO-wiU+3wN6H
zvdWw9odMd{X+I5P&)V;69Rvo$`~y7cpNRbVmEWIUS^>{}cZ}LZ2msDjSUXOea96&a
z2LGPNJ;3+>?B&l-pFRRNH|b}g9e=51@Si?h{Gd+^(ESsWRk-y(8v4~$+S@>WLWS>w
zF{%G{L!4a|SaBVLW@G<o{a0ti9+1#pf_`*n6aO!B|7U0Pvo6SWZcq8Yyh@)JEWkv&
zy`}r%1MvEUNcilIls<6T*qbUy{h2}kKeOheEHG<rbGyoaKHkG8o~y4Fdm_tLhurxS
z%wWGe`N;*_M&iY_1HJmKb<}sk7h?}~9FOeEAVZ|&mAf%f^j64}!RW6@yif<qhOwb=
z`k1I=kFHry()1yBv;N7R#e1RJ3cqrgT||~qDLP%9xEL=Z<yS+cjE<CCc8-og&DOnK
zzbDS4tCySQfYcA^!zm!^R;!AeOCkEiX9rX6cN%GvO2VdCg!*^Fs1$Xz?xS|ak(<JM
z??0Vv`$<_Y9_kHd>js5m6s<U`adkrdK^X8v-4C2T(93%Z9FOGh`I->@d?MwG`^ns?
z7sK&V4Qs62N`%}aO=~Z@B}ay&b0F8#a__o$k*=~+sDY#xBr;LNaktB<V0WoAQc$&8
zJE|k})U&i|ah-f1FOo5dPH%OW4p%<@Nw+ShIYp5Ynd^1jpNWj;ZJSL1&pS7jnKxB)
zhk!M@7Peqn@w|C8PN?=5Chf0&O{|wcu(k$&l+4%JiB>S{eia2Jx1AC>^GK@l*@Gq2
z?(Y6b>UCy6B(fNf5KUDHe^l58O(5x*-dX@REFN1rx6kh@B#+V+nBkssZ?JT&Zyd-3
z1h+*z-WBaMehJ12l=%6yH?(QB-fap)FEViGSBupLGoJExs<Ks7$Ua>%CWR2hdz!Cc
zWJ7{X$)<8+s~{oX<3gv<{%E~AGB4igITPD~<G29~Y6n%InW-(ugDi2}10u6Lx23&7
zlhr1wFMnVg7f9?aIeEi9BQ)ZjH!%n83$jydBf|0&MQ-?%l(OP%iAWWC`fTUP(_*8A
zJksuD%duLE+@~g@=cX?-&6nFvWH%?P?nV@-;{0CovtnPz9!f-)+PFowtt`ZhnjEF2
zhXiKzd>VB`&2-SSO@LLnd{3U(4#bHflWOfAK8UE$DWc#9FDhnt-f-R&uC!;jJN_n{
zs~h1Ai{C)pAun*NIo&VYioPfKhDQjn4w+m%K5*d&SDqJ-lUhoav8r*<7ARL8d<?Pf
zFa_%g3@q&tSYjN%qj6mO-MxmmAl(ksi$mQXCUQlr>eA*{GjPo|`9$qTc8F=BD@Hho
z3q|joES#lq8am^e%JApdrt}Rmi(0#8OLmV4_N>*6^lZpcDeaG37h`r3dbOCk@l8W7
zf}S;+8|7Spr}^P6cjpu`F<<owG=*!m=1@Le-)UMU@O8I!$Lpc5VeiLX&Zp44Taxv{
zhG7w^;ppUqdXo@6K=j4Wrc?haYSM7cb@w#8w6Tx0`7)e<ijUMw@PSHD>1?PEh`^vS
zmDo`xWzsnzKBn`?&5xx;J3cUJ=%L>wMZZaEzP;Yi2#vCbCxh);!pSQ)zvYR?c<VaV
z8h+lN8-l7>QjC%o%_B5fDqQ%5W;?K->4X~8xgORluzC!!Jc)?8p~^DaJR0DxU~nkE
zvMcR7KB}s&hj0;1rYwB}c`1W@9Y0lYUr>;roU*`R7&2Zxz`HqF6xUOsnwc-Ycu&Md
z1aRvsdJ+~`6ZxY?1Ke)@7z!T*>$G(E6Gkla=~kbo)ju+mUc=bdjW5`_S}M=``WtkM
zrX_uZSuR-NzE03c{(@Sku~g8<4O5Cqgi@1Q<~i<sgOQ*ZVN{P+H?A-TH80NGMqNi*
z?H7^U>$BNCklT^jxhb5tR6GL0{keH20Xfh2Ia5k-fsJQdQ_P#4)vG8G^WxZH@mp`g
zZHcGZBDTlTC007y2!V$@WIbD=F3SV<K1t^XZpu+%`mVEvy0;}ICA;JJ3vA(w(h-=3
z25Bps^AnUM&cPOyz<Nz6v^wwIPLc9n&^I&;k&oWnnnUfD5kS<~4OYjB{Nu0m#vAHo
z>H2MXQyZ)4m%b`Y11?gWJyv`r66LTpGPbzL@H?Q*Cx&fXJ5ElNMY#T?H%dM8yyKzm
zYWqg&-aCv-UCwO7X}7M1Snu-EJgZr~O_D)L_r^Em<dMA@56$77k$z2rXFKht&71@l
z@d9TD=tA#}_-d4H!qYgWg&i%o>G0ccMO+u6skwJgnX+nUUM|1yZjRs=v=$(V=IFYc
zMM<esGEx$R++xxd%&|?nGcvHOqjlKe)Z<+dd|L?v_WG0-5m8OjGh-QOW65_&6C1AQ
zQF9bK8@}frbEC#laYyy^?x*t+57RdhVtzlOBGbE;Hz+>7>xkD;a_G(5(k9NiV;(rk
zWOvdLc-NrfM=~?CwbXj4I(VvV9c^dBh?%M=BFtLXShxWV3ej~k>Mq=~pJX)FN>#r+
zwSdD$4oF3o#GF)!@|4CeTXN&74-#S;TUAz3J(E>+?XM3xHV7OApZKl><;-?;c~747
zEW#J3%M7F1S>tBAC-NA~6H3oJeQ~$Erm9m)UiNu-GO|W8B4{iXy@XI-s}-3Z%bqk`
z-%O`yBBjEs_pp>X3{U0VLM2v8nK9}!+6auKgpjm_yB*^!l-^AU8Lh^cFGHw;awvVx
zXsCrwdxNPn)mj%hURfc#8v@yvUM`8`i(wpcbup7~B-PhW)zv(k_f0aB%wEpr)n&bb
z_kFYrB}{Z&9{AwOgq;DcIBm>Xpx2Ia^SFd3-)BZOT!j|mc1rMXJ%%}_Q_s*SOcXVN
z_FgLJ*E_BytvtH?D@8K94DDxwmA$lB^Na1Ym~q<{{r1@X`M#fyJzb;Cq>k(Im-_q!
zOQuaLAvGhRi@ff>QhxDWhVXBs`jw^&c66=gL$x3|ZG|W%$CI1n=hTO0+W~XYC}IN<
z3I|Qqgd&3)Qz2YZR;T4@jQj1d^J_{Ag~F2@Md8dEZ{hGg!lniSLht9h-(&X!1%BHP
zx7@Mf5ipipW<`_b<KH*jKL^epXUU~jzA3<3acG&)jOQ+JPk*q&O<w-`fXl?*jWxhd
zkgwSlbU&yf;d$wTotvdwk$S!c1N1qJaL_3H5i@~4TP$Ogsg7l60UREY#1L38Tmj1G
zsooh~A0D(`;tHygF1Z;$GX|4XkSFKKhNyqn+S4qPAS6{~sdOM<@2UmJjh?*)u?8a3
zO46LWnl(=d9+O~tncmS!WgUdibREde{XWDjK4!m&V)<d`B)7c`$lx|BOs~#S@vdFe
zh`5`4U?!3X0;}yQ+sz(xU5&3-1Q*~-iK{+xWQu6gxl8(veQL<z6~6plmr0q+)|}3E
zoY4Tc9hgYwlFEJBjc@itbt*KYF&+7|`PG9dZ%&$)<WC!q`a}>`Ce0p{r1C|f(3*qu
zLbZX!{al@%gIuWU-L|syHPYRLhSMF*Qe}x!#FzN4jipqV>Py^dZhmL)p4*Vs3@>ur
z0<nMtoZdfJ6nLZ^eSmyn*EOvUm2ek-Uo_H-TXSgrY3z(x+kOe}BwHm?D}7C$y9RON
zW|uy4=at;^3Rjn5p-(naLNDi{$JwJ~bMNUZoB2s?JozQ;a*)2d=FnM?bCC&26Hl!>
zqI~U0ZzywT1+||W0XOMU&VSKH=Cpd)fLR$&m2VFBqvZBnm>?8sBmN}C%yg;18wYjz
zlCZ;xP5<UjPvi(gTO4PF>*t}9#hTB_Ui+9`x*$QP)&9Dr8jIRmqv6YWzfEYddwAo4
zl|{>W3zEdP>d`kBz~*XP;!84G#B-d{+F26nlGih9i&s}yddH^N`Lm9S9t<OGrc_f@
ziHV{&1kuyo5y(I@*>o-f$#@I-Nc}J8Mg_MiN29vN%XJ?s#*m>+z;NSM_K9(~S#aBZ
zSQoVKZ0M1ed=XJ^X+Um{Lq&rVFL~8MSD+Rpi87Y|Ij;u{#HC^%fK}gKd%H|Nlg&cC
zGqU=HD3~R?$lsJ+Q+*)Aw2q5sKJt4hfAbV8GebCxVKuKQhB!mrD>%>9lZ*NIdu9SI
zP7K;8L|OHiuJfA_E9k@`eVjWE{-8X%V5LgMo<Y8KG=*6vCY9xZ4ap6GPQk$i<<vzb
zokI7`RVu{RQ=5v^w57%ELY_SG_AuV~aelq_^Q5UTj~wV`cxM~1-5_`q*y$l6f{tTa
z&Csqf5I2=^fvjkESK4qXKXz+euV6I4PO#R@qABZPO;=O8*9@0(*!Ja+-Teexr7HDm
zwKh}kvME!4#-FFp$11U4uddcwe(;5gKtT6tl(lMwJ@JwBS>5=Mm&!9mb(;F!lk^(c
zS`egHgL{AeWaE_XT9F$gi}U8VJ{QC$row%6<Yc1ed`q!)mQL1sxWu_}SX9ze)MGMH
zOEiRhEX7vU7<DL$DYe2LDEqWXLz8^IsT$e1uwy{mqLR6iqg*qoI2A^Q-uvNAFCWVR
zkq*^8m&n=J_y1+z0xn?;R-lD`r4#SidAL<9??lD3w<>qeOJ`p+(eR)L%ikQ2XT7h*
zeHzca99WoRsFT_FWFf_+CURHQgUhi&S<B*99`*@CA?c?{`_nd<j9IFkytFz7-_!QQ
zcBI6+A`xBTe#8DX=jwJyMw?_+NT{$}T5e_hV=Mi>vAG@SwSxW!3Cs+i3b?*;mM5zk
z;hMOR4WxbqU7!3y$Y}J&|Es@r(i_`^cg^t>`QINxG&)3_53%Lj6&Aqg*2?F5z+R^E
z&eU%OpN@Mq;%T#}o^0%?vE0It?5Tygn&J0Z<AhNERrQGYGGWits^sW|#k*vp2S{$o
zT}%H)+#?E9*A0Pu_0k*0dt^@_0@d{GhG}OV>4HQ<iI(z&Mf_*B4+IBlU4z8xj@5j=
zvJ#5I%<E0^%s0pr{G|r305>rsi9N?pR3VruxMh?T1k^#T2Vwk~s?S9maI=L9$WVZ#
z<a2(NO}8e!0e4?pk?E!$Y;173ht+t;#~#T{pa+whfY5mRgt}J(UI0*8Eqw&W%E}7`
z>iM|e&VmVsB;zgh=s0#F5C!&!)NAD%Z7~gBKVg#1EwZEr5+}wdIzTzEkKfpq#T53j
zd!F1kz}G1^9Vkes@H%sfMX0;{%)16myq#y$$f$2^5dxr4J4ykRyah?5yT%CRV+g;c
z11PtJny&u|`W}AO=eD(T&%3>Y(<ykokrK!w0f*goZwuj7l3mqZe3NLUJ2!+ouOORW
z%W&ntNi`Kuz(ajUD<8a;pWwy~GdN*yj+4n3h<*t57swhJS(K8y<F<UzC)3J-DhO{c
zx8l|r`9ja(QOMZS{>)H~q_0Glw_tG|+!s@{NL9yFxr<zLkoq>mx+i5_<>ccavtN6-
z?g%B$`84LxBiWqKU8W_nm`cv899(TPc*i<Z|C#6<TWIv@1F$^oPUb!3@Q_~0+lwJg
z%*}U^Pnm}KudP=U&&`)T&{AQP3Vhz#zHeQaZ!8Dz2#JZm$4Wj|WfvaX0ZPm7>MMgR
zZGUuo&z#)mUS{t(#IkjS%1*cZ^s@k<j~NhejJ|1}e-V2vL^ABP8-Ist)$dOKik$>q
zALqdGgYTc#oKa7vSm-tprV8kaS2GVJDe(7(IA8A*3V0}u<b>RrNb9Zrp_>yP$*3B|
zqNiR#H@FAn12O6Ota>-@;bwf6JEbTg^+Z$aVwj2Gs9UtvNQje_de$E)@Mbl|oE6md
zvARTt9xY4_UG>)Ftw5e<-J}#Av0tp7Z4NvH(uT)l&TGV{7btH(jG@s8#qQElZ#0@H
z?E114NU=6sjPPe?HWdKeJ#i9gf5&V-Yc<{=)huIU;w~4^do{myWUAn0Q@K5Zcs!7j
zH_`sR22AARCMNIw#=0>3TVp_R$#Be4;pC9eC2QOBk!=o`Z^-NKPHKqrhxd606}xVi
z%P||85uXMLsQ-9sy~dvky-|a1`eGdaMX#ZFg*j~@Z1Zl8P`7ujeujbXrM-Eh4qU&d
znL}5XY}XV5I%1n(FK!)kW(`suJ3*_n2rRKsedoy|O$tSkyvBPw#j-Qb#D~dsO>T`o
zP-5(~S_VMA$n&7Z?OLOzcQeYaUw9zc`W8*%5cUn|jbpJzY(xGT<crgs5qXxCFs!mR
zt>1v{`cvMtbwrJ#LGqV{{LoJ&YYK6YE7Xq6JcMC6IN@I)Ye{in`Kd|g<Z9D6>&M`P
z$e+rVP{CUiNK~;#<YEb5mLlm*7GM@(DcZ_CY0SG+TH$ZOQ@WELgx#fa&gh)vTCJ35
ztA~%LQ{^E&<&&&sUE+kkc0~k}a+<Kgte#u$z61bA_2myfl2GdeUQcxM^lI7avike%
zcZz46h91ys_+>xZ+AOwvAp+$V`W4#ECn52b?k@Mn8@4cLcTqG?_u?BbDpXUFo?v@)
z(eg^1-CDH#>EWgq+|oIL``1YWY&4amO5j(`pH-_LF@Iu2EE7l&ZI-V3cGGz`><{NM
zSLlY*6_9;8*jNp-zipmYYSb$)X)`1=4mgpZQKJsxs5>)zras9%`0>RvrC41wh>px#
zsmjkd!LTJ1X!VA@_7!ZXKj1@>IcxXK1Fn8yG_p01(15##_w~U{^^`SBBxBSUx?oKQ
zHDW6#xtMgugw|fyXYskv@sV5y1<1p;FI2<mrABTsc_iZM3`B?I<8kTi@+j9rmCdc~
zk?|%9<;&-hcLhi}m)f5crQLgItd4ySKMt1JXWi-0*h8=`n_+7{G^mzN=)P&W<Kk8N
z(%Zs7Q+!Rt@UWofb2Th!*IWvT1KV}BT<`#VenkC9N*UnJHEiu);m}n^lomGj?lzEl
zX*egHr6?4V6<RKl6;D0iyF*UQ01>bYioC{6aOTkREZqyHf>~<ZtUcVS-xfR^i|l@_
zu$kZ1VZhtN3uqS4;DpSO51W!?dZ)kUPd%(>#PQkGhU0k`7ACjejoZKhUnTTH`rW>X
zr7#zM)v}C$5H8Zx{&Np`MBoEtIHou&UKwdoVN@K&;9tQrQOHDabI)ysWP5A6$=!X|
z;>=`fQ#|+y(E^I|u2)v$Z7WF}+EJqv<|=jTTvH@FJ#F1Wjn<!kOlym_oCx}Ov<vs)
z%$C1_hsUaw*U38-2HulNKY%!FPQnlU@Rm;Nr`%7605E2_(tnJw96m}{#Bl=(TJE3$
z=}6K8-CSSiz8@v*EH<qp?9OZ1C&TK^u{@wW6~^a{Y6zmMuo~TNPQmySQdPPy*#O&<
zKyBY~2pgb>*RTCFW&zIOL8N4*uqWqjZE!RqknNgptPa&ZcvfYmBb-{4$&ZXLO1al6
zv-^g9_ZtMJ*gfg$wc}2Z_qq2ltLj`z+(!MQ9p-UgaH!A4x>F<?uCmWoHX9muRgX&G
zvU(M{&S+X4a`o~uy^#u#*7Q!p*S)JLb1F-@fbcrPQU1q8#Q^=UL~rXIWDm34%Re8)
zm-50Z#!fksWKXSh0xB#WDI02DMh{NpnR2@2)RH83@#o{M%v$@eXvzU7xAjE;;A;W;
zwGs8($2blTL~fE%{1#JxiQL;yu_Hgo<wg@jK<ySLVqS52uDN5~n``w4KZs3U*V7zt
zf31465c(v$$txFaH22GI`|fv%KV|NDob}&@asq}o%n!b_Y~xq+LN{w;x>_eLV+Y?q
z%t;bgO`<%nl%QQvtzmfRR20vDPu<t&XEGnY_)C|~rN-uhNq;MRztm3`uus_Pg4e2J
z_@f;M>2iCeC^Jot&jo4jcUH>-1FV#8{t^Uz$Z$Wsd-y>~?cXHvTP^~Zv3eDkB>qj8
zzXbdQfKTodA$~Rd2Uz%vjGqLgcHJLvRR$>49hjIYq{2m{^k}Ndh2Z7kKfXh|2?)ro
zb^JOnF8LfW^j16*^9bF}gRB~QyiZsB?eqSU^DkD>Td{qtwlst90234Y>T~s}dlkCB
z@Qo17cHgIjomzi~e_pD*RSev9>)N^aiP)=HoLN`@3PY~m`k4AP)qaK}Uz+>k7r$Y@
z{5CU<bE)YsC58VZ@Bft9Wr5rhR&D)kf1441_HTL`U?fy$mtGzHv+KY5Z*{>DS+z$0
zjXmAd1=8aB(p<WEaYyaHjP0$Dtibyzp_8romlodo0^G!D`^wvy-?^WDw)@wAO6UNn
zQU2QE?-S_Hw%)t}S|ISc^u*)8_dtxc{9>I%vuyku3nc*Zw2powy!6)sz<=$*_3zOD
zco`1Q)ccnffH!enOz`OP*X^I;;y(w%XZQ|4KXks7{_S$*UxtLQ^3r8<9MMZ;BLDKL
zZs}ZLJlSZcUoG5rO?vW2EWn>b@y90|;LhvD|D72BznB=|{6|OR7jN~Jy-#t%p$vhR
z$)L0JVj`loPWkgbl*vRkdXRB3<hy5AKteYcOQJ{=CC!m7q=)2xPNg>vmrcb4Pi}ub
zx-B+sfz7nELq5z`Y`<W|7%o6);IKbuahhE2SDEjPK0x1x6Y4eCv$OHGU(mh(xirNA
z-YoSqpT7f^A7?gLgUx<Ro8Rn!MUO4!a2>i-H2%@0`tfY>L0aAY&xF)1GuK9l{y8nT
zlP_t!w&%JyA$l05=OZ)p?>7KCSeQX|+z@ATh~QysfoPe_RP%I4g$iKQ(M(TNcu}*5
z&4baKXq@9y)^nKs&Ys5Bh0V41`OrgsLv9&5rH%s;AaTQtQcXp&$p@LOD+|}aDdfXn
zcg-+E&Z>+JlfN{PP*1$s547CPaKr=j_E@vomH}^wkSD*;16tpux00^7W(wAuCub9+
zlB}Ys@@Bhs8!B`<d*K-EeRR07XaQd#J*Zwg+gr4drZ-nbUARO`YXSJp5o!-qwv(S|
z;umjpA9J1M!m2vmSX}X#K{wv0-2;|cOp}$!Caa98M}d{;o|Ef;?z8@RKn??d(;DZe
zGV%59)o^-lJ*nA!25`Pb3m^`_qLCGPBb~UTp;}b=A2$fCapMzWYt|Zfuf$N0NGFSw
z1z~mN!C8;Mz7JM7vur0^xb|B!TRntSOBo~DbQ?BeH{!t)1z?^6Za2_&x2i^2^cU}p
zmy1F!L#e#y<5h(aI^=v70n3DU$)Tt_C6U5Z$@A#4XECC2PP9=vyQA3s2=;Yn&Ifku
zqY>$&B)ifp;UgVg3MR%i_mNu%Nu?TB++bj*t}S)Lik%uj23*$T%ud?kbKNj<IfHIm
zXU+X&xPRXh?*iNI&TFY&d;q0>!qQQE&&ZHCfE2G&T#2`8_9yOas(iCi_@JARhDiur
zX*CqOhj$X$wK-=~tL~y<pBS=K6umuVyE;1Sc|ZE{GLw%8fM=Ba(zN<JM_n<!$CO}E
zS#8x@#~T#<CueZy!xhU+dzY030QN@3ozx6vy>jkQ!Qj_V@qtHdu~Y0%T}^j*5bU2A
zL0M9LW`a>6nc3oynD!Zz<K9_I2Ve`AO+1sw3eoE6^yJYz`sYz%#2`knO!izEA6P3c
zEVsOPcgGQexEQax=^y(WOI+zAKj4Pg8De_?Q+D2zi0^<cpg5$G3z(Q+LRkxHY{<;D
z^zS=s&t*n4dE^K5OYUp=Now-%D{or(1&8TX=K^_$c&V{DGYN33QVVpf={`hF<(SJ1
z7@jfYZ32*Ucabx@a6ELB;&&YFpOXqG9p?!w`>{hqMqmZLVoeDqam(S#g-58c5}Fg4
z5B9z`TX>rU->ZGlD0AW=+V8L?+A(&nC6P?bLS3~!yxOF}HdX1)zH4|vG&wU$$74-&
zb;e}oY-H%I&z3WjUVtN{!^u)-0G_m8tczB0d2cinO~;XMh3H8hCE46LOp0$pBH8D&
z<B%;55SXd!AEL}(&aPp=WU-F$dk!3qwAz>DU2W93e6wZyg;rFv>`u2-9rp9?0u05o
z?s+sOWY@(#BerrS_;xlAZ^n36bVxm?MNjB7Yzxr_VzHzs+xymVO6*&n|LRdJPYl^1
zeQ=@9)?lYa#@rK)UeDXf1z$j-L9eCj)_r%+t$>7rpzSozgnDaGio&yoW$mn=MPL8E
z-Ti4#2|?dJzOI44A5h&Lys;!}dbo;w5>~SO?MlZ;&k%xJ*j2ALDv8_9fg!nB(}{W3
z>*<o2bWmhp2Uph!YZV-HY1Diu(Pz}fqT!1p`}v`Eg@D?tI@f^U4ev1w;_Ttolyu*;
zf3}~0HHmKc@`H=rQ%ucA=k{l6Ht7(%g(*!+2Rbm7ecQ%$RU7j|qA;K~S4&?I@5W#S
z{AF7@Jj+po2i$REkdWGBsW+@6-2ypt-oa+wU^iHBRzyB<M-lnD8J^i^eIs2x{lA2E
z6f=IkX`aABbYbu)vMN1wkH>a@?xjb(z7}WHa$w&U9^cO;bvU=R5HC^&vy)_o??K%O
zTM7l^x>|*++YdUpTdNG3-rCGL^HP>oIb9aTE+aIkv=!a`R#AWlmZ0lZ^1B@r#$^AJ
z1ag?Br8<^-&rw`ZK_6|?RsyVJuUy^8F}L<1d+xnc$pXoL?i{qQfJm59d6Ekf>yu4#
zl=1AXDb9K6S>+w|QkIpeV)G9tQ`W(S#1j(Rtw>ygM8}t5`?-2<$aZ3{)5*btr8F3%
zp;lXeYRZ89WbTV`L!nS=To3<%t3zHSLX)l{dCA?;?z~>WWv)*NrF7X`Fe=@K4qlP4
zt9o9tIFHad^ia(*SAIHIQ)VymFWviUp&R~+b$NT+HmA{)?q@&0v!*z7`jD$W-sE^H
z@K-a?#Rtp3+fU>A%Tp}M491H!V0dGFylP;1JHKi#-)%C(@Jjk?MGlDYeH@3zQTRT|
z|2&O<|JchX7x7A+g=y)3Sz3SH2*erz8xmT4Kw9^2#`ql|NyqY4IBc2WpQrUtqyJMe
zU<uRbqa`5!)42F;B=}qfYW)a&TW1mo{M%;#XFndX0NefzOYc6NzYfA*Yz*3OK)9O1
zlbXQLe>1mlTzDmoqXz$n4TYtTIL-k+W?pzrMgJeZjF`}^mn4KIVx)jM=JTHE$@-p;
zM$>a>Vj@u49V)D`sg0t@QkX;8;c$8%1OpQ50<+Tcg43L9xro_GBp{<Zt?U$5eV&sF
zJ3C(cK`26X*6*5ZrkfAA6Fm=$jn@`eBF@$Ey1Tn`RkFJyip0v|9fei1Jd$|Qb)3gz
zlkIR8nGJHm4#a9U$A*-)hnpYSaVp&5mRX%z8~KfCS6Ne<6me2NOmEJ_-B0%p5kSFT
zcVO(K_JtaDoUNw>9QzH_(LFjTN@GaD)}55b=i>g}97>dk3PxV%!*zZ;P_D9|aaQL+
z&F#Gs10c#N;Xb-R+uqS}?Yx=yfcKlq@0kLu6rlJB?PK}-Z{I$|T~_RU=NIJnL0|u=
zclVUBxBKY?p+Va7*RSVO(eA`=y#hR4F!H1<Dh?ejjx#ezpz^s%X}R}SVW$@Swx^eu
zj<y)>GdzZE<OWpaa8u%aqG*HN$gKG3VIAVsclhHo=9^}s7!#CXf{;X@5uJ>?Yo>f}
ztpg?i%XN3LXlgzRNJyA(Q1{%7(an3`B5%+lsZyN<<kCHL<hr}C)wlEzWqmp%FGWCQ
zh1hfyc6PK6%A6D_841;!RG3>Jc3aq8L|Fnaqg;Hc!fw8uYC>C)+X;xCYkA48%g1Zo
z|Gpb?=wxf#=bFDvk^RT1U<BCR4puq+kFl=veR}KfpRHK!;0BbWKMOPPQX5wDUS&xV
zbw5v<m_Zh~o*oTZ4svOTrM!q_H0lb>1X&J2`Ax!2<($`0K=y7Oo_sA=px~ghbJ%Va
zi~_!)W__G?>=ziV*<ji{A?UnI%%YnM4&mp_N)&Z}91`O^5N-X`tSxJ3Q{qKu0=M;6
zAys^{>K7|lc~X^`uqOZ2unOrpFC<qQoA4B<>!Cj(km^^Mg=J7wHTrQ;`94av2rTM-
zD320Am7%V<J6Cw7%Zk0KcPVT7vhahh$=Cfbl1bwkmHW|lYLZ5dwqB2Qpq7)qeLrj{
zUoXvppO_*dZ*q%wxMNI*-CE^4%x8cc2v1<2USE$KYSnP;H`~?-J{n`kVK)FK9IQYs
zEv#Nkl|EU>cAVLIbQDDa&c#){C-~*nL2%Ih`$>$#K~XHKbxy+Ri{s>~ipe(>W+OAy
zMsTa`OlHR8PA)myI_i}<D6i~Bfsv3>&%Kt9AFq49r=a=a7Zf#UhC=`N(I^pwv>1Mo
z$_yja5pB3>sm{i%RGH(Soz0WFJpZ8#X7k?v)T~>jp$&!!TePE)CuY>Qn^=vyecKuJ
zZ7g4cQlfB!FfMaPhSo1AC{#@Nsp;yIjIGmetzpDW+T)AtS)`|w2G`fr3p6X-j?wOi
zS9TXI_hs-%Ns&1XJJ$7hY1EU~auX725*lifvV{@_TzBWm&p20(`%=WGJW*N=_YGDy
zQeu!r2B&V@*}_xjn#Q%Hwu(z$1e;?p+Om4PNCv$j^VUVlWWyrHll6pdMM8;V`ZIpF
z?tO3KDGfn47@O9U!|{=U?r!NTdkc{MTE{`&lzOTaXyM`MM2$15+<G*vEauSL%s2e8
zJUDn0gFXd6@%#`>@lNt&z<KHg)e55ci6;)+tpkQ#aFix_a+B|;{tK8e4{lA5LmmtV
z+yvCjSwFG<j4VYpGe0kAqQ^icWJlZIS#*=;R;+XT_j5MeI**mv_ROI8a`Qd#np0lB
zl0=sqzPtBP?z=&}rOsNHnOctUy`}CCetOFDr8-52#73Aoq%yAI{<)Fn&^mu)QezI>
z1#_=#s1A9`I_jj9A&$hhtl9D!6qN`hvKDYUu^J{kp_KC$P`G!f)11fc=Gn`uce3w|
z=FpD#5R4%0j7t^WBg*KG7dES%hA+Rr7T%!r8SU;&X=0|3JSc`s#AGD39w1&UzVqEN
z7dRewl*E!9Gdn;6#gMR*tN}HFo#<|M&#kZ%P>$|KasvjaO_A1~t#Aet`)ss@qDl!H
zm(!AK<G3hpXw%tq@@b{F%DslSda>>FXn(AJLa--MAeTSZgjwwiMZU<VBHgON?5(dA
zryk}nh||4>wF}dF3W;S&xvfUikpAdMx#^-QZ)KLToRqBRY>8WYZI?XNlW|2-Wrb(&
zv*-l|yfsP*^BNP(wR31_H<*TaP^qn{vmzfY6mIP+lQ~QVTPPDYE>B{wrb3&>z{UJ_
z*p<~)G$NH#45A*dlAX0_pj&;iRE7NZODl&X8b#$cu;t=+TTG?!zSt*{8d6IW?0Pr*
z#EFSm*!1&)+1S^H7g)OnC(A9w2TPb^3p+COw?@;K+-YF4L5p3Xg(mh@(9e>d9j%iu
zlZO?Vepv^f%rA_Kc)d0;;O0i=jpZUL^s`Ejo#&ap``cV}j}SDnlI_>!i)wPU-pn9F
zx>u?v+(Hr-yYJ?Z4>0xJ<P+vvliFM4qCaUowwL7Q&RLOY3#Z$YP5#C%-tyH0`{{{U
zzkx1x5D_82w}LEpkl9)me%UH_f3Rs6DVtix(I#{(E!4m}J6E<@CVEIMCEjrr77<uX
zhUm{iAzq7RG9&zQlr=n7=-L}?&&+!_#wrFQuDClf@7m}t-h&R`6}0l74OqKS>1VUW
z1VlwW>n9t$x8?(kW7rMy#&U8+*0?x03n0~=?oN3<w+|nTPfVazKI?sk*B*oH)_=?t
z_c9lif?;9ip2e{}UxDJzaMy%`ldr+?%Fk%3WOxb)=Ld5KmhB?Y?oK1f;YugRwx<hN
zd!$P9g_0B3v~7F3H(Hp$G8)O|<+=SIa>SRqlS-zDWaqNK79{Wz&B{d!RlSQ{HFRi*
z)gOd-SQ`ygBTSgo`itD5{Dn%HCzBI`4lG(TFAmw1xCQ+yKo4>A*BpwDX_4eHXMVVp
zj$B(hdxt2{i;3RTwj5)#^d9(@1Bn4_tsu{v`?a;k)?+>CPn@)2Hn(q=nbdW(gYwgg
z<nq)jHE$$18i}YRK#nyjECx%IeyJW}M#Qw(QbrT-V4xJ$?8{f1ow;tyJ;d02+O<P{
z!>iHwYvtCHDPQ3hc52~|s!fL&kf1~vKf}$q&4TP3eHv^A{RR%WDwL%D;M_b$YHKys
zoCl!Q*4$4hUDeo!54YCtC^zf2oMVC_3h!&29&W9isM^C9>EnfoJl2=Z&=^@+&kb;F
ziQ2cA9Mqg*K-%;6#?-4t60(u~o$P2si+xss68eL20sy6F0vgwM#mjm&MWOus{A>7L
z=aY4*S422Ya<7t}d>Y)7?9%RxeY)~>QaB2RY>#eoDDww1eYbklUVJZd(Pj0@(Bc!~
zF`2m49slAA=h0rNXB>i}G3<WJrOC?Ak~eTO^=?+ZsvR_|NgHmlx87_Cc_X+{%s`E6
z&b0Hkt_EePY4&-n)O&#MQ`%|sewx=DvuJSW*g&>Ip<b2lV?yc|t7GpJ>S76HuP{|R
z`$UiO*QP%pWzx1fgETC=`;kxy-cie}X8ac875rK~EIC`=@`e9~6&JXJgS}5jGb%zr
zRKcUfVMYilLRzCBOBo}s#hn>+GctsJdHOOPTaEL1JzLnvw(>N}+^z}_mJqJT=nR5i
zZb86>9Wpx{77VZj{dh4%yd&3yq_-avDZK9nwj60EbOh67Q%#<Nc}~gUP+VnyVn0}E
zq(O%)(nDm9aIbPP=#+eEZ#cGkYr@^J!%%A^Tr0(yTzX^A^Emh_?GPgTQQ!JXbx3?%
zN0%X~{6wHOKPK{}v=*O(ZJnu*#jF#iG3$)d>ATf|?g$fWM|yg36`LQRj-F$)`ROVt
z$t5Sp-^_E5c3K%}9XFdBC0JPMiW3y$k7*6X<jRC-pH!;1zm?Luo9~?#BmztN;<QYZ
zzSCC#WJ(uZL$Mm@^vIzhai67!CaYP3rm*7Ib&Hfa>HMBdo%DAD2lD}?!DGS*wIYxr
zscf8UTGESvO}!M*`n^fzI!7$cDYH;&k@dvEkuF5n5508oB9XouhIZGd`z-c^xJ!o}
z3|9mhCBmiGEM<-g#{`*cx^=d^QiLe0{ZhJ|97vaqrF<O}@#F_4>rDm%>F})8;Y`6c
z89Y<FC0zZn`w_omA|DX|9#nv_=u=!kYO=tJ&#@dQ>KMN=fh~I+6H-%QQ02j2odgt_
zlJxFgne+{`Tn>F#ZEWbkogTf$rW2o<K2P0}DAIvjEgN>+uB%s>x1t>lk51zuhR8<x
ziANLz8zo8RbJ<lhx$h4C48|%MtCscQt`0ZiA53mO6!`E}mZ%qJIyz)6YW=zAlZDyJ
z+cp{H#jD}{4_30?Rr44)TZ1lXkMIK*(w$C+Sb3cXHjqZU>E@9NzU0Y!?bG>T2F9!%
zggPBg9_X{q8)%dTaLQxb-|>yL3KiJV5^FFDzNx*a&@xXN!PHu;?O=?2=7<8D4^Ayc
z<D^2JpE-1mvLK!BNK_M24JU9}Je{~U;xTjvWDi^9<RBIAJ~iW^19>Y`maPYre*upe
zO?*|2aatj*ej2u-a!n!`BsDVZ=^;<vxo^yW5b>=QkC@T4R@xC1*JUfg`g^E3`g8Qs
zerY1WeVAJ&>Us~TnSWlXnSCL~4<*h}+E+a<)GlYJw$3`(?Wf_FDR$WyMF6I<5TcV0
zG*r9dXK%Km@GSmHjvDcz&b1Xn9y)$Ra}_R_Sr0Ibda><IS3?ENdJ^^Pj4TH8KleFq
zWyUanD3aDpKo%)K8eNu?`~LLx{#2DCT+U&w5z#@CAoV$gQU9bq<;wN%cQ1EIs5?lL
z&Os(hy#_0$%t`Y47hsV1wpb3;#oP!?KNP+H4VLf)d@b`1iiuc7(>!M}CrN~S9mSxi
zT=@2DWUfljk#m~J12va7=acjV@>;fzNOjK)W{$eeCiPMmX=C8_s!oSwyGCBQ<KDHh
zeCAittno$jmjK_uWmY}slNh$qZjiKikYU;Kt;j>y)5Q>hb;nmYG@^O*%7o7ow%#pM
zlo}Mu;zVl9AC)|eUQ)1mZ(vaG;-k>A{5@>ayoGWG+eXd8KC(v3tV`<rXyX`eMp4)Q
z9IEydAIjX%d(RU#QtA~_-x=#}b9_xMqD2<cv%Q84yGAuyWgUd>(_$;*zc^1w`TAp>
z!{UEQ9giLZ5+{9DU7IGLp6Fi(?AuMv-WlbG^$Jk}j_DfO-HA`zOe=_(3RLQ%A3P3x
ztdXY;7fU^7D=5>N$}2XV_#hL;XLdp)4?Q^8DHup8QBF0TxYq8Pchr$E;SPS_lwIN0
zl`QPJ*5cSL9kJ-)P?Pa~*SNh=xiV+7_O-$h+1(Pr{Z@c-&17%YE5{>0bZN`o6Ko+X
zT2!Lf4SfHlW0@YSgf%60x59v+&n(MGv3)9U86JM$JpH87{M;1j3eQqJvX}clQG<zd
zTzH{CZ?>d2R<U|>94N!Xm9UE#+E7znTZP+V@>h(#(bASH6p^*Zc%xh8umtzbx3%79
zyT-5QeIEdJOD+&}1vxfcTZ;KM{?SHMvtfsM&r|`#CpU(mS3Ijl!qCcat`Aro$ITg8
zMw+bEA*&?u@;aqjWgcySD<mu=BpXvihN2yWoaOv}ku@)tuO3qkfYhrxxe+)LK2jk^
z?GsJn&^|^Q)-T6H@F^Du+13z_Iyy&?R_OTUqEa{cLrtDhWcgxOV!7=G6WwCoSaHCy
zetR@T483~pJbPrAOxP<}=$ha(K(82V!>qo*BL&`LJ;#!wXsZ7yp92ENi^tPkY|_Oa
z24_-Nn3%jS5L7FXCaDA66Jwdydq1xL0xVlWj5PP`^sv%L++Rw=$L{K#%&(CFb5ScW
ztqx>xA8VrE-fnZy#^ieZ(KSnMmC4-z2x;rVM*=8b(XDMhZdEHt(7}a*=)zEJzod|^
z0blHfuj)s9zz+@=ZkE${5dQ8V^`^-GL)}}4MY+9Uqk<xefuex4g>-kLbW09BNOun1
zD59iFcS#RJGt>ZrfHXr&cXtdi)Om5cx9;utJLmiNT$h*E6z}S_o^?OZeLq!i{sFS?
z2wj03uz20EeTpIHE$H?1+fGsdu_vbVH2$uqk;CUqExMh*shv!kKKDtPG$Z!^<vsI#
z^DL!WVyV_Uo(n1mSY&vaRHYk2V%}sXpA~#x{7l@b4}hBx%avZve_?PR?p%>46+#~*
z8`SinOD%^K4`yVp>3B5@@^(ok-+lKpIKc&pIp^brOe+nzgn9j?4{6VJ+bpEfZ$KNs
z0OUylX9|vr1MPkYxGY=>?=AhCb@>D6`|;n@cg*)ky|gV8CBfwX19Wt0y(qAi&!_W=
zkMN7TF)U`<FP3Rfe-~5sUA%8Pm^tfEUcd5VwY~)$)uC5_Iz1G}^uP$YdoS`|ee_pB
zH-HFITkc<|;eTHJf09ap6O#1u|G+{2Z}_zFckKV7w0?c!8zA-R1hG9Rq-EWlE{Mbj
zCLWpZU<Ut4l%sQCVzU{bcKxdXGw(04rOdX5rjYz7{27K=ax`g02o`|Y`1wq%xwZ2(
zND@8yZDd2~0i<1G;y9QLc+5Lz%;vF0Tujcd)k(-l!0C>}Z1iheW|)LQkAtjZ{xz8%
zl3zqtNbtRe{pgz*tT-;4P=HqbRNps8IqTUBl7;=Zdfj0Lq9hjdE@0M~XyI@EHvq}k
zt!+6_mhS7rfoA={mcL^G*xX(VL$7o5@CbNhUzs}jPrpCq#IP5pDi>&T0fsO22B`qv
zo^{y9B<}GD|A(Y;-lI$i3wgRXacmE^<oS=KMOkQw^y^se^*G$%6EDD-Z-sS_>hP5d
ziBP%Mjmxci9d|~nttRogtIaR>eXyJ(dZ~f+Pj^220@PW4tNH`L(-%%7%vQ=5kA}O=
zF{x7{!y+&)z+tB=_rG%_hp;7eByu#$pFUu$a-D5X9ECSFyf9EtHvfJ60WR^Cl;psm
zHsC{H=#7X1^<|~QaWT4~IQX7)kQ&%SAWe4IzNprUb4$oqEQo-H=8abrgBF46d{-i0
zbFYHXDf>$AB2A_9=EN=(<|uS_XpnAmusP}7m8nkVdr0%)SqNx4ttnW7m}zry)36Vu
zMJniOy_f7Q;H~U-Fl_m>%052w?^wl)CO-TKjGw$AU&J&}A?+IgQ#98go`8oHebunF
zr^XHe;6B;d$NOu8Yy3vNFOOEOv=Ebd67uH|PoXsf$j0$B7(}niu7xg*^-u;Cs2d~w
zT*Z&d^W!_ik5^Rk9}GRQ^I0FSuxq^5b(@&|8^3nEzg=*V`9LlR?8#v@Qc9!rd24Hn
zTC035TQNOJ=mA+vx}L+euOY&bD;!bz!>0VSYOu5rr_Fvvilo&+C`>U2>OB$>*>)d<
z8B!ofk-+DG<{v)6-ar1f^nG0mE_gIG{>gu5r3CKc%U>6YMpB=<pCr2$8(WU1#h#uO
zXxBpR#^cc0L)h-^#<vtmg^c?_6Q8e^<r<-Ot&yL-3=KaUJ!z~%rwMOB-RNVuT8g#F
z<fGdhyJ3lCc`Dzg=IvGo<rv6zcd1X!zs)RWcvC4P==Fm(LY)}ENa13WE#xMa(GA7Q
z&KJjtCd)VORy@Gl(cH}(A;gy^(5QBcw9kE`TM3Pdq>(x9uX(S3<e-prc<3Pxu#*bd
zq3I$pkM|7#NY1gc6hq2uIQ4B)B0J}d!aF4cNN&ecpj#z*HtBV=><{67&h;4PMS&n3
zzcW~%lWxg#_wHS!YRcaL?Mx)#KXEDJTe=CXLuL&BYxs6CLe5UH_Vf7nh6}Cp8}0xM
zR<5^2ug2r}eO(tjlPcYZLidPRPtI1mK?QHkkillk>=p$B7C;sXYxkuoU#?MjB?Lf?
zPEUI4hBLGfS3~e({AL}81_n_3=@jk4`z0)<N%ql<I=O23Zm5+3rn(dR?U|-~RPyv7
zSi*uDA%o`L+Hi@&=-OhkxAh)_2J7enQLX#IMqjy<=M}s+!tI&209ZGU!9Dc#@c{=^
z`E*k1p7~&o`?~q}ZXvIN??rE?7B*^~4>q8~#T@3nYv$_e=L&-Am6m250s9YGclMUU
zIn0NU*wqdGHjZxN>hM*PbuJt2g68fd9yZ4vQHR$-gk9(8phr~&P%!$Y2sUnE+!esz
zT|1IJ5xTC0dX%#09dfEu#EEbntvg!?A(_T8B`#X<qS!}DwE;N+2XX=TZI0foZX)Lm
z1Hn7yf+h9U0#*KRwABkeP`Gu$M|-me`CVM1R%*w2vla}OF?X%MmmlXlyVVWD%H%;0
z1{OLJY7IsQX-XDqQC-y>76VAa>**(lMd@z+7T>weEke~EKjsq|)I!Krhw@rjWZe$>
zxtTvayHHIKI`&Hf)@Q@L7y*O0vlz>X+|JKtCC$N!TN4tV_}o2)yarEcy{m_+-6nEY
zwem;GhbYn(DVpwOb?P#^Pxl@Ot_-C+Cz}sgh>szvUHh&^(m{3x-ceN546sc<|7skz
z*copkt3@v4<$-WRjg5`%%(b$4pPfuiP4POenAX~Ej8)>7ayX}Y9`EOV06v;)4L?3Q
z;;<N819CrW@>&c+fyjE|fvdRWmZdz#9WmMd=EGwn^X<{2<yLvTXJ==pXcSwTko1>S
z>!lV_pHS;`bBVhdx(GL;?j)U87ARV9tw$oSBP)C|OCh;6oXUc`4V5Yh0jAQ$<;w8e
z2Lbo}rOg%1GIOHs8DJ;OYsA37XbvQ<&@HzfA90C&Byttuu_@3e%OVB~sU@P}?jYh(
zgQ_dmxY(5)bqk$mkG#J})xQ`_#3n5z0%+rmM$&;g5XEl#Z$<_jZau$mZUPh~o|rBX
zR=Yo9vD}vh;zNVF!$^7b>D@-i2*(F$B<iL02KRCng2aN4vc&y!2P{HQ-FKYRy^u2V
zkTZh@A)#~5a<|SAw@T-3#`LbSruM8(jqIHvUWiI-X2_~Rmli^8ecc_`Vm!xT!6HAA
zuiR{Zep#7{<D-U6y%^mfbhIiDGQ6{J)p1|3TdUlx+G9Pl?wJCcpa4DB;>tpm{b`g#
zDi=RL|M`R6Jc3&fcEpC@ZeHKvbx8_|{8Hz{ChU0w*{Jr-Stkl!-4dtqB^(B=1y{>!
zrdLmkDT4%$ATK98j)J18QTu$ElbieAoL1^traK=}Czm?DS*(M*W9i^L7Onu7ovAK_
zL8Hp@Z7@-MO|QrF2@ftg|4WM?!VV_Qnm68=vin-{hBA&j;voE`w!-?gSl&`=m~+&|
zB9CXAVds@0b_Y59I@jH|jKp`0^J(W*(>(3;&L_a)XL{UAz1RbmgDK^jJtx~4L4<Lh
zZ#|D(Ki2S^DpeCv5Wf~Wefkl}Li(4rfOjF+@uoNnxUyXPD&cz>n0Hz@_a1nE_c$7U
zh+yxwk%pNj2L(y*c?ZsAO7X%s#|FVMLLSE<u&T~zHiw*squ>*gSE<P6vzggKuu}4b
z*YP?as6z)MzJI^J#?_(8d?;TlD>~5EX{qN6=|TTfeFcSXTGiZsn2r{5G?vZ8+^cBE
z(#739nqH%Ksrm&hgW~iMjTUEsxRwqDQ(*ZI_+?fl16iY&dQx!+MoB#(B&zeim$A<d
zXTxv|>Eg6AWr?r~vgG28*^4cP7&AtI&xP)*gFN_wwZf~U>wW6zsF2qY!!rB5$l%_y
z7}(b#Jyb!n%X9-)XXR+&7f5r%J4^~e4|V?qUe4;QhO4)Tsh1KMb$A7a?uBSFP|3xW
zdYz(KNd?>>{y6y76YTRCg=nObmChsgrfua6=|~1GP5~Bu^d}Hs_%k`28#k1D06jL>
z9Hk5u>tV^8&Izcut|7wgm=hCb_-Ab7Ku$caAzCG9MN(Gx2P8F(diJ}c`H(GJ0nkDq
z*GQS#8=2(q;!Dz5H`9mTh3F@0tIS||C##?@4e2B9*-X|tF6_|=bT4fd#17$zM3+kr
z+R)R2zC<WU&1;$um<Fj8;8UxpQ`y{)7j)`}EQk|+z28o;C4a!^=Cy*1E!?-M$-$4T
z$kE<@5vaq<7hhX7N?&T85Y41LwYRK{z6D$E5O1$Ma~ALEdK-F$tk!)|UXRl|W4c#_
zsXIZ?s=pgtn35L{1R|>?x^dZzja9j(>oRJv*LkHsa~hG22oj{&%c+j9mY<eQ<S1}L
zpwX&_rwVn0*{WF%2XH2B#6Ssrc`tY3+4#iTmiVG|5D3<Xg{^kGY9wVcrCUCsZmfKk
zM4+n1Y_6~u1TCry)2;Bxm!CL1M6ZyZ`*gp3CM|sRuLyYI6T(7IPwSISE`f`i$INS=
zG~5;Oqrga+NE(ZcFj!Y8%mzJ*O0H|6Lz?8O<Q(H3J(h`rdY^H+&7#W`YJx$x#Bb?}
z!Xv+G!eVxS1CzrSu2bz47oL|>0UVYCvagI}2~v!K?5m~Cwch7ml*+X(+i8AXz$R-k
zkgF;w`E6&uodj?Q^EP{!bUx=)(1mG~822{-&N7l<z}ci|%frsjE)hx^7hY!Ainm*1
zAY;Nu!l7R_f=>26Gt;KG42?WT4S`*E7gU)~_m=z2)lx^nUPto*6kZih>v6=OY>;Q)
z`kjGMz<^u6)RR1EF$5bhT-n;PmCF?LKC6jiZRnA%P|Q)H<g2cgi|35n$X|-|+p$5Q
zq89k*9^_loWkU1m_C0|`Q)JMxzl3bez1uX#WzFs{R^_}YXg?>}1dU|)8pD|Xt|lqZ
zfcIXC<lbPu7JeV-eH(|m10TznofB{O<16%7w5s|0qZM`OaTS%Z`by0b8MjrioI068
z+9*)25*Rrnj;jZ5=Z$q|CyfaiT;|G(GVGliW~Yww+X2bqChZ^7t;<?$xD0elj&_Gx
zQJswena06lZmUE^2JKOZnm%GC)b&i6S9>0Zxal5!M@0T+y`PccgI0XhrKc#u<a}_o
zW~E?6ixdWTyuaeHY-<pH;mD9wVz~IwS-uuLL`;)1F?rI@D2$0nF%@vf7JVB)+3jgC
z;mfP`t7>rXEHD+i&c2-%;?~AA?KCCulb<teOQ_U))tB=mUMM84ws)n>iIb4SbWDXR
zqf~Oy@$KHG`+kQR!cMI~J@dvB_7?5=$UHS6V#vD!B~H{&g@uQ=uf$-GVSlp(&~Utb
zpEI@o?@AS)4?mx$)Ly>2ip+1}Ym$jOyArrTwY2q!!5nQK<UHXC28|Ox4_KnrigI_0
z>y^;v_GWw*dC!O}BlzV@8o&T(Ub<i8=<Lk&vcB|&ENhrC#%jT7K`pwiy<KMcq5XVY
z#!^X<%5HRWr>G*xsI(_yPBx739cQ`zK*VVX?K>!18ZXWAQCn)NwFPD|(yw7G&KbJc
zR+k!!l%9m<^gIy{W`-BsCyG;pM&l5WJkcpJ4!LW``MAl=x<+LVv|GC#teC?Sd>Fmp
zY%@|S#ets=y07IOV$%Al=^7MJR1+}2A#N0Tus#Ypb4#mG?@Hi78SXB0qPduvdt$_3
z-Y9KKt#ZpEOR8slj4Mtw&jB4a((iQ&R<#p37OhG~5hUoG5g`}7x)nm|mrDat`8qn<
zovX%OpX9nZ;F`Ds!<C-#O=(cK+I8gUtAj2wCwX>SOR^6wdlSfGML0%Jx;)})9BDqD
z5jnM1?F<x4M(_-hqRR*_=B|1Hgx2E8V8)ghBD1oO9#dt!X10-}*lebEkECV@KFWQz
zt~NgVyvR7?J1coyolS{5S}<jfBo9Onin}dfIVknjUz#r+LaEvonXuC>`UL-d=a;B=
zXUD4LYr`R`5yRpN!Q*zv`((TCDG-$j6sI_|f6+_;KS&^O@dxAZkpOCEqK{L!cit5Q
ztZ=GDN)z7bh(6bs{I+kURZDUdgeNM_)zBaoXog&gY%d#(>LgK})K(_C`TBJjiQ>)i
zm9~l__v0ZxBIVqmDCUf?o?x?1X2%0tu4oB(>Q@kql$bbzB~MWSh$*xW7Qd#tOdov7
zdI+Wy=_;~4Gl6i=i%aYY^Q4|%Vy1mC%2BRg7I+%6zc#Flw51dsygz#x`?hJ<4q!3@
z8S*OBhOUt;3kHjJw-rL8@Kw3s1=k!?U-$<{x4lj!n#2)K=5>^2u?vw&bpn9%G#v5J
z+k6H<70q*4B`h>cjZ&@MACzJ3elTFQ>&R4)b<*x%SMn2vVCF?JDYt<Pmg~D~q3V^=
z5RUw|lErU!D~4P3UKGor-gzL{yJ<~vj{H0-cc;y@9k*&A8imHyuU9rt^m!{DrHsvJ
zRi)FwPTSe5IU`mzvwia$a>Yr^8@S_^`-WR~$MMJ6lb15EkFph*#+ejtY$>xggq9pm
z1I^UxLIbiSHhk(GE!1-SPq5@Du5sR2hj;fb652W+ytEH45G46rjk7wp-TkDF3!Zbz
z>N+zCi0C69&-*beykSy?`FSnZ4OGqsoL*g`-vJ!LK?F=@yR13H92N&_BT^b+WX$Jp
zAMD~&SD3ZbN_mG-u%>L5dQ+XUd4}2nD)$8%@+5H0h!e#$w!Gvv)x2fh^s2kr4Lug1
zf)lTP(^cZX)6Do*-~n<7+EOKCK;&~UCXI4t9NaMD86(XezjqgOwk34Q=GzM~OVRC)
zbdYfBfjh-Sm7{Vc5T!JcQLPzE*crznH_Q`!td{d!U})BGYj(Ie?#@s;h(hdfL_mKr
zKTDP1aZGSO5e@-ev{-u-0|)*{F@u;(NbAeCu2+n3jYAcI!aBuyQ-G&#G}==$#b(l#
zeK~HzsN?P+zrMk^{k-hatH`Mr8XUE!`&w4O1!7g2904Gt8STux25(}3We+zWpq>A;
zzr9VPT~Wv?kte6>qJL?G)dRZRt10$gu>WxD{FL3iKU?%Y9xW(3f>~2YIwv){%~l^W
z6~t7_JaZ_0$^N8*CeFAty}n9O`P{sa7Q}eh0RK$vA?KBdw=eDmhO_{lk{BEPEkZEe
zJ^&iCBsTXY>ZLDyE$matVV#Hg1_cG>HK^Ml`m$8x&v!1JoE)q7MXXp10e2SeouSFj
z5S4sIWx|%vsBInx^c<+M4t}1O`YPPGE-X2ldm#|;7j?!)b`5o3QzoF(u%Ap4m<2MM
z@SjxeOxK<(g3D}5dgK>1_R_Ar^%m-7@^qurQ{;`{;&tZW8ZDNqz8Vr=YJ)OI5UU0f
z&?(j`85w*ObfJ<@%+aQ^(yCD^v9G*7+pIZZP+tsc+faf(7s+^MHsx|X<rX#}2&9u(
zXgF{+@%43H!z#zZnL{UIkru<`mDO1JOA$1hDR$$;I+I>m;_JLD8bLojeh=@EV0QR~
z-clU_%o}XH9<egcl8?GLT$FqLVMkI!aCc(LDuqyT#gGLi9ip-x?KJh)`tG{^MtL#<
zqEv-WdbP|O^BjW+6uq46P$l*iYQ0>o6Pn=F#YHafGmm(G1xhpT^tdeO=ymhQC7fB+
zyUX2X{!ar5xyBjt0Xs%6j$Lu)27(mmS|5zd5CdU3k->qny3_smDqiOeZOT+mUgb)A
zBS%&E6&1@7$ph#oGCn8MoM&=$Psw%#4_1d1hD#&AYa*1Mw4J4j4g`8KX;-{Fz^j2Q
ze^T$)gj<jA74*iOoa}Z>U(Sy?1FRnooN;2szK${#DIQ3Gc+(E88Z`S26>*}mFx~Tj
zHiHQw^Tz-eMv%fQO`;!NcOoc{o35SQx}cyFNu5_r-u&3#*)f`JcjeI#In|2Q==3dt
zj(PXnLW1iiWvSh@q?rMgw%-q)ge(p_%xM>%)IF{1jDxce6|EK8_s6v}@L4iij;*N*
zKsnL#g`0ctq*7JMberG$IBO<vpUZM+4t{moeHJn4-M=K%!Bl;)X5<BPp9~?gsEUTp
zhjsa@M=oV-s8rgW@;*UH_h-DX7R^$JgtiQECCYCt-7f~ey-947Nv~0EHSBRV#>3^z
zwcDhiFrT7)7|#h!X0?Esw5jOoW(H*+USv`Opa|b+%KDp2(UjeP@wRkpd^Qxa-#1Dp
zLNBcXD-)lsY^1rM?kx9xW8ebanuWZpWeM{_Vo9B1ryQdiG{&zy@Y$-9cihX9&AM~q
z?U}c?NN6LV@prCbW7A2Ld}5_bfwm%XLV;A`nDb@k1FX&>&eH5k40&HkeK@0NKbG3L
zH$K?cU@PFzsuT&hjYF_n9vHU+g^+F{4w87r1C00r-RQ*1R2=I>JGcACOt5l7w7YS5
z^T_76U-GTwpQ(<4PeHCX-CtbL4IldAeDC1i<2OKdOg77bU6Tm#Hmcm6*3Fd))TV2A
zBs_&)Y`Z;Cc8cB*fH*YFU|~Kxw<7xzHZ7^VL{7#?!_J`N+KY45(BfrY+(#a&w|UAJ
zT#E}tTQ|k0uj1(!b6BHDpOw;&o+DM(1ETTkgEO^Gws(86R!(iDJP#l0y>2LGLa^EO
z__jwg(X~NG@%ESdB(_bB%+=oeHAsKmZly|o;P7EKg@noTUL5{eLpl$W=SxU^ZGC@^
zasXDOav~Oj+(Z)&PR_XYl@4P(TIp41;};VS2DB@0X1hL2ySB#Qc(99X6sBF*gs~}n
z$nWMfhybolm3aO_hjV=d`QW~S2c4f`su^P`-F3a5qU+G6$5)cnrg|#3a4^bk7}2G2
ziWf{s$#<C2#AXop3nuWXO>d#EVsTc?GVfC*+oxYoWs-kHU*o;^QR1=rUib?5C+(1W
zpR_rfJ+i`}CA95TqU6<9<{y2NcDKTHSNy%7Z`GH^9vksHo}pKlH3A*qPMuViFpQRR
zSo?lJPEIm;z6Anh1Z1?Je><?cfz*NM%Iju7XW`<V9-TYDPYUjnO82GGlL9UVHNT+G
zQsIIU;m{wU-gl}oU3cf<9h_$!Bz@z-3UB$F5bVjWBBAB_QBaM<ghZ3>7_~aZa1ySD
z^VluW*7htu9ms(lyZJ9hqwv4v9q-thV#pztRt$@&`1YRHPyJ}G?gt;G^b?-xWTvaQ
zOT&ngtSl3~36Jp1&b{u4Wh@Q_wx4+a7UTlz?+P0E`+WnJ<fYRFDYFY%30qrV;Eu97
zJ$3CT<J8yXLR>Xz?OK)Zg`;ol{0ihXtLRS<@UPZiOf$gS0l@W3?jO!BLbKmXr#RAt
zQDR%;-k^=n7H<M18SA5jH5C>$kH#z+QZEuW{1efR7v|$ILxl6>$AXqT#I$O!y7xi)
zu=?ZOhj*S}Acj#<VT!7>KNX99_!@=%@B#b4Z`=`b0W1R+g1pqHQo2=`ggz;$!GH70
z)=vZ1k9FJX1dNM{{qFMk`>owYNWOK#@P$;}-=F>dYRVSqFEZ<BHof0!{j2^!+pRD7
zuOVz&Klh~HTleF4qyPcBv~k`3YViNL27q4yK$R-&jOl(a_qV$EGy={LrwW}epC2Rr
zd*MGPU<E*qBjf6_{N*0{H8vNoY`HN25-+@+i1~lC@(vf!%Gu`F{QqMg0Cl-d1(0~B
zop>()lML`b)tC_n9J6EGC4dL;pTYh86)+M2iFb_Ar2c=jQh4kFQYJAe|38rbe$<LP
z;Sz>v!07zV2Y+<&Uj@A*0a|G{+oAS*xxaTrz&(Jt`~UyR@YJE=?vLp>rGW(q&(ZN1
zMi!OJu$p)?!Q+lRCv&658!7L4Ma5zBRhUf-wHX$(yB{)3`7;f@(XJk?f@F5b&3mfJ
z5B@>=_x;KQoTgvv!iWHU=Nfh2Hdl|UoVV9>8Qh=Q3?cLUs)I*S`lDf>{7OoNDqDqj
zs?kmfH9)L}g}vA7uX&zgCjagCcVU?CZ3lHd3^M`p{)cy00Pg4jOxxH%*fWbFrg(mB
z`Ucm|=L1<$krNwgBYU^}>s5GeYz?DN{3{{Ii4QMgmHgjK%0-A6zx-p$Y+(YF@H%1H
zIAFmC+@nrxl)*5S!{)^70SL9BnqD4lgC%WX#d@KE7L)^Fdt9^dum`{8*R=G2u7K*N
z&bMWgmF{J?&+pW_pFcnIYL_TusA1r??CQD!fAW~_%4f2%r_4IEga!;8*;0eb@FWC4
zwXBP_IJVaqiS{Nv<}9c_og3f*6i723&t4|RT993QWfG)mm=&&g0B*XJtQx??H0)fY
zx_n-2OF!YP_~;M}x~eq@`rx)ylLAO9=A25qdZ4*FW~0&D)X%JV*}TSc*j~XA{7Uz`
zqZUqiD_PyEa~c~7$u%kt^uKq$yJ@D)QJ}32NHir^*&o9PzQl+6C)GK%aAnB!%@Db(
zbZ@N98CqJP%N^<pc!)fX1_2tSxYTWM80BVk-)`2raQ_#jKNl5~w$F`hFgMMu$38xn
zuTyL0B8}x&jf0Q!j-KPRbJE16f*bh(GN#j^Rg1rcbE)Lr6?yLsh{8vR@N7LywU{n0
zcPlS;xsM3@ej)ilc~4=~k#lnGpz9c8lWj-_phJ3Q-KyB+fX#88K6c#VTY|`wXfpWT
zy3lTYETAV>PJ3vThY6^|xjC%K8|d(91;fHQowbO=<^aaDZs|dq>+**3P?ruu8J+@u
z({!g4dBMY-mNe}q=5ZV7s628p%_`!fpawxcJ(W2ClQQq>#cEH8#4T7UvZm{|B!wv%
zdzVao17tf#qdGsQs$SnytW4{s1tquvnxj|6dg;2Qkn}m;+HRIR3nk5iAd1=(WdG^F
zE?Ra&Z6+~}NA)|v@V%Rlv((B4sb6sU+coV{krMuQEWoc#$d`}~ST}^LQWn50Kg4R-
z6sLuHtnZ&%Q8loG;NpUlYl0iZ<@&YWR^0i^h(tP*zIK2ztooozyw6d{D#m1Ucon`W
zwr}y^!)SLzPC6jt8YK$|6O$;a;G5@eYTa`x;IkKF^Xq;)eq_=YYpq&R2jYt+D5IZG
zejK~YM5kc7U!=yOX)6__@^STZSLXGG#e#7%?%k=6AL4z9_|r$z66H0WT2D^A<}NqI
z)oHlQt>n8mixaNhLe6c-PFQ~on`v+EZa_S8@77L6mXs<vWQ*QQ;K1p83yT#RkD7g@
zOWw+nKbmcJB^2e+{+>BRF`bP|pC9>k%ipt&xEstcT{qib)^z-0gum)W+RPMDUqvmL
z3!X&S^~r6cYj?<IlIhSisJjOvZ+!>vSFini1<-bgdWuq|<AJ`5!D@yHXuMh)0T_z?
zdxlMZ-X8fMSVlOWM|0r9Rc<qhiJ>Gv_VbiPkJhpcm9bYBR6lMPD&V%8?K;h72R4xS
z8+2Dc5A5c*H0~8N^u&p3*S&Px?R_iOYca762>(T)LY7LTi!(TyzA#NPXBdZC2RZSY
zS@-R{_v>)PL7QpEeY1>Uns6_&ek7FFmUml6?USiv{R8*<^x*HuU2j(>wY`$!CK=cb
zUX;2vjV<%D*8_xnE9)WZeigfPxmlybM0fHqV+9f+H&{jO_6ZTMo=G+Re=U+rzJwQd
z7D7rXJ|JruHD(~@YAW^Cn_F1`=Xn5XXfT&0BDc(~OH|f`H*@~I8n+^MMKE;s_I;x^
zTc0#P_e}%?e1W=Cpw~V!he5f$xY*J(N`Qw}u20sXU<~;7K<(vSvFG)RK`qws8wd83
zqHl1SbOoaw&K89x7VTZoiIb;^$GAaebFFJ9Qb8}0JNTg7X4TSOZ9beC%oYXF?LyrL
z?J<J+wIPegIu&=vUzOL<(X5t*xnDiCxM>)y?*$bZS>j*H4k#0VhL{?B5)WWGS6w$V
zBBE=mFsfVwazDMlIWMZkt_-LBqK!^hT^KFkrx)5$(g2g8hW*l|aW{3@;Jhr47cR%&
zudv<KZQ15i(foYiaHhH|CNY7^xU+xIt^no1`z(n*{f3QGLAYbb;iTHSSOz&SiwuC#
zIBIf~;p*U+X^ymf#}B(6qYydt=i%@MFg1i8saFALqaj_2A4wn|sBN~=WiyhAfGiQ2
zS97G)0-;@wn@*O=o1L6C!|%yf{pLQl($|KSRCYQOL2eY%K*l>*6I1M^Qf0TI5|&hH
z;(PdTKuDD-SZA5yYNEkuF-uyRRP#s}C+&63jBI@3GmFW{$HU|HXF9thHJ-P_f*ZB)
zSte)JiOJMK6-Rvp{v#^iU@HT!O~~TPW_#y`+TJydQl6HQ&qq<zpvQN@6TL@{q|3A~
zlPrRc1(gpr_&s;?(XOZyad`0U%@e!&xpaK8iaR?aU&q^m)x<0Hhso%K+@7Z2_87aa
zu0=okhh6v(12`Y49zN4~<RgrO_cEz?h0vS#{M)Bfkm`m89mrMxG`^`5nf;oy?{QFG
z`pR>7PK<~~FCflDJh7u#vA>ePlt$DH>RGpK(i(X0r9x?Rnn!gO+nd3JEdf`Nw(saN
z7{_z?%1uRNAtdd3X1>jW6{PB4X>_#4GMYWw7;PQB+x@x1wgWMeR#=ucvFi-pI5@8L
zcV~oC&*p`g=RHPt<9D4P6B_HFe0@cM$<mqyLd2h`h@5gi^(|4c^EW)|Oeb|{npe<9
z^woX>N1O9-q;2=SNY^-dc4t*(_}w3d^mS_CTT55Iex?I%1R9ubtVs%)H^EGTnF&Vu
zHJV;FM#n2fz6&_w(*`9iC^5p8mxerFp$|$|SOeZl5KH9r`s+p<9JqW>jpj{&uYSsD
z#Hwbpkjbby?+-42W^E-(5?(qOSxz@!`JrGHmrg$MI*!##dfpN1ZPk*LgT%sjuGNh3
zHer=c9Lkps)-#D{jdc*hd;6mYk2eJ&w$jOiON*90<Fla67&N~JkKt$zNucuLjy-Fb
zVBT~7XL?0fync@e{IM_kQauvBx)=U3Ljh>eUCdm-=iz{H*@Qfye7=U3kB&vd@o94b
zk0--Z=nJ2Kv|hgMD|G5(8RlKdLy5?~YbcKwCM~5SE=&6FT-V=0%z8`7N_3>YaEUaw
zzyx*JtF;DBkdGEDH;`m!rTe7~eQggX92i~DgEtBWzU9{}aC_!oEba1R6}-K7lr1-o
zt7s2NN{nXlhP_518weuo@}#QNtQ!+GBt`p@Q#}j*D*T#&a^n=^#$qNl0(0pFTblqE
z+DUo*u?A)__v&-MI+##iibpN9t2vj-nmbQqV>~Rb@J!Zv)BA1v%0l+xaUqsO`$AU)
zucLYN&D$J1?(;4&RODgTziMM?{nw@xet4k<M8!=*_V{9IyA(k;D>$-Ln<`w1!1L?1
zqYsmFO{lMHhEc2dUmKWtnXN)f=}^TaWQ&Ri0B|u;T0P#+X3qzhI9YP216aMi)m>TH
z>6J9P14rX<G_pkoq?3w|#`dfTi%r_NQxwl&1NOtS76zgg;icnNuV;`LOEF;-?4e59
zE)8@UbsF{_t+jb<a4@7h24=6TfNwOYi-;*aTk9Yr9LUt;jJ8XZS!l&0GgXTMgkJ~?
z{NLmmmYX}*=m;fm+cs>D;FGW}7S^Knnra<)-;N=K3`WHaB1lpX@Dqn#lcKCF6}jDC
z4E5q1v>0HP54G$5akG-V<J*5vIZ;g_k^DP8Qu4#2<sX?B%rSHMw0nj)woUK}?y4I0
z1PXRz14_bF+Y;X8;wq@H=1J=fjdn0r3R|X3-j&@OTpML%)d<-QSwOqQy?n62^4E6q
z$+vzw=#lEKJLPNt!XII&UYONR>#VmE*t~tka69AJIm_1=$WE`@m<zWk#H9ZiEj(4d
z)mD<Wd!TVEv1E=yr6kod5lT5cN4%RCi8KCv!wjPlz8>0gC7tKui~7DhFSl>0J|p5^
zO$jtIkxky0w*5Y)6D^PZ)~g>n)faQy;1AZjj}CBiUDr>$`_}{TspnRCt30=hEadAr
ztm=~5mX;H0-z1MlY#4>mjw(1?2mcV@`|Wmp33CuQF0{g5@c~cR`iezL)=NsEyZ9bA
zT>EOa7JE=_c)Phe_J8Y5^TLO?hh~PoMDmYO`Rn@oaQkAK*77|0qsBk`0C>VBNFaA7
z{hv0`Uvpm40|Q{P*mS-7PnZ4uRyYt)AWeKM&ldE@_VLrU!UF?E%*3<(5XktW>j8u7
zG0^g?cYPg?e~tLR)|>BFK<X;-a3T259rv$Ve7*+M@&CFTXcYB!(Pini#8G&lt~j7f
zUqc3F)KKzbcibz3_W`&Y=ZB|oOLjfNe|lSZhrm{HqTRp|D6ak<{^3gBBOs!V23(nI
z7V+E$flRe<PF~}wB}Mx-^$@WdLhPMt$?uyMoubY*&ANw@Zz1<f&H9XYw&>N0A^E&0
zQqta7_)Ua^39?2*0+*u7TWGAWui73JXVeB#d5wJX)_HZ9N~AfMQ_aovd?LIhjKh3C
zErfG_t;&(kW&TqWz*w(v;QQJ%zyS93lLMP4K9jSrh^}-Pjf(B_y7$6OLV}5DQ+j}W
zd!+FNkOEH943i56=3*SVefzfcMl1vg(}CAEiSfOUe?W-9^bdrr4K}h5U;~*0QLO=A
zzHp%eq`bd<I>d`1|EB}$O8@{4t-+(*aSsC!JHa3%1f3358+#n>Gzn$NdzCqZB_t%U
z%u)Dv@20K`g`%r;XEQNecb3bXqo8n+7kg>D76?EKm?=pJZrjxXV3b@Qsg*}@i=A;^
z>ur%yR(!_aK1{dG2W`Z%n%TUZDw84XYLP0j>1H%BiRO+UwoX~v4SP~29W98!941fF
z<$_@^^SO#9hxqgHRPQbI3DMK9efx4+auzeQHltK%t2p{>4Y0Z*=u?8qtE-OzjY)#8
zBqAarWJ+rt<A@ZvSs=V+J3V0Y?OS7rJ*%-hdhUIH>r9e<Z;Q#>U-KFdm~?6KTtOG!
zV!W4+OFr@$zlkq7I@C0z&XP~mWYG>fDV8NC2mIKbah(zxz3$GNh1Z0^+|K3A4vvu!
zD97P^TfR3CR?F_S2Y1^Z4!9iQ&o#Ge^WudyLmb~~|9gYLH1vGOc#SGa2&+4~A5ra;
zJ-l$sVwK%e2`Xwvxq<RN7h&4$7|DKGfiFXVU<1OLzn}-`?%z7t+VQION(a~^G42dH
z%nGe`2s9#H#oDSnsj<5hbT5g^0iAQNg^bORS}XNaC<kUAki$=td9gbW#CSa45y|(k
zAm{XS%hqZV?w(ae3(Ar1TwJ~W)dQNf!z&lp|MtDjJ}Ffw8IRji3XnX)X>Kd6lFeqU
zB1u4^%a{p~z+=HFw>cKuCqvj-=Q6Dw$8L6mfUy^9M3T7o?VDu21t4$m@$Ny%k+IE0
zaR{+R5s>CFc;W$(Vu~%2P_tC!vz7oLf}jN_db}|yRAEyf4{pjGnBP(%=t==7f<hRx
zX^CQl>-ECpi)@%ZRpec<EbARP;pDoyC}K_;mC_2{AtMdKMZiT}QBf7a2->c6yVcm(
zAV_}b6dzhZ4=!HX&)4E{IEK4aCI;o@5esdIJvm&s72<;Ke-ByiT~->cnx(5E9d?LC
zZSD1oxt~wy%+so|T-je6)6F(5l3N{&5eC{`YWPK4rx~?ODpxJKT-*!;WN~3yW!m15
zz-W2{FATWJ*rA!jFU7R_5;|ao3=24S0C@1Hd>{R|9A&M+vX^@3rPRwAZBZb@FY1-$
zkmZSE?@2EX(<MT2A3g(ds-{f*7L^D3`+Jk;n#>?%$U^?e+p(&Qo?Jygkz~>^eEHV?
zwi>m7B;5%dCwEu(c&?zpK;A;{FgMP$?uF|6kx9JURQ`GsF77_k4jnPP!>z5A=A9!r
zA}5@$YV<4e`5=mM`%t0GDuIrX!J$w7yO;$!>qiTtfOLBj>o%3A&p0&|-s;z+HgT~x
z6rbHvQX>xpjAjmjQQGMacV5q(5BDM;JwSZn#ljp)h+njJIM^6(6$%-ybv5v(9dNRm
zv_JVa4RWu`IXrGPkQf)>4{1sQNR5Tk<Y0aqASy>$<#UsI|6s_fYNP0v)m@YBU=jgV
z@Rx>#SEpIUwpW3b<#KH)@Z-w!J^aQB@)fW6jq^lqr@aHIx;<C-6z3><woKXFmt}4j
z?&OSHxVT)mio818K<<cGK~FRgAbPqz`V}TH*~6&wh+;J@b-!w%?x-uJr-!fVJF)kZ
zwaShaTAef%BCN!aOQqJSWZ&V{R$11Wm-h0f;+3BT7xbmrP3u!aL=@p{2sV?}jc8@>
zCktmlx|iMP9YXpVlf}?T8N$edz3lsu0<+B`F(SW?r6e<q_Dd~nhzHNYfFtc`tq-k%
z$5vN-=H@v!Mw2Uw;%JmJpJ|8Ltm{N(+5pQ+!t*FLX~BfNj@c&tq2#<d2Y!s&9Sv9W
zXeOOPZ$Vmy{GRuDdGWntf%lnWJE^LVir^yFG+>3CF&4gliSkI&tULLb_bN|zsU;Br
zVT*&$apw?Goq8*tbI7niwKl{c5+BxIS#=Bi(y6e4y)9|9#KOJ9I(d*lZnJ)3oHkYm
zDoWG&{G*Z4vnWQ;^U68L6)q*~bibw%m^SK@QJa|=4$)#OxIU$p!V8>g;+d;+Kldgq
z<r60FD5p*KX!iRToEpW(7QJa1<jqF8mtlhKs!*s1`<snB-<9R&&5D=-?a{BaDeajn
z&z6U@jZy}tI&$v$`VJA-^k~<Oqq*OK7U<iU2KTp)r{(44tA-bnsgm0m<Ewh{wFbN(
z&eCD`xLr?{#;a4eD@>P4?%!VS&0!1|M7$d7DA{EtK~4FdDJ>DhgiA6%8=45{)%UG!
z%<eP97aQ;9E2Wo5rAJi-+i1fz84fnb^DQ)+Xa^i`_20X(2WnLRm^j-^+baH#apY@A
zFMJikDp*Mm_$Bc~gtyh6Z0OzG9|twg2&^1{y<wM1KMhGo(SS?jJ%hY}MQKxWdgklt
zu0m;m+M!$ryD~_0X%kr8kI^kMOf{Ey0|XBWJ$`}l@|Y_9okK=0hu4Fn4DkZpV^@Ft
zj<68<b(u)o!N6|cAy_t~ET{Qh!=#%}q`6P_3&`Gn0E%}ngS6hkL}9h5lVs@0;|(Ci
zX;_Z3SoC<0h4NN|=~3yK>iWk=n<(Wy3EUvd0hqGz#7SIhSsq9}nft6Y#aXVTH)|ZF
z`FzeOh>-e0{(c}4zUKp7CY{=}8P+F)=jxx(gC?W?Der=1gBvq)TOxE29>Y@{5^9(R
zF5eMZWlqh1Ex)w<OQp5u13BPo>&vJVy0<GUH;=bG)8SiNh4EZz1rMskxGc~r1EY$R
z8Dki(vIem*uc`)%bivfL)%{sr_N2Tay`64@y7Pq~^Rgs5jj9A3{qOFvo?F7R3tR0O
zev*N#bof=Gu@d;4!9?af8pUFSWURG&QqiaGX|u~!#mk{_X4Te}L<Q?)Ly)ITzgCzM
zKtfxJuuIaQ1eEPrFu1s!m0h-lZl}c*pRwsa*J`3RSeJf<g~h8Hr!mi=qE>NCa>@|L
zpu@fSbvu1UV!4#B+*-F1Vh25qvFVp6loJB-om)1w@k+nibJEdeTahDik0i?1puy5=
zbtmu?JQ;HhX0i&II8!iMWY0`{j63SQHX;(+(EQ4*@7epX*=+V*i-H4HS=X-M$&$Ev
zx4b~f*MyoeYS|Dmgqq{sCa}s~EhB}!1Sx|8a*iA{31FkCZx1!($8+wv?B)ktQ>&95
zP=S`~0Ve#@R~R~$s&-4!Md|nwoGTAk+W^$f!kExRhoIDNCZlbxHQM_$PW4{%*~{Id
zDjao^_Q1fvlVh<6T~RO##d%ulC=mSQkz!FB$gw$Gly3k}5~p&~HI5vqv1l2zkIY>e
z87MTnF^(M)uFc}STh)C&7B8C{eZUP8{h2@+=wn|h+7D09;?Lj1K6G7Jz$RkCv8Lj0
zq3hRIg^nGLu*Yz2tFg@r9pm3%z6}KD7;b;c2%%ce>CMhbW;g4L8{y^^&k~~(8UCJk
zg==^EzAR|iwCRb;)vq4aSKG8w>H&F(h%E~i0Rb+>@Ji<cSdmVcIK<IGd8dH99^al$
z-JdUb{kbnFgm46=^eC4ge-TVHi3X6eWQBPNfj2MxIaG|a?k;M0%d&he6?^5}r-FKM
z^uD*+emPCh3$|2}Nqm0~x6G@5an-%%$f;^?S*5K}9V#1)Ph+D=G%0=6oA!p`OTh3|
z_g&hXPN-brv@ABAppP5@Emo0F)RLv)vd1tI%Xf7(r*tvGP{fFokscCq0vgs@n2smp
zRgK%xC)j!{MAgH^-(xK3t@RzXZ0&rLN$0(uehUzz(4dhT#f;)9g=e{V7)*6<EJ2b`
zxKFlJC!GCLqJRLR<J{@Wv!nLvqcoS0e{MS;rZ5+Vudj^FNLW3(lsL5jxwy(at?_B7
z1&k;myR~=v7y-Cz;A(q~Ge2bPH}R2iWFvM6PEstZYj$Av%)^#2@`*CfJTvlGe*UgR
zo_tPPf>eGmmIoJ1Bct1mVx-P_b0bll&FGArw~*=ST+~c{ApKYRAVv7|djo?#B|G;)
zs--V3=a9b(RUKcntQ}Upp@p5q<7f}4PUQ-wuIEB>$LgDQP3Tr~8(Q3*1&Afh>LPOo
z)cL(bi`VZ{BklJdPq&_lgoVVzRU(7saAgvs@>IkqXu<3@`v6;kF+m7!JkN@iiT}E5
zY3{RGo_Pyk$CkA}kb8(%;c#5eEV4QFF_l0oRT`CXV{tWBM{~_@*qgRsY|jpL&Ma{o
z*oZzqPWfiD(4n!|bs}=F7uCZRFd3W^uF?sPUQHY=&ldGsN*o=9TlQ0e2w&+03Y@`W
zp!=&s(3dh;PSK1>;1t`t<9&fGVj{`#9`&lcER*CFTM*YlOI1fzMHPCn6K*~Xu0ol<
z%Ds`osJ#j*=$|{-7%B4Zww~S51r)LvL?a8zblfkW-%b}AtdN>NVZr@%W}MT1pvy{j
zr63S8C#2*)D`6qK01p&&g%5D??+@;#?5PXQ6B5$sO5=X*E5v!dl0HUDlxm_5&`@IW
zw$EaARzb;L*)1YvmZPs0N@<$=_Y(42Tbeyjhb2(NTmapDP{wM6PWNPeOCh3qsA4!s
zhM-HCtw~k2|IlrUL!g7!`%6RFs@M=4$GMVf;D*hf*4fZw{7V4K5!Q=tQ_Y6DJ&e-|
zfQ>Jn9kl>Q*mTSnMb|F_<^lzm@!v1?<hP6w_0^J{<-910TMV^|54pX{Zu*H+Zp4)>
zi%x8$kI&(>S&pIEtx8B*J?xgsyBfWZ`fXC1gR64*{EE^Qc&)qq^f&V<xoig1kcL<}
zC>7XMxi}()XDU6e$g$WejH#KKTxPk{$4&j}JYnrh-9w8TPo6yKPnG^6I6lC_3ruoo
zedCQ6@xZN?PBc%6gsj>L%xtnS2X0>8r5HXvQQ78kjAO5Mw(RqSVk;_Eao6={zBa?G
zdfAaAh+60*Im2*`hg(`$dIJkF$uBz(9{6q59&LZzCEkTH&@q;YpmkrElhWyCFpRh}
zUS>kkG#Jeom(}i)=R}73s#1nDG14qwuQ)02uiC+$YcFW8U9N8-=6a=Y1@SAIgP*~7
zMl5LM`7=UBaqoSu>Vhz@(io|g_c`(w%30WzNrU%^F2rPARxnq?uHx@Gdam^8{dF~_
z5fz?Z4#Tb;&zr0sb~vHadg@P~Y;=LOw2Dk^HGRlEN>6^=egPzWV8wD;5A=FbwqAh9
z5E$^mBQ1~o{+m#EefZsXr!+7HV|usWlpm*PfS3y}>8+c;{qmnZ<pMo=>I@(st*19j
z{>+X07XSo2Ve3vq)|KwUzc03zFlkgDBGP9~COwjsK;2cpKo_N`OGG_1s~#nq|4ja$
z5YEq2`5_WOYN&`gF8}Jgf8%I07pjkKypz!XDS*k2VgB<8^(73<7As#(+%Y=-#av$_
zFh!P^j9Z!gKzsCnCzdjh?O&Am4C4%!+UDw?m7B7|qW-d7p<nvHH1h8hUOYxemi-Su
z*xwCw(FQs)j85GB&!_*4-KYlIKH4Puzp`;(@@>HfQt|x%tP&5OUukG;<bzv9vgJt>
zomAS4<H&yy`~l$p9zWyz6u8~;wk8oj1F+L>pZf8ho-ph>a1Ml}jy_fzzv~z|g)yQZ
zcaV$Uo)^g!2_$_2)K_XdN_DKzhzT}@eR{N43CMX@B*~Y9YLZ4io;AmoTqp?Td5qc$
z%?B5kFOhJ;gusYTWr!l{bBpN{AUd2$2l1*a&B)q%qp1AV?`-@Z^SD*K{?Rb>jsL~;
zd(U*|!Gj8bG@|Q?CZJYdntOlm^`tu=HS^Lj%PdEDiHW?k>8bv4XkyD5t6A@x<Po@+
zU1Rxp<>}?p)z=4;I>jzu-q3h|mQSoYrX%b9EX8KO7xrGrRlHOpMYa-0uy#1VOq<(A
zUR3nWMfK`z&pbAKeEj@zTB@Q$el4oMUOi>QU`+`hzHY<=Ect9qFCGU*-AX_}5;jk#
zW<3rQi3U|O=`wf6e2I{{hd>|#JUNPOk@{#*LDmWH^XeBOn<s)sz4f?4Fx?WhGGdO&
z^QrXZx^t&vC&{#~_%CY&>a~#VF%56xPH%FqObGI%4QJix(%-QFP9W)HKUarLx!4o=
zNv_*#qwx&k%JI>0nh;lXf2&$2$>O&)UFwG|CKR4`h=_8oiU>X6J}F5BaI4-&VDIhN
zqenJ-OM@j^CVf%8VmmZXw1jB&PVIx9RhGEo?{y<{<YZL0dc=)757x&UCtIpTzxdd^
z#RUL~-sTK%26L6HsGSWNf;QzkH4ZC)No}>Bi_eaovFOdSc5iq3H(Tgp-vao$GuJ*~
zByx8J12G{qFCHE)$SE)}8RS$uSu<(XrWMDd($4^nHFEVe_I^NsKaHLhd*2QJ`?wpE
zCL^C7e@^-$mc;9--&1{R(xLO2eP5v3>B^NkWWIk&eLa!4tPa91zR3?z?dz!=Z}-O`
z)F?4?pDN2k=z2Ca_Q}NVP<XL+wDaw*#r8!Pj2mWs$)dRB)V5UWHM&7E^m>1NJW<fo
zjf@-eE#+QI7=s2vka|mVv7G7n5M93BqcK{hxV`i-y=7(ao!1)5d=aF(I-KiR9ZnUx
z+7*!ar1xKug%`H=6+k;X(I*B15aDPvg*mv4W#iFDLr-q{*INt$Wa4VO(~;Xub$g?G
zu>iMH&}%K*$*lSe)s>*JT!bTgZZpP&29Vqk4@x5pN-{cV0*4l7lT*kREM(Yvq;O+t
zTEu~n$-%ihg36}$Z1eU@%wo(Q&f7pJ)+_*S?sO&z1SErt@F)jlxtO0RoEQzBG#%Zz
zFRPlOw;Qe56}KI5*GG*XeIT?LL90Btv~InmgNuvnpM|o@_b&f$wBnZN#Xc+Qx(r}k
zN`dvL)#vM)oHpYy&s8U~5Dq$Z*K@Bo;o%OU0N2RI<<PUw3GuFiVtO`QK#LRHw;%Bs
z)d5pJ>Kb?3bAxF%!O?qy4(Nz=$0cJCPB2(3Im8$X2fx;3`o#%OehuH&Yv5Kq1l6`i
zZz=~Xkt}v4-l}#ka16?9cA%#^=bb*ObZ8b{?#-Z6%q=yu27BzTPho79dTnE&^xPW&
z^!M+L{pT@w{o){fQ3wGJQX0vr=8#n;PP3O)maYSCoD6&pQS{Oh0I@eXkeT{fHu}1>
z-=MD5P~8Z}inl@C>8s#!2^)`!pn|82Tf<v6QLqWy-Gz|cd6}I4;*jB$eUT1eTL>QR
z_>M>HHsq38f3T2vTn%xzS_-(V1vgF8>=hSMK2Jcn^>KRIOjO$JH)M#<0zf2*Dma)z
ztJK4F@hlzSAG+t5J&9Z><RtjRjqYN95i6U(AOOg>1m0mz>lO>br{F=i0P)W8gW9=}
zVTO1vVwyZ)6OoCcO-J|#-Iv>3s#x9(?hhdu%*!qC3#P$b9R`1H<2~m$TM1&&Qa~Hk
zsLf7I=_Tj~Mdolf&j%5{er-cM8b->SJwgV9S#w@WNKCW|;CCaKN2LhQcD+GPu!y{6
z9Ipa4Wkp3B)%|agqhOmy1NPhPvF(TDimybPbOj%vhrewCacPYQoZ=?Gd?!E66$MGa
zQ>Ab%%KEPGL$Pab-i(<eE4-R-5`ou|TDW-ZgWB1WNWe)_zWV(rU{idh$dRlX63@Q9
z2(aw;6Tym?BWF$fVClVzyYo!h6cQdhP@`2RMn)J-16?Z<E9+zX^9g}wcKo>z#^RHM
zp^NBl-Abh@S)Rl_1BtK*MiLzp4U}qE0<Ys?&vPaLt*uwq)!V8?_5+Wb0_%p(JDn#e
zpq2+8!M8RC)8S?|P^Nybk%&o7s8)Pui^-vh2>u9X+$p-<MIeRMVSygd+EDTjfeH$u
z56Z|90XK<L>P!8QZoFy5Nvr)9ddU2=??D6|d5Wt%*Z~l}ax0{Y0ok8N1-~L-aVSJY
z1NZNTu{RR9ojTrua@h;ba$35<irbS3mG%lroV$$&lSioNWXzqp#FOJ>;LHl<O!hc4
z5)~EA;$%P>%w~25c%tN3P28NKvNR{kawE7F@^;ItHXrqkMK1GOF5MAxcdSbVQr892
zTY$#Vx9C85``QCIf#>oGyyN}qm0QZ0-GIW&1P5*8z_>rG0OgXtsZ~y-Yd!j^Ju`$%
zt8VTCqs}CJLNygP{d8iyI^fo+Br5$f=1y=t^Kf6E%qaG4qFm!m)TYBxFXg!pzlh)|
zzwx43Z)PIP`T_2ww}L943eG}6kx+|eBf)=dtE5ulA69m-Jg&XK^2engQT4@tS=p4>
zJgrF-7xu>AXRPq2d)yu@pUuyf<}TG<?5hzpg#gEvo3IvMnl<wBGOs)}@xRT{zyA_=
z##afzGWF=^zWVQd;nz0tP#zc#J3QpCPyX}jq2NVua(Xk%Z%_SqadsC;sKVb}{hvSB
zz6g+};0XO+G1_<DUFb?Bh_e4~d;P1z@4^63>@eF75HI<6*?+$kPPnM$(=?3#`2&wD
zq%#h8S}y*aMs=#!Uxq3yk>Bw|MH)+TK6yy!A=pR3DfvEKeZ#Md!B6wQ-V5lWeJv#5
zDpsnhN4}Q0@3X(x(O+&=a^J#ks>hD!&6UYEaD{N7nBMf?_4#M`^s+7iGX1Hhz<|=|
z2m>JV;`V{^C0<G`$@<1|)Ylvb*oO7o^Q<{%OpE_o@%7}urC~H(6!2vVKa8Zcq27aT
z-XtPbW(|n4;lB2ilCRL|zccGjAu!&h0@9@yU9FU};qdW=tFp`9unWbt=l5wU?{L=P
z{=e1mkMDliEL$!>-%@l34gUE0{ll$Ja0{-^O{q7&4**{A&rbS#)+A+L!hPhCRs*^4
z^nW(>jZZz0U=kWGDX)u`al1SttG6^4vN&NC!-NnaMgYk@dRM!#Kg)%q>zF<3)(p4C
zj{*9Iy&dG+{JKis2e^AP<UB(p^uNa%ATy8m@G@`e)8!u=*QxC*tUOtCv3;jP;>jV8
zEbi}ZD7M$xwOS5Y`=3^>&&+nd{;Tf4w{Pp~m2W;?`lXN`!~i|zsg?Y~PAY3^C#aet
zE;;?E_xe<mR*rH8>{B<J&WN{tnu2b13FLfWs^?m=Z0M~ZlU*mz2wAHMxH7s_x_A&S
z64&2WSbL9Pc`at&%dr2GCkR*fX6pw=xg71-+=X4GsJ;B^yEhKB1)Wb}nrK&JOU3_(
zy|;{tvg-ms1w{oE3_@B3q)WO{q)WO%L2?+7&KW>NloaVMX&7?olm_YU?(SypGrs!0
zzQ$em$6a^bweJ1HVrI_soOAZxXP@1BK=t-k++ZwCXx(~q@@SaF`0i`T$y^5&-GCdS
z2u<0sA*Y?j_1x=|(gZ7b?K43%PN#Wv#e>9H^r3Z--4CmTlyZ1R4OP9#GIw$JU$k6g
z(vse}y?;M5N<ZmNfMKSghRL%zj|%k|BAm9BaR2gZj!A;GUt$%+MFGqPb+^2t0U%Su
zN*8~BvuYQ}6Wy2J_f_^nwV3o_3%z5-q}Mp$bJN?XWqH1E`DkCTC{{J4!0+>NVZg&d
zY@4H25BI^%x77*^s>Tj;zF>SURxavkr}+esH;#Qy$f>zQ-~5zw3T%Mnrm1R+oV-4o
zPpY{9LNw-*m=~KDlV=t$;ZR|4KylRU25W6^k(R@`qbmulgXx-=fi3pxxt5UHvpFVE
z=LR2%)`NhiSnFaO#!WTKR8#M0j2l3evkUS}Sq`%51o2|MnO!?=WGG-tG9-5RZbSXA
z2ibuSIL85tA|NEq0&45Mf)%A`FKSSU662xU*ACP4XMo4bPZ;N*eL5ncB(5B)1l#lP
z<z$+uNc}pm#;atvTSoqbyYev)FV8bk{vq21!}3<BXroQw8tfY5n8GCu^fvGN<p$!5
zu`J3Q_F{^Ho-SH`WOP>?vVgRF9_B(JjxfLtM{CQY3ncO@nk=6$S^!~%iL$;)rZ`)6
z;!z_HvOONh<F*YnzHd$gq?~dCo9B;;7AFmIisQ=E2Lyu*ldt0LI;5@bV<x)<`?UWi
zY|uOb*r+5|Th?tLT0z1c5auUKtrr*Ls04xvIHPPbt%j91hKF8nH&z~(Gc{=ilB%jb
zI!qcN#F(PZ1r?%KkU%+>HdK8ABCtwr51|=Kp(w^7BhS|{m20S{W_z-1?AWoeDsy=5
z^>W0??dMX3RKK?Oj`c`vbTunwhPE$DI`aD%+Owj)@iQ}E7Y}*_2Z?$`*|SMz#E(u>
zo{dQh(}e;tb6=0-+u7u1;fBt<^pZJJb2frDG;?0KsjbIGwD?mA#HQfBJB(u`#mn`!
zmHyt6$<0SGx!1#PoSn0m?)<`T?sH>qk=3*uujO+9R&O>G5%0^WR*gK-US5mSb%=U7
zeem7YMhslqcb=X^<v=ls6ny=r3mj0}5tz?zO|3rzcQ9u%nn_nc5!>S$wpQ+oiH-5o
z*+HW$F&cce{s=$qgqH!PAhkl5TiUF%aamJrh*#GIo5T9&j~_<JtSdJ^T%ZPGvuK(e
zH#(%ej}4{C#_yL^E2ZneKGxwp;>ZBMvb0`1jz+{5)B@eG0pGJqlsC6;0uCVuM1)^_
z-`FK7EPNKI%ED1ZY)C1PdC|B{XFouUKIXV!7-m|kbSSKtu2YlwF()&fh|;)efO7N~
zPJ2uI9qJk9>&JZQ^yq+BPxrolqc5FG7DwZF5qQ-NWm7hqYq+yhPLr7UqO=D90XNTu
z;z8{J-za?bMfnq}kxU$uWFjKEp1X)I<fIKAmD<GnIJMH)L1ADQ8rtl8_DP?Hp*q$n
zukDH})T8;Ml}yNOjUC>~pME)0<A>$~0c+kM*W$Iek0WtE4NS!I28a%J6+hi1BBz}{
zUda|4?SI5fp+zvjk@9k_C+Mnju&}3?lKAK7YA+sn@JFt&TSmpdUH4P!IPWiPn03Fg
zX@vZJAiEbRcgI>~4Fr@->@2h!oegCTV@^VO6E%w&(J<!Lhw`+mp%xtAks%i@15O}a
z_wm9Nr8h~S!HyA_@WR)K?9D9o%DwZ&xL$pZSV32vY>j^Fxh)!v!l@ef&GAa-LF3)y
z#kl@#&Cxy`_0E+i2%QQC`Q^?Lm@7Q_sb@aRsq|Nd2J4c{R|T|8t9kBi2fC~`wP}l;
zforM_ORLg~Zmp-?nJ7TpHJpy*G>r5?8WjrTh_(8YS0T;RWK(%(HSF``bgy03cEFWg
zFL~uAmAZ~))jl_R!-}@;X?&ByEXXQuS<QApNM^zrWrRYPO#3pfRi3WNtSfka?Dx7{
zN1mhvCqKv|Ggq!Z9@{T>TA22X>PD=%dylBG1T4Y|I74n_o1{g**BM%J*Z%o(L*Co}
zvB}_|RUx2#hk$4IYxp)0&A@9p^Y-Bv3=|?yCYUa^M#<~xp}bk}SLeBA`Gkb-T15~g
zSCQFp)+Kwyg@s)B)+$hc>-5ld_h5Z=5_0I_Cjfy!lwHUT(XoiU_`0<vB~;=a5Bz-&
zH^i0$A;bKn%8quHHcM&^7RwizymHr4WrApni>=L)nJywCy|tGd-?d@ufYkUv*>5Ij
z=ktKr@Q=CI<rZx^as6SlmfT#@33IvcspS^;7+R0+?ei2?ngP`2);S6p1md>a=B=rv
zG>G<(p77t6M@tC_UJs)2Fid<%#6i6APK;sHRl+YMFnetA3_DII?d?({Wj>h8PWzlI
zSuQhV<j-&dY{_eH^MNu`;@+r0i5ehrHPCQjW=0|L*@sV*QnImUt6d3krfr2L)y_^%
zeVM9=>aWgyX@Nj}9akXezh7cw>_XTJ3RDTx-q$}^<0dWEOtxBGwG7A~(6ObuTK&An
z#e&g-suvHp)*+`mX{Q&1j!wv|{yl?J+XAfFVr?Jp7i!Um&P<Y6MwBCnSQ4Y;8l;`e
zw%ElY3T@8V48Ln<B|QqWvT4Eb$(ey}oD>Zi3s|o!d>k=;P8(KU#ZWFDl3|R+327SZ
z_)XXNR0&AVuUx&=?*r~+i2D~$pK!TE#Z=XISm(xDQ`o(!a)?ojARyHpq(j9++RN{9
z^m?>tUHY0zhSG7Z$F-4r0hbC33JQW0ZT3H0IX<zO2)weq_`yz(^r2iKx@P@++!89%
zEb<@T<eo|m1O?H|u(AOnAdWjwVJ(~q?zoFb2HC6q;<;P!s>NxgFCB}7=fdc{YrlxU
zw>R{S?ur+jmcAzf@S>On%x`RLEQG!&E$h?@-;apOT`y?)E&evP4A@vI6eAodXL2DY
zDKg#P`7BXw*zze^)GrbWEn1Pf#{-y3Sou|%Q&el;cyd@wyc($ja*jpfFmc|)Ak*tH
z+|10)g{w>5NhyOsy0zfL&W9A^a8NO@wg%!i48I;Jz<kGd<xW<Y5ntoNEnv_08!&8E
z`V4wg{4ntumxl5R_^)TIRRG1WW}5<56FjG<r}4Zhjt#4UDr1oC24;4(BC{4RGAtFh
z(X?uLpsJo!7-L7Apq!WS=KI^aQU3ee+qO0~T195daL}OnM1_f29GB(HYR+Mykz`A{
z%-~8X?ZURSES=tO3!}IVh&B>)&zO-73)NANcjj}{@;(7s$m3=EYwC`R9XUs*r-PY?
zS_w~&fx3SBmf}E#u%-aSd`>mqV3s=EVp715keyWEOg>)yvfn+Hl^{6*U}f>T)dE0y
zKUR`VjJ`Nm0hgJ2bV^B_bk$8q{nH56RQvT2lg?n{A9>k7L93qTqmy1nuW8@%6Bt)i
z4^lZ0hkbV=!7Ixqp(okkQNyCqp=woZ^ehdy9#D|%+Kqe02ziN&`Mz}P5qnVF=al+a
zKarI<n|mF;aK^%+Wa0F^>&O?HB7>p5ttFkM#9T+h3A-$xe$!&b#Zf$CJv=;ss)2Su
zjY3tO<<O7Xy}t=dfT6k`>DI}+`^5&pWGQCalvSRdXGLYDnD3Da_5<mSHUr2{Tlz=u
z{Fn#?7N;)tcFq9ii)}O<n<^_x>g^_jXa79`$O8fV>~Q_%|7!w(YglQf;sy~l3A2YA
zp8P=ta$ORbPjFBrx^$L*wcG-cd<jUd;h>;?2jCj$?rtt9fT+}Gj}h<$bo|akDE2KY
z<hRIbA*(yD#bte7B8jsm=<Zg_#@#zEtAK{f`9|0qr}cF1s^kp6ln{!s$rA4exsc`G
zoM|<RK)myLpB&0vWMqcueb;GJKsg4~bijVq!OFV)Ha3mcqS<}P`e}I&*{^zj3(|zJ
z!<UnV0m!}|-2#s_lMO?t`UJ;+TPNV8lmLu!Ez4&4zj4d&^mZR<HkEx!<&pkpYs0r!
zT(Ys^iOTw0(zp0iq-xdG@`Cm^8v5=Cu(|`7$D=zQf&OL|`ScM$0)@@v@V{lpe~d;F
zaB4w|#!u(uXB&z;1qI;0LXWwT@_PpAKg*(^0vN~t4~lQ{(*Ffea8V?bG9#1h@0(zb
zl~`Agb@ewAlaTbhI&4-;6<^SSpU02{&A@G17j|VNUs<=^Ya2U=sqQ~JWvJ7{bIi-i
z;db=69mN;jE3>XMFqB3Xpk10hXwv(+V{Jw4K~0iejGLB@Y)a*VU(i9izTIz>vt@Hd
z4_%rs<^wY=K>u65*ZZiav<u?x0eO_SbBwtBWN)LOR`J4r=ur&rSQ*gaWMi5TtwQgn
z(5RrCXB4k$yW=5r4p1}jHcBftjJtF#ly_`oEnKk+f3XW7jg0gF<xs{!1^_$G_HF9v
z#eszUILo=3h-;}9m9OV^)=`JGW_kzj@-E~+R39dho*ix!l<`L5X;Q{5YW5y54MCFi
zL&Vw;o9Dfke?6<$DJ+mwcY2l&benX@N6nB-xU?5C#Y}!FJA88qmnzkwJYJ7Pq@et!
zad3_eOge?YR~-TvLke1DVE3lBfy_x6QSgQ;r^To@cVB!X{;K!<YohV0x7|Z&`z%1-
zka@o~fhLyDjbpQm+XkBDhOdoPMizmLzTRX%#u+la+xz=7`aXw%vy5ttO7W_J5vYqy
zCHmy$yu^C;af8!2Xrj|~I_=(6dR@*~*`Y4awAydXU0fbG-HLt7hIzm>QiE#bv5_Gr
znByy2txL~$GMciRqtv#%8n_+6u*mB-S-KX}Iy}Z|y!qDF2!{ry$tDFq({b*&YEN9P
zC~wGXWIf$jX{TR&?Uf~I-{+d)_%8I-&Ua#>kfWzhNG|3R^}T^evh~gRPdXolQemF7
z%;Ra#26(3f2`z0-XC`3&P||=Dqs7+)kujB|gq3QYZ<pIgsLg&gCSG!%L-GRd7?}Zp
z7kqed>kghH_mR%l`1|!#b6;KSljAQD=aoruZK-@q5=5Pq+Jc*z>{hEyP9g<LBt-|Q
zaHFf7H1S`JlLf=tW0t)RC>2s=`%|9!KVij=t*~qASoT-9rL7c>Y{?0=l#EmH8Vhh?
zHrOqlfM3S3nQ&Tpmmllgx5K$ftE&<gja^qSVqG$SWYN92^`4sHVB<Uu(1qySU=*v5
zC<}(U!I8h+4VM6TJ7OcbaR62PS3SsTc%g|x=Cj5q+nsw&IsAlaLe|HZuyKdGLibF1
zsrMZa$C^&rYSvxrTe0vnTnI-MAx_&#(*UL&R>g_<i-@s^hY!i_@#F8<_JihmRXbKA
zn0$6y>)eR~bO%Aa&dynev?ubmLp-w|c|`JWm}t}t2MQ7gh=}X|N(l;umn`4nKu*;8
z09(7T5KYaAjy;?4PNOv((?G>Mzq_S$wR@gRhq$u8qVp6x?ux^_O85o4spUOqWrDhn
z1l+zVo88!|u#IX{==(dc{n?sFXpCbOgO+FhRu`m|al1K@ooyZF>t>;XQ9f2>ITIK}
ze5)Tbl%kkwJ4lf><zH9?jXKf-BygGql<c1&|3mVvBa=Q)NS`&Tj3zMxOAaIzS=}4A
z&!eqTK&JQgA^pRi!u2OMS9nA60{~`WGQoVmpa8mOCn1<ERyuzz2U>jgYBA2PN`Yap
zrtw&R&#1I^dU}bL0-Ps|#!3Guw1p-HFVhe(b`TXW*sNj<^T+gR+BJ3lvPR&e8?L+9
z2WORoe1dO+lAXKna&N}Y4ve){>OxlfpdIHtx0c@A9~YHRdJ;$=1l*9}n=b4WJVwJu
zWrhbDntO9KTkpLB7rb;u8w<DDY3K2O!~$s4>XASNAGcO$R(7nNP~XbRC&iHKTvtp0
zHxL8quGSZ#HV=!^2bw0eFIHU(N=4+9<>=Waoi?F;4N-?Kqympw7E}>Vj+<{qe03}z
zFEAGUK>+wEW9^og8)}skbsTAXDlLJj219jm##2PqamDdVdF;F4yRR%&W^x^G`r&$^
zwnwEGHf(1W`@J#(>lPk*A5RdXRSuG2@(|&WsB={Ln(vR;h)4FNXX0-SgpM927Nq)p
zUH$0QpQaCW<VvNBtphI{_=u8VC)LV<<mkR?ufD9Z{>p?Kt1`Zl9@QBoM{daar?oDi
znnWe9WX4HBgVFJk_f`W2b(*Q1yy5)y09|Vyp1a&~dv_5y=772$UOJojDbVM%6tFv9
zzZszPa;b9Bg2vMk$e5iSh(<57u2zz@7xBXNiY=P|vYl!FbVKCph@}Z&=&iLU$5~f?
zX<(b2irFy<Ii7<*_w?<TmLs`Qimy%?r@E}wjlcM?3WkB#Ib^rp7;`F?Gp1g+xU+~E
zP?R&5s_j=bZo@!vW-4Ct?(}7Ygfe1Dl{4U-qJb%zPe^x`<>osvn&;-0R=Y;lF;(kt
zs+h(~GSM?D-jRB%Wyaf2mO07{_bPJ4s3soz7(o2=F^@{lik2%v2LMw#xLc=P%%q!e
z<Os{>ee3*uu->Ey{lDt!eG&94@7^xXA<k3M6g%{83r$U;0zL8kgXUU?d`*RKE^#Fo
zBSix>+~==V5;XgD&2<_FX&@u^M01MhSd>pzZ+jB-BrAtn4vz(xZ&qsX7t_+qjoauX
zEaqR3>K4(CoHT(`prgvImfS}ZXZ&GdWF;B#yKiC1<!2SWg{srD1eI;BrAtGbnjLhF
z*<?g`K3FKLnHAMdK)x!jhssiEv};Q7>Y}2W*66N*tz#y%DsCWp!shJc)NePe6;~U*
z{!B_UWuKnYbohf~ITKxOY%lAq=KhXdW?-A>I+k*bxyp!G!WMtOht!dXeVP>+c~~s7
zZDzOw{0#jJ=b4Ym?r#xB*ZDM2)2UK;vI*>+KCTW&auy(+FL$25IPZ>sQw2jGdKs+^
zq+mlf+HML*;VX~?a1r(X@cn#~LO(@*OInqv7B@BWJO(u8hZt)kaJr7}gHZpAE8Ohy
zvv2=Ty>vi1Cow<$zX-GdR|A4dNT_b#{QCg%8sY2T{gpMYIL-6(HZBe^h#_>ZU&A^8
z%t~mv-B_Z4zWFKV@4q~CD+_RLLRC76cmGy;=~D?(O8@`JE4cVF?;1@299(Dy<L$L|
z@i7#FAC>ODAtW|Z$SLQs9N6qC5?r6c0MN|Y3aH-%v`7i}EcM5NEgQ>3NS^<LWInyE
z0s0eus^<&80^DUE>90`N2GYxt`}}XfzeB(M_bC>5<!5`@@NXH%|HT#Zq#|Dd=tMrf
z%@2Qh^2bN_&s2aMv>bES@Zau9-=6&69|}yQbUMS9fBmP0{&@V`g|&=S51kg@68u3<
z`F7j2JO%FId@euwUpy8+wtY+738@}VaK9A&{dWAeE1`U3e)0c<py<r68H$54J>M%e
zazv8@Z(zwDt7MHGefE<3D4)MT%{hNqiq788hX(Q|<YytRJm&^kPCRAr<z8e`$cG(I
zKX_mtS-dtKTUvs5+T@G2P;NR1I-G7IpJh>bL!588jweI&@L|uzgjrU@h3t$OLBNNG
zVWT@{TQ;50J6Bj_T4wTJpVbq9S*ozfxFbFr#`4=!j^f8%DXphm_ym|%wf7e_s21M)
z{!>)_8={W@2;QBHz6}^+<}rY>l>^=I7g?)0TC>TWRY$s6<#$|W0k@8KXvSgx`)wBI
zSPqDLVrD{uz5Yi2ke)t+B`Fce1L*T{bn@zhttzUybhP}P*Ix$8dL-7mowq>aBRbsG
z;9VeTs~sB41)034D=%WaQBjyAQgE_RzS5trlkw^{2qLh&4wNAcb&X_8UngsB)L7f3
z=m^~o5BC$u(Ym?UqFy^pj<@(gxLVoe_0gcdUmfm}+0hres#4mFyp4x0h-!&EJLiM3
z2Hy?OBJ<I^t2(EgBLb)B?B3_QdEJj6KUR>WY~`@pWsJ>volVv#UDSP4y_sJ^Ki3{a
z_i%4$S%3AyxzqCC#q3kUYC#Od`5mAc+`^0j;lfu%5erq&?qK`V@spnN!9F2Z_Oe65
zxsdF_D&6(tDt^~zzWP!)Onvb>H$j*4ko}$hIdJzKuX9lZ7~}%&8-XuQ(H6dH+8tZH
zI5Y?AktW7>5>@i@avS)Tu1Z)O8;osH@xMKh1Hkt3!IMFYi5peQhsPPQq#Jm3F?^0i
zYTa*8E}$%_+Y_VX`sUJw3}~2F_+Zt3aEhtISr!(eBzp*0DB-DNvDrAd+pu>b#^*v~
zePh9N1d4z@gJ;a294voo83(r&@o!ckN_`3x!(^G%iMeJ*<1$rfRI9Ymi9ALM+75>0
z(&X17B%;CQljz!T!``k3kbRB|{l+hxr`QbgS<m}v4QBb6p*Kkn!35RvcNWtSRiUu)
zYhNQT^kdz${33yV+D?kuks<Vk&~wo(qH}@#l92ra=Q=!k4er^)ZXg=Le6rLvvd^UP
zVw2T5bgWQ<1TxzDiR0g6+X(~0$2&Jl^%nr{V}k~b;38L@$WYG@BRQ&7ZKPL5e-aVk
z7ip(#7`NSGj;q6LN3$!h89c%DYDrvwFek`}pgdTTW2p{^VgqI2v&ULkuN?uYMn)YM
zQWB<&u_F5)){00@HPp1KtYjt!+;9vw`jaZ7qI^Uyi!{l`2#l5+Igcg{skNo|F6x?&
z^Ln`&q)G$bz+s5dKJFBlY%Gszfh>`MQ)qUdQt5<7ph;N%7e7zU;Hj>jy=60oF>;Uu
ziS1ICW$y#sfHMh+l$B@PPFA_8Z$07i!RdpC*>b_28S*Qf%Pw<EG$8W@AXtuHy-L!W
zAyu+H)C(()*=|^^ijX=uNiK3V*kmE5ywZA8C%i#udipS`vaeEOJxtmDY5AT?_o>)*
z!erBI6<+&w&XLSVZYBB0A%g*W-5@}as=T{5i)g&yaGl2R=mY$B=1H=Rq2ZKVHl`Xy
z%j@fkjkma*)&ku^dlQvArPU>`i_!Si7C)T{?j~RnWx42|ZhSz*Va^HWWU76cWpKvS
z8~iD!yZ-{{=+gLrV<7SBip(YqUw0$<hWdFTfe3nN&d~Er^U<$W2HKV0%k4$r(+Msr
zGq4`d>!uEf9)6XqyX;$8FGmYb^Q&>yuZQ)L2&q*ETWIQh+7TfRuyvkP?^Qp9Ww?j1
z2H@exSa3v)$J)l_q)hD)Rq_m^>AY;nxQS<7h39Y{rfYP=q1-D^J7TkyRaqey+F%pd
zT`wKm0~)XD#AMLvPp4O^@Q238Xb*FpiW2$A`|c*95jyY3${%AXS`07>a6m(RA5!(e
zp2I!G&v#Whp&*;P$&f{;6YDBpD6H$*a!n&OMlXWhHF4%sS;%8!A&Uk!xj1eMz#r~C
zafhUAZ!l_l{IL3Y+|zr<<4lbYCeOD(={quPZ#jxq`#R4?jMwvDXk^7O*(CQ^z!;rA
z4W6oF_PtllL0f(e3PU5pS0Hl5=}S;p+fRLFVdayV2!{`;RlyZ$Uh7ZG%VYcEm(3a^
zE_FLU-;5=(T5L5Rv0CgH*L96z-%EnRLCPvMC$kSARB|!dhb~R36Ft}1>2K^`9YF69
zJ%7N=h{+=LTFtpmjrSB!SnbSseS~Orv*g`Clbce5_+VwXpllDXimIFKYVk1Xo63I=
zTM=M>A3b=<1l;snL#X&n+R7UfXTyRwPxoS&stJrJo>q<J=Lz&yzTW6G=}qa!gv4=G
zj4YkhY$Tt^-%bk<Tr*l*=}Yi5>5~9TD<3x@lnfJIT)1(NOt2NvT}nW>xxzuKb*G_B
zk%v-&Uyd0J)sscr2vssnX`7v=rn)(u?7d5KnW_kTD>XF(qyrwCX8QqG$&)98nE0)y
zi-lx`X;4U6)y{}>>j~Rc)4}wdfhvRZtN;Or-SY0cU&XL7xwAZ*q63PIj|KgX&sL7t
zORWrDS1VtNMpcKxj;E3=-a&RcPWoA8qxr1&!nH*-vi*80593M74?1I63|HTAdtxqt
z$JRo^6Q;whPp6w&Fi6ZNxdunugyjW2(fS)3cQ`GE`=>k^=iBfm%U%{uTqTVd+n6Xf
zn#fM<^hTX5aRhBwpu=DtBkU(lEwj+bgV`myB8$jWzAk)?3cEw|y$6zmxP!-v-TV3W
zX0fS*Jsf3`Jj<HrM;e0zOl;5z2d3p$1m&TOXUduxsy<knQLZ$oYUSpmQ<}y5q9cWN
zDs?CDj@Zhyt54G=OB4+)<iJ{du5aELS56#t%?yPL>hKjDAMBr>2sph+4l{bBxbZ5a
z)qwrPyBg}__`c|COtH&sWQ5p3&hz<?WKA+GBSUIF-BU?&Rm#zaXDxmpRoTPN7-1qN
zt%{zVhIe$KXGPX+XEP$083JxIdU^iFBgSC8#DVrpd6=$WvEx>rsr5BEtd74d-Bm8P
zIo2(9v<aA7y*(=yaKg0^4>@riTS<OLDTU)-Dy50@Ol1gkdH_k5!i5`eonu$y(S{$E
zj)eHF%gf6jl0Sr=T`0!v={7>R9b4CO#4Z%2#J1~6bKr{0xRu<RaENyGmqz)4jw%x%
z`%o|Db6)p|!4v1%Gi4|HsVyMDwkKydN6<B!xf1Kxc!^ph5y;jmv{;;Z;Bi{d1N$;5
zF#LEBQ7-A>C-03<x3|to=6`R$;GUQZyYbMZh#yQFlkiBVb3JN-5dqq1kWwwHIDwhm
z2Zed68R_W|jhu=4$OFCQJ=+RW0xYeq&sU->H3B8usqHn-)ynCIN<NNUBr&g?qUYF{
zmqPpZfHLM0FmJ-<5sfT{$&vIv@EvU!CZ2PZWO9$w?7HCVXZ9Y__CTMuNP>GdNvemg
z8;YjJaCA(}9IZUxX_aI>0`0E7RjqWr<?K-gsV1}0Jk`;Dt1dU4GI|%TB|kMdoMnNi
zv2nO~-~$|#<2Pw3GCH|3Dian4wQxOIAM~*0hA)z)!qId86+47bgQupzNCBK8SLoTZ
zdhDckwACdJd2h(Y&a)6hu;*2;Dw>wYwv+i#xNVQ(51p^!q$T)fKTh_c=}Exe<TO{~
z6+19HQMoB|dWx7?Wzps>R(R1p^KqZ3D0A1O8e%j;8X(^qN&~Y<x`yarP_9v>@$+V1
z8-WNdr=8l-tC+k=6v0T7O#f8B9$}q|#Wdd*rO7Z_3?8T)6q^0WGMhrn-jk-ZHQpS6
zV^fftsWwVIs%nrEK&Fv=shH4(-(_l!#(DrYnen+#Z8VCb2-I8X*t;Z#@FQe-CWqPw
ze&>xVsjdmN=_Gf}&`S3`;dIJ<&q}MdtFWr`pm>u$^3<nbH|c~5IF2I)&b$o*Ht#3o
zt4irQV#^D`tN3PeYnF$mm6A$**B1SHZh4y%@l(6Y%iA{S_-Qo*nJ7wS$>vvIeZ5D*
zS$HtN6s}W_BdhG2W9aAIx&j~QaVeJ+UOH@G2$4#<3NPM#&kG*rQrScit_yCnfG!#y
z<sRa+O_YJ{zoMcZNSjQ&nJ*(?J{b+@FWm{=|KJX6eGii4<EL+XXViWf(O|S`*s^BO
zZPxfzq}+~-_*8fe7d=?ZY)%!*l_pm$fB<@TQ1P%Mh;~PhSmL61`m~7^{m?we_cK4A
zvRs~U3?|Fwd|7wG-mf+)c<xg8=AC!aaCku;-2yd`xnZZCyQnHbrBRKxGG;?Q*SBn4
zCcC0Z<Tv@mCqdaocu{Y7X3{2AtlTUh(VK0!z(}#+>b~g;qkn#1$nzZ5qZYAqnQ>aS
z$r5$WN|AQOZgAG1i>j=k?)c7!;h_>lLOEucnliQO)8#oQc_4*|6}zAatc9m%XV8hK
z?c$4b%Bj0~COR1~!&g7DlN}>zz_K|?0Fmd1EW8monF<#;=hVgO;lBjtw%o}Q2rjUj
zCriOG(YGNV<dwo>8sC=)demMYmn3+S<QGC0x^Z|wC8?<*gA3`J8?_L4ZEGpuuoPa@
z#0_T8b*LK>I33_Av|ER7^TK=*Rw}85as(MqPLn&|hvzS6`+fN-s&^F7alog!-_kJ6
zP~yzgrEjw^F?FsEdXSZ47F<?(-+LsHhdp0TgC>V!OnI^_7|^C{s<C*SAsJ&np7G%}
z2{Vb2WKPjN4f!eHES&Ql_=GDeoLD#6A)Ic!h)$|sd-js#-0NhmREkljBJox!s!#}R
zumUR@R!_1uwHkAP<$Jv@mH<CnDOhw>qaCLzJ}xP{4jC^r1H5Y32vQb0*l#g~X2p)d
z^^I)c7!C6w=ER`l6u;90GWqa+C9H-an3?Wu!wh9+ROKFZVQS&VBfnTy61BpmB+4c0
zB@6;O#-yP*`21=bzcaR-@!;6Vt9LgM57_o}PK#t@x{WByXjkM5o0G=uM0#=NdH|Lp
zTu}_t17Z*!GfA7-0AUNaWrR8jST~Qq4*R5Bhx^^0Bs(*B@uKU^u;8$<eidEnGJSdJ
z8t;qEO{uS^JQ(+AmTkx1fhCWXmM=kQ)(jSj=_5%5EmeRnflT=iKkGtSRnRzb5bPSX
z7-sTjs+2Zo)~68)9Wo><<hLOwkgO}#=NFAU5phje)zI_C6F**{yN}X`88kmlEYUWW
z*;K=}h4Dg(J(=shVH?8KMbMQ#^-80Sx9=9(gGLLb<T_a^JA$YN(N8Cs^ZfM$5|2TE
zm^E50DT>V^r#{G-y;tk+;pMNIttF~jaAFGz4}jZGz6@dO_RB;)KKENM60@|i`8u_f
z7Fs6r>4ESbCZt1%%JMMQqpXTX>Tsd`BhYi}+=_<6l&5q+h0waZ<Hgs2sI-XNZ5*O~
z)r~TQ?e#~^Z~WSxetobu{7G;!sr=c*$?49aa(AQqK&ZvKQU+avfA!Ihm;sL~^VZE-
zym*dQ8A|r66{Ec+RHg!n+qXXg6|9UpW0mtv#(h~1@aQyz2+L5?rMzgLt)`^I^vh(D
zTWL8SnT;51zsrLhWZME#9cbNN>s&3i^@ji9#ko5!NdG5gvnKKqiZST%H&@jRO}zMO
zb%2YKFi?+K<eBKbYb(`T<m5@dgWmR8T8~Bg8C0@|A5RYw)KwD}*e}k6JBG1{DdD8F
zw=q$Ng7c)@V-4sA$c8HGU7Yzuk6#TP(nfAqZ+g*6C%uqq<H(^iOb{T$OMBlLMl)dq
z&2>60e`-Pxxe##d8!zvk5AnPIl%C-$$9U=849ARDZ}SiIin4UzUt-sNeAipq0)}e}
z8=9{b7P+vqqOuJ*b!oqS;BmsIT3xB&rpcCR)SV4ay7Q_W{(&YxU2c*|eQR~rKXGfR
zB+hlR&@M$@ygs(By)z$vT));dejb;4OyCU23&Pb9K`7$GWSxD<$`+wTb$C-_sYq{b
z^S19Ue}!KEqkiJ&?)tWX=>NsvDO=+%Mh(r!RI8rG_zb1^=kT2kdvJ_}nY_5{WFr;P
zRqW$N95)pyT+Ji1rO^co*^n-I$1Avz4losiao9cX75wvs$k3z!-Ef^%tmn~fN*-!r
zd1~d{N$|Ee>$;Tsk61RXjq|7iveb)Q&UZqHlx$Vg$Aqs6(z1OPRx;79m4ujmDZJ$@
z%AyPJNZN|anS7#NN4r0@93g>5pp+`GQkw)y=YN*MQFi(B7aSJs;p$agRawQ$v+ZWH
z`L_z_oQvv@?&`1JCu%FUqg9sIj;PKENI3kw61ODhTU<P7PcG1>cx_)E+q2->4R7d+
ztnI74QCddKAUq2&`i%;Ki>4(rNW;l~&IQGCwkFK%1DN+<Sv3g}m9s=oC#R*kCM{U(
zP{+41%&C>7tw6eJKc+!dv@{HK8UL;|ym%yZDY6*pg#PG&dO~0DlzYK3I3*9)=)-%5
zV0J@+2b76~f}}hyTGt{U6YrB9(CTJx7N6Md@6cqwD5Sj;j@8#&hx4>`<20x5MZbnJ
z*2o69+dzV$3MU+zE^>KyPa?_PPhL;E&0CqM+|E%w&UJ7)a(%gXu{DGyWl-{kQsK<j
z^j%SU36V4gqb)AM#m>c?_obF^?_5&u>pxpk6KuA~K2@N^q*Iq;p-Fn|Cc=t#ltp>A
zF^O2JSW;Y}Wiz8d*U+pgV^B|Qj<nUxmJtpKV|TCJtWHRErU@Dur1F^yk<Ik2R$*fA
zk*EC>U$GYc!3(%wT+1JE7;QXGQgA<(9}#e^#qa|$_-EA&tdAx@x$`5u0&o*nN6z_`
zsTsAX<Ib(cKZeq3R9g1>D@&ykst3_FnQgxn5_!AtoG_opWgAVtV*kWwpg!?1N@2WR
zmC*W_R$p)I`1xWrf@L%F_N<**EI<}9l1cIIEXMtj49ff|ssUImi}5}lj@>ICf{bYU
zjOA@a_UHFCa~@ANP8)UTFmD=dPKIG-Yge1!ynsa!ThsT3s)@A()9{p7@ZC^kq8I(J
zpa0@iwWaY2PPvjh31pSie&cL@0cFWlxvl-&I{G+o`<}rd>~dLD;-{|0<pSzau)ZE6
zqwEMM_QbUOiWeMariEuCo`tWFL<e%k$-0TNYB$;zu&=~nuB5r`v=4M<T~G#bkd2gU
z*&f(($|rk&6<$A|kO%uY)6yrcP&0OPM6Q?J9QBhc&eE=y;XLqVTWrOZS`OlLJ|sCY
zuNTA3;7|-LjM?YZW2EXR$f5fLWl?_7x+j0fRu52T7dIWgqUZh_9&~>KHIKrjp_~cp
zTd+kg!>z5{$lX0be44MH>xFk4PXeY5=s1>oPrQ>Nu5~CiDAOd<Mh+v!JA>U)g4sxt
zc}nZvA><;AG16$DpG!hSD&*wu_XW+<KT0A*rG1$2rU-8omrbcEDg&%xR?IJ%1?r~d
zFdKm-n@EyD9<Q|a-%pZjuh1HvflLr)<i=+_rK{`U2wtz`*8%a`Up(fA%CK%CI#L&o
z6N<2XOI07->HoSuwjLwmnyu1+ZlDJk3^vD(rC2mI%)0N`=oChCp1Phfr!tl8z~S?t
z!O`<F@KDKl3`*Rp5^ZEU&eMLXyd~=z-tpb}-OZg9UeTf$(#OZMLo~biu&x-72@B}b
z%v#@?=Tb&5`e}cHHY?hQ2HY94TEw3b{P-YsQWfS6tw<;WjE!c)Ma5R6@bdryOdgx#
z)Q>R2iqi{xS}2&bqnH1xNP2K>cA<*Mn>}#nEb(1aZb^s3w&?;Z+r2qlu7SE?`W}b<
zwnX$yzW4m(Rb5Bi2D()f_V2fBF_hjP_rt(nfvvhU$k~>EIZ|QK@`C}F4N)<Rba_vT
z%<THQiPBA#b)RY70NfID_oZ$}+N_s-2mL~2*IihxTo6^`^gY_jL5owh`d3fCG-N6@
z4Y;Uy1w?m+JXw_Tbn>w9q|N|2=M9L;Z)Cj5R!kK^#IEopxl1EevieO`lO?0cRaiLc
z*h#WlzFACzFrl)P(NgYadyd!ky@tt2xi}J*3^OUi`r-qXcP(=pDMV7UuCXch{;fPx
zLQj-&4?Y}&g9VC3!L#}C!g`e-3ANQvlU{)1)rv=vHX4&w-q5HCSgVSP$X&`oA`6pV
zUiE$;yEW0Gn<hVp(=qjcLE!YvOF5HsSu^DI-URE0cKW-W#A=mgNG8Ye&dI8cYQ{b7
zFd9-_%UH<ygWk=fXh*4b-eS9Tzg>GiQr0<S`0ICX1_%&Rvs=EYbK(vt4K{o3Cx=&|
zfizMdzEED^N)vC%%AFfk2u!ZesP7f0BkGNGH~Zz|rUrH=gSEJAdx{&QwY0UBmx`dX
z9j1aCsV3EO7ad9|y(6DHW6Qa~CuiaEhH!*ay#v2>rvp~_@pO^c2U`XwR85|1*ZApK
zTmwg1>0#QLK;h`gNB&csDIGsz0hBg0BP5w_oK3C9j*mt?<v4j??4c+C$uy{JjM+<c
z!Oet!@|#eiwp;pmfw2&p(<AMe4p^*<E(`IrHc~rnB+>@a?w1&+J9+Pxm6uX)z4GfW
zthDdM^4>GymaOH7!6#}{)!ChKybGj)XZQDmhvZS7HQ3OLb`uHV65;p|vpXf)Rd#0v
z(azazvZqNmJi>r?9$RNQYUoC@vRTBJ-MqRpVynpxo`s{<n<h2DG!Dx3ByL991TJQA
zyUsUH>znD8+GG^1rt3MK(#R4T4G+Yxa_&7j{SaihvJQ4BULP6^7X{oRpy&Pfx&sKt
zFjnBGB?0g&&V-pKtrci=RtxD0=}wrGSeluoW)mTRcyh$}I^+QF0>pof)@b<P?)CKu
zov$3N0V;eO^LE|+syIt7h;f}VfqU&XQ9!vcSd69yaep3UH<XD(>D(UoUc}aFTqPn#
zVjQrVlm$M|aGB-a4LxU>cTQq{<5yq-#_=R<I=2Yl;CZ!6hiJ*|2J2odc875=Vs0NP
zE4)_Z)b|d~Qq7T1{o=WE5m$M7Dd*UQh>J0w;-Pr+Eei366xZ`W7VwafsG{IdEHDi?
zJ+wyy-mjB<FySmEoOO%*N!Im;&+I06p%<x(?Ocn`e63}xN;^VU?PDDU<C-!Dot-Z_
zHxDP@rRN-ORKDi!k6qab`r7f(M2kCl^f1U`oX@mXko~5Lb9>UeYP?|Ph0bG{ixk`y
zZ)M%{`8dK0jgRU*=RQgi{7DGv&*vT#lmyu#bvx{4$&Wp?z9`lXYL1P#9JP!^Xk1{c
zOyr(GdwIxgi0{We@&m~b3qB=ycCixV`WoEFJP(J-5Dtb`+kJi(t2lA_c*X*HEOvd^
zU|#(^j;BZ4(9mA@YRl5*MDecc>@w`l(;w&PJ`qMZee>;yZ5x4SlbWFX1XL-}OYUZj
zua~UeswVUuwxm4%;In0KLwyvQuogqx3~4pd1s!0#bh&6q^9h4(3`L(v>T+AJ%a_4|
z+Ym4W?mGyaF({=YY%Emk?wRR$zjKQ`=vtVh6y8PP%D#a*S;XyI4yveDSE^j*@je-c
zIy=|~B&>U##}H#m$MI-1G3Idi_<Qtzj|~>aFR>RK`!XT7OZ&!LtbeO;aO@qjTu#k<
zG*nd7LKtK2o0!6BEaU9w-?Dmqp9uNGTWLB9=}K)^{fWz5Fozcbxot7OkY0C!myOMA
zVJ+E1U_FrI9*NXk#<kKcp$*68sKJHKWuN)0A4b?SmxjU&uP;^CoNv7^$|kyb^tp}b
z=KlKE9nr9wsei4(*YCf$g-Q{BQ!nZ|vW|0eM$Mq^o|OIj){xc~s_~3L&3mL5ulvGj
ztfoeW(_aLbuL~@Pop`TE%TRHOoUu7sDOf3Z?g&H;w8QfyAu%E;qDd^MPL%gmjeLnO
zhNG~SfeC@cfuo-%j7I<y?z;xO2Re4;=Lpr0yZRY!kCzn&c7oLXD?-7O9rHN`)K{O>
z7+)F4ihjukdimhz$6rXJR=n*Bw+n**A+YG%Kqm?zRE+=*kLUm6uRkc{JG<4ta~}mP
zUH;dgUle{|K(<)a6Y8HQ{-1Xnh`wS$|LDe%GXCnfG=lGIaw7!>3?#MR$N6RIA0KPN
zuZRl~^_u@RfLbU37_i!Hc<XPW%K#iG;{8lG)iHmF=|3$HDZ0mtp&B~jU?w1!bi(j@
z6IuejCT{clj@+QgwdS1PC%kg2OA`gtS+LU2ujUW1JI9&Az&anpPyAagq#HVJR|;z_
z9$@~s*M98whtqyf5f}j7z?A=+*Z(S$5bDTO@kg}3;r4_Ez^&k+XWAdu_iZ*0d;qsw
zn$4(x8*q*T;5P2`snYL|_@?l<)nWp;Jz{u;^0xs{3;<r8kO#ECZtwe)HB)E+ZqM-Y
zFa2eJkRUK%b+PIe?q5*%VhedDp_uCbQ^9`4Z5;9pS?j(BV)g&HQDz5}J6%_+J?Vdd
z{?}1ma=?I-Ql@AB#smC!j(ZiC(2YGNpW^-Z>wgimlnM;^K@Pq$Q<b_{E>&w;dD-6k
z{|@^8pPMKOs~=qHTPDF7)z*@_OS1fF@MfqXxAu-E`yL}#yiVR&sOXV>`iY*5b>tlU
zF_YrZK~R}_i1++rCo-_*msP|kx!rywW24304s6U_^=_JWz7R<cYGCIq;wFR-q}#kq
z6euMKJ2Dksc4aciL;oOAOxlozUD6BoM?|_SOX9aCAp-9LeZqcu@sbCyDaa6-9zepv
zcc@kCi!}EiO4iq@=&CtBT<aN6rHnDVVRDnFDWhtL1KN?DO00XjNph!)=d>HyfbeI+
zcVA-^Lggt(puac=6lYv_+J;>z)DxXoS)bfwr6n({58)wHb#oUOWcZ^NQI1Nl+f#jA
z&qk6ai?z|q?i!fH_O{W;A)FdA%10X>Q8;2xo*NBXr9LGEUoSc3W6XP(dM=k;No>Xt
zqVqVOIA6#1@tXOoEU62v@l5>ni;1?e;*1>ErP-S(_H&sOK4L|Cw9_9o>wFcGABeZ(
z<R@w^aFYr6DY9dh?b@6TOa%>+MTCbpTUCJ;)cYnRmCG0Pj*hZb&7VDU<{EJs9AgcO
zNLT2$Epl~GT03CM%+&Bs_`Jgj)q&#}WwLLgz<&kfy~s;U57-Jx$bqD@E-H7T+ntor
z4-su;{^Kr=3lkp)=3~5ysR{1J4e57O+mq{mc7K(2+JTu{#7r{Wx;o3#AT4brUZn>2
z-yGEX_;x=|yUl-d3bJ7Msv0eoQY@>_f8@2vj6WS*67MJv9;Q{rXDZy)r#;w*BAQkC
zdUbkNkSFvwDX9~_wIr~6Ik<|@@GG@=HViwip`o5C{mxkafj_I<1eBQdbKYtE)dr?<
zzZK@$SM`XV-u#ajJ{{pvk>V?*DiWu1_;G<!Qo%GDA@*fXhzMdL)%KFzGe|M&z^gd8
zIm&Mlbj(~RvO+{-p|^oHg%$elX+zH>=)?r%xNOh6qt74Ql*Ff3snO8;6up^9&RK0b
zGm%pi<pN%teLfp@*&6#TbTV;nIG3t(_O4g)R&YU$LVs~+<_Y1BdK6-!Ta2c~MDOv7
z?Fix8+g8U`LrLNDP391V;-N6V@#G?51ANSaXx0OrFifG(K0OmXUzHvY?tBtDcA|QG
z;04F`*yP`}Drzwnz4;`=>$4LSFYF#EZdi0Q{f7mba#-1jraeqUEj>h>Vz@HVRm4#+
zA-IrwQOS9%cKB3yj=0bTm*9ilwir}0yF95Kzpay&Br4SM%mmUETI1ZBXUTmCnQN_^
zKul7Mzo7mt4+6#G?i6q<fC+#WmNmS1;jYYujZD{~WcX;Cf++F%lBLus<1dGii9ao}
z+CGzurD|^a!e$hBrm|?xA2_0imQ7i}2kG2TWkEMd%F*~DtE|@Bs}n1y<4jRac{3(B
zdMqm|D5J<TM^Wo(Pi@=nmGzLdg5Z+j)VW$RKEIGjg7&lr;{D+(*sdhkvk!JJR`jt7
zqwHoJwR*l(;VPAGo`;c&7fM3a%eWTcSz7dnSj=fj`%<gV@0wiUeibCogwpd{3{-NI
zYO~!BgL6)qM4BD94%>KAh%R~lO7r($bfHGOaV)KqI{-Nu*HAy9g$BHG$0sYL`JlwT
zn0du=_hqXsG1-~pQ~s1A{4kSX>TqY9QH3PVE9;m}UCA1^xlytuXC<>M{X8>#LOj!5
zHbjys0_#YVZ!85L&O^F()}lGX&Qu;Ll%*ZAv&yt=J*q4jB~Kz?zmk3<e8oO<r(-9O
zuVie5zF3Jf&SkBW(O^E&R02NfdMA@qQ_|tsDyAg%6OWv@bf}a_A83AOiLdnHlu33K
zql1ir3$iV%M6<}pv^n{@Bgp&`&Noi|GjDWzg1i?0w>hincXKhBA-O@U75c?mI_&ZJ
zPPbT{k1~uj7!YBxp_ptdp|s4-y6=hOb*xtodgN$n@$JQRx%;vN-ptv_SXJ=RN1Hmf
zaO+Im%%&}N2(*zs6sz+kK#Q;=R&}N;tyQP7SXE6M{+uLeQC7I_6Sj#heSw&6R^7kT
zA83?Z{)tRAcK%J^S!w$`9+sRK5w}Ek*#J5CQt;0!{^vG-g83TF>xl(fEt2}~ezb12
z;<Xkso;$EU47ranFU1|Z_5!4y>;Ua=DmK<pevjoyKQFL!(<4)~iK=7FSzDP=?1OUW
z&K<!Pv9|jP3iTb5(6;%ujFIv{8V2p1RO!!caw7!rtLZP*N>}T~YZsgx3JU{`QY%XP
z^n;$35^8>sv1+%fKaCwJqsYAAI+>Tc9<tHi#=XvEkC^OgQn;uZVJ9a<jsN``zafj1
zrM{gSx2o&SrP`%7dS3=!w7?{#+4(WWHB@wn(n#a9bROvTccQh;-}|KQuTXwNW5dAT
zUrNad%pYaNny-~|rYGb~@LITrq~9${b~5CX=>}q)ASO^ml-2b5<D>+o`JJMgUe1S@
zi*gb^ZF1T<s9qlAqyj#QRg#3-8<QWmLvpO}i~2GKDD4BNB{RA;!tAS@5W^#`o6Qoh
z9YKj1(bxWa=K)tB^CJ}46!Sl_@s<kO+`;0LeIIO1$jgRpO{;<e;)`|dUfYg~TcwQZ
zvO-c-`;%Sb5_pFh@_RWR2|FB5TUr*1*h0Se6epFbG9`NV^BHw?u*$Wd;Rhtm8m?n*
zTjpg?M|{!?C2xE@HFo*Ir^bD|Jbr6dtN9PP0jA|GrH0w7Uy*z+g?C|CQ!bRGoKj-%
zecF(W(MAhUsXnHSn&Da>-J|6lSyoxwteJ;5KS%f_t0T(HCBfAi=H*Op?PF|LJR}+A
z5@#t%9S`GAaOS-iLi%=3TsQZ!&-10qP@aFQF8UvF<SGLowZ<0*0G*7dNHATV=XI@}
zKTx#O2F<EAk9@H)R>Usl7sh(hMu%Y?5f#c{rrFI9_m&#pa*f9oaR^q`yL$(7RQ<fG
zH4{RKue=nKffriW(0ice<1Z7e*qJmEtS}x+e;F?~Pt9p<p*83w<8f9Mcwsm-C6f^}
zz^pF{>~(D-{@PApMuo}(C9zfKk`64P*rP{5))m1Y-&4|F>$+A#iz3x=9%V@SiA~kC
zt$g9U05ps~3iH(<qX^S;9j-s`nt!jP$i}eB1u$DAgX3lY1B1JQ`UunNZS!L%iq+t5
z<~L{s-&!hVyUmGKV$4fuUZhCr-ThSIwRw^CWV@3v)S=gUdHU#bSahk&;jn*>PF2ry
zY;p>UpGfBMo$F;J%5}T*r)8|B!pJ5{FX~ZIP*5~f@zoy8yH2;0bZPvPKyZKS1dWu>
zZ`67FNx7t_4x;N1J$;<WYjBC3fEK>UT+LV5?)><5<gtw{G2K?|VqUEXZIMs>DxI{y
z7PV>C0c7cdLFl*QwNo*eSzM%c)LdWMS`6)ScC6rgya8U9{v+5S<-DnOKxu+n7x^M<
z9~s}yWovUZ&=O|w^MyIt$>}C(-o^Y)NpjyqE4j=A!I%7X0sj*k^Qi%W(Z|i^x6HF2
zlBKw=+ZCG=#^B$$^AA1Yl{_#24`uoHCQ;vStB+Ne(3keKseh{n^<#?WL|_0tYR|u+
zCBJA8_aT7duw4H9TVL@19D^TIhyVlBuY5-Kqx#eDZbByjz<cczaDL4BKLC6O^L-yw
zL-jQ|djQV&qpsJB92o_L<V*iVHn(zf4=<y9!vp*}fCmQO8vx3OpVo9IyeLwm^7%;!
zsc}F<^++sa?C53`1rhyI=52`@pc9^_-M?pT|5$)EutL`Fb&meHN)oh^H^O4nzo*%`
zZ3A`1D9@cwY=+i(^C`lfcHp`|tQY2jW4G6s=zv7!^V?IKD(AzP4}VKqb}y#5<*+f9
zojcmX1f6?QRh9f90$Fvg*$_#f!|w{Teg?repfv}Q?={NUzEje@{f*unw1J_zVHC5!
zLEf$QdULJOzM3M0J>1|HHGrG=LtyMa)aUxIip!4;GfM-Ad{=7m?B8ni|HbE0C7>)-
zPCi8a3EuyqmK#WY|K$de{2vlWz7dBLpzmvJ7Qesrw=+=(XzSqcQ_;S^(30B(AeIcA
zGCUOe4L1K!RSh#z8DFTn&Hfj1{Qtr54XHna!B^zPlD&SrwX?>;wnl|bc3##8+usQ4
z5^Cg?uWZT+-`vDo8fb(AIe7+k6@xq!9)GazoY2((#)5I8hrf00{!VQ-GyqchM^5{}
z%>Fy&2^~Nxu7~fMf8)j9NzMZgAeF9Bv8}(6$_3JHGg<lI@!v=#9!V;D2e*Mt)c?-?
z{bPJJ^2FF%y#E{HU^WI$%+*TB6=Z9lKfPip2Wd0;zX=RA%~zyltT)D8+3ca4lx+h9
z!#!$Pzt8&-=B8ej{EtLmVdt*vN=h3yC_sPt50{7&5=)iigs6YTk|y#%Z<2NY^*|%B
zWKsO?PxixaV6Q`BY3NjJ?~m{SOsf+}ERAMAVE!AHa*<d%xVX*#`&R#<<YFY2>_FH5
ziX}57U#oO|_E#)rBl+5QFeqHPh|Wt3H_Fy3(h>7NAxFv<zo7PBC@{WmgeehdN3lkE
zi!5$yeQWZnOV9dp-EM#8u|ZD59}43$yC7Fl?Ue<PudnJ<_iS@`_|OPDT~tH_;U=v*
z!SAymSCurbfd?cli{Aej988hP%s#(qN<JhV`d_{bB$wIY+)ocAv5#RVcXLa)&gV)>
zm!P2*P9#}V|Ka!brvW^4p%WS35ub|M8P`OwQ})Q-JX6nHWS{NXm)`^#lq+l);U-zh
z-x@zojbA4gv^=TgS(lNKS^Rp`(Aan~ex)|+R~P|n8o0uR62mU&grpq{(RfLNNh)kq
zFIV2F0w$=_3EN4#^p~{XAFGMNy^nHk2q8d9Bn}2BAW){c_K4)cu~W03D(PGQKRm$;
zTpH(C+YyAo6I~Bq7#Pqn%*@Qd3zLvv{32|0NdahZDrLBWw1ZaMVrG>pO&4TgLI1an
z$N!$GxrL;>8Q5)BK)S?7aV~c$wboo8cl8zS8a8NCr}`CRjg){|P;wB|4^XuwdU$xa
zFBvb=ZR5DsMl4{}T7uVP`s-?hYL3tpE}F*AzERjxc8wT>r&Y|Nj{Fa&LCE70RXqFD
z^S>Ez?{BRjg@JMZ*xy0)odyU29|Nc+;dkxx`?{w3fgM+uk?{ZRdcML2h+hM4!hbVl
zyVYa@v<0>0b@~Ih`Da<iw*Y%Qir3$a>40$;u;`z!*zNsI$hg&YAK*Ecv6TP1%^biG
zd(ywYge3h}MkuVHfN^L4v@0;Jn<01R@7gR!=C$%w*nr=_#gvA|eeoQ2Yb;GZ27e5f
z_u$mNu%Bi0f<_*t7`=4)m3VBBt^{%%qzM}3@~v<VYs>wSb&4*HecskxBEJ&n!6MIS
z5+%iwu-7v0v9Qnu!Z$wWaORqL(rHgR-nZ$z?I><vCXGvaj|FN_Kx$G>QC}}f%e~f|
zUZ_kcX~m1Tw=pt6k^12sN10NCz=x5;^_&7ekW4;P!DrD?O)uG%9;uNM_N@7()olG)
z`w27QMfVw|W2Xe@>*<|8=qx(rZo?q5K$LH&%=f6N7@p0qd(2ucTK=ga%253g<I1r2
z)tHzw7alY1=+WWnk%7w9jk&UrAF%*Ddz*HzAUdk}+1pCTEBe{sZ+YE6bHW-;z|yy;
znPm770Mt|r`ZF;>va|W6r!eJR-V+X!?%kgGRY__qebHhaU9J)(;*;?q7{3?J>w_pR
zgIEQ2gOM*gA(}&Y)O4QOPB%)OnY3^#4M>^hGj8tFapmW85NJWpREZ>Ev1*4e5z8>;
zd9K}U^nweU^pd<)qt@pM<=8pKeaHU?b#EOO<@UV~9|H>k1qEr8Zs`s|x?5VLTRI0s
z1XQ{kRC?$fa_H{v5{B*?dVbI7IiKUfbFS<A=llNS#f&r0?7g37?{%+x-D|C0p~o=R
z-Os*>TM74+JDkw*p5C^WJLf-ZnIYXHNzNq(k*f4=`E>4+@esS{%zOz~e2j~ies80v
zoduPKEm^A|r|SuPF-wubI4v@2?+l?`ADU1Ns@vg8TbJ!pb4_<cgVp7mWs>Trw=pe$
zI;mN99_8V($x~$TIpLea>pf=Ey{l$to*hP9ty`&-joLZVy_e~-yB!FIb~H{gqg`Ll
z4KY?P#}u5P<us^EE1gW#tz;(;IG^zcmnol$`c8$BOFL3gT1}pLQnuzPp(SmN4i-oE
z>|2s`hW5XdGYwCOp^}Q<Qk7}ZRfRXYU0aT@MLP@In!C!^J&6Tu1?i-G6i``gT!Tbc
zXY!d(qR*EC|8U-HIzVz;?paq+nr)QCS)ErB?Y2KsqyOej<V2C7q|7O3kvJRymY-P;
z-fi^6<<X|bzzBYFB!f^A8{M8LJ3dNut2sqe3B<;KOa`$uxW}DR7x7{ydm8F^5mbp0
z19_!jXKrq{uC@1NrjyLL2LnP^4cgFc_i!A8E_S4A&o94EeKEA@7S<RUM%2oIeXy%B
zUF39LysS9$c5Nm9n>VfJi9&znFzf|?$Gl;MsBqG40cnY^juWL?S&9N6ce6d+!1N%q
zV%v1G#2ZG8DsSFq=_qJ8j+K!O3x$P;g<)di$y`*xR|#c|5ftik;aJO5mhVTmIoS+#
z!ejN%5@!ePM>sp(T~f8eMvZYUl|aWNE>T^34IT7RquVhF5d^rlDe{qfPO^y#!~#n;
ziwou)_f&F8e2A@dsIEQAQs+|nqeIOUyTr`yED)6+jgLVpN~l8LKxLmu6=kE6=+&Ur
zg1dz1HUTU1G<3~}lCpbRz#?I`PN(J^!XC@Uz|AX^b>Y<VoyAU#_0-NDo`S!JO<R<{
zDR#G4KLQ+ZBw}XA!}V%>nS-f4G~Zc42^BTB_@BiA0KvfA&GPq+b7cYVfUWFxAEnaX
zjGQ=2r_3Y_+z*>u2ik>H+S=rs_eY=-Pz2zYIj>gU@RMaVlUIVWo5?peH%k!3vFC+T
z%58}SlP2@Jn3<cioVGG5le%-1c<zsYurM*ZyQEnXH1$O)y-YX0W)-d14@;J=y*SY*
z7fri9L%v_}m|7zvjx28fk)sDD9t8&f^aR*9`=XO0j2UXTS5nf?>eo_f)_9ACOShL@
zX6v+;S1u7K=AooCoJQa>eecZP(hbylNu%reY?D;jO7gVSWRqr~B|RjiiP6XQana%k
zYQ#~5R31iP+|-+01D0&9_)1R(mX76tHTnTj9S3KZ&9YN0&+=u@9_HY{nrJuC;_Qxv
zZ%OQlEIpN9Y9gFVtr=<==``aL5~iFddb!B1C6J0G+B9OTm=7B)<uhxGrbsYfG<{Hy
z^gW;*g@l)c-k1Qp!(%HtJ3ObFYg}$nTXVV$*+al#I*h|iuuKQhvu7%Y2<O<nEjKGC
z(Qw5p<O)Fh1HoF?vpdLUM12fzkEY1mS)z8pDKiJIZS=70v@}BoDJhq-qK-&fwT{O9
zm?si~$^3SD8^^KBJ-V*voHT&sQg*k4k4P~O1nq*9<CQS(Cl0LY9X<0H)QU2yP*lt`
zii+B0M4uO(^?Yl;aiHlZ*I}d0C7D3V#dWD}&wb&*P_$2#R}#6<h~cd}WBlzaB=rsX
zI-$#jsJp$iyS@D-rj?|Auxg;3?4^00+{HJCS-Y&I<zZ+n-3x|43PHPaC~E9mbdy!y
zVe`4i>f4i)vOuJAuI;Yv%hQI>XfJ3vB(XIIW_uz*u#bhl<B>F6kvRs*D)f!LI-jdO
z?1Zf34xw^ZQ$Y4D3m!eq#@4=H@E}o9RMWx2ItQwAEkVaKIV*`$fl54ZKzKjYfE5*X
z#Z<Qdij9fCBps`Fc-^oq_4F<e<|`7oQ>oKx4YG+}@|yLf#uI1~ak+;iYD4u~Z%jCx
zvr=<WC-xs!Q*o(Z*P3++$*NFK$x7LOL`|j(>oJswF(ThdSTaK#x-<Fs5_7dxXSL3`
z)&|?>YEJV)hO^rDg&c_$C#0fOWiLC>hBz>i#sn-jDw+}YQ-xhkO-(}$T6k@uG3wCj
zNFj+Vo+w)Sj7Z{yTKlt@+U-_t;JeTT&k<Pj1-^zSou$$iTpkgsTy9>ow#h+1Gy$)@
z6^C>7ovc(=Ag;CF^bXz?pZJOIyCW7Q-$L|nKVVIp;FoIa)$(#@iD$<0$+9+rbtlIC
z{kG)xtBORjK`7f(7u#qbR!dZAiwX;)teJoe7R2z>D-}1|4Xd$DH*WSG3zmvi&W%jZ
z!)<}+@CNoC^uplew)MTC+f1b;;-7=%cybnVU<NjC+=V8<(veeRp2~TC45Jw-T6T00
zDS?XJ+0Ofh1TL+wKN%ga2VCSef0KZqCk6z%hqX4V%VJ5X?4~;~(CJd%{+71WrAwWU
z8_@(&LP_?g<>=UaMnsSAv&H8QAHsz(he-RRvN}>NgBa)BwT6lVPWgkK$?|oSm&06g
zH})hdc~x+{I@VPe>no%rD*~uFBs*PM@YGvvPrM)Q?i2<EnqH~M^yOEfgR|vzL-*<#
zYsC!X*?fq_q|@eUcVZQ~!z$C_QZ5f31(j-!_?tHa^}>{Cfm%;5T2m|V@Uqp~J8$t#
zO)s673Mu-{V-T&4NzDkp%2zNZ#5XRBokG0U96M=&k`6F!wGY<Jo`2JF$-$%av>Dy0
zBXQCGnhFjd8tArVEY8jLpGtaoMkWbf6tp$U0Lr1!Zk^5v?G)okoM&soJF*|DENHzd
zlbzu>-q~}I7?spex0)&FGB@8=5z^6c-aa__9=IN{K4>bE!r;lVs#*{bUG1d6Em?We
zH3hRmGvijH!EtOtjMv=W+cEQUaWbV}-9AhdsImKgkTSRaBAeZE>u|PtmU#)f-O@v?
zvYa&`ARzv&Vo!}YIe}FS^Luc<ucQ&8?&EI9MwlK(OzFYe()7a@YEB;f1J59(scpLS
z&(or-DF?e#jPjwn#)c10uORYjJ0Nc3ysRns2e3Ko@Nr%h8g#$~&M(_D8evv}4Ggkq
zYc-UyZ_tV>qu(a7SxV2!K_hW6uxS=KkBeuLJ((m;1@<yN)ds}p@p4$r2oupnz`1Ok
zbInRl>^#m)>I%k_O7C&;e9&=m8U5f}F(VXN-D<tOEO4{uOmmAOkK4Yk+q-p`lK!Or
zY}9cBQKc{%(;7OXJqgx%LS>03eXh6N$F%3lSK(MO+YEBiR?0K#Suu9G2nq{PF+&s_
zhWUL?hG*@sL-@5PKit-dfS=WH)&lV_%4s2Zx<MnXwP9rG*qY@CUB(6NOStYhJEBXP
znvE$GKN;?EVRzQ;e}3yQEO_A63B8&~@-e7PvoS6Vl|gx&<C!&)dW3Sj2ywQKh2MGG
zU6?-O(aQdrahGm_gdAKfY}$6A6{@F?Fdf%aoY@ntS0pYIhorgcrPYIA^gfqL%bO>*
z%2t%OVU`~TzBIfe3Nx7He_ft1>PV$l*)34K2z{8FVruf>giO-RA6m}lLwv=_Xng!!
zJ%se-x9!jkvvPA1Tj0L|dfbme%=xh-NZ1O@wD9blkno<7&9h3<FaGbQTnoQ;8uw!m
zjhyeIQr0qmvazwfshPLkmzLjOqF(AM1)tH?xjzL<XWF)AT{rwoS+_HC^SZa<Wum6X
zh~-p-*}w>W94&c}BNO(KN1X6IWQb-^#}3~N={t~O-?`K0F>L%Ah36rl2P3`IuN(N`
zF5XuZv_hCvSbzx<`JdZ11iTqGj?S^O>NoS&lE8jH13|p%wc2dsH}(q2`^WMBPUj8~
zqSdju@#3d5@r8ke!y;n!<g0rTeP;<Zqcy0#?D{Vyr;v2tb9AKAqLshsXPJ#FYX-a&
z+(ydhrlTG_xayVv`P;7v0IMCSPpppeA0PPQgrt$Ir0yUq<z68Te!K+6fZ5kl7@YH8
z6>9o;kkkT%{N{g^$$8=jp!9_?F;%bMIhmgXKqBygnn}#-|H8ri7*l{Sz{lBakY@ke
z0Fmz<Aj8NrmUplHus?ttbT+Vx;MDZnWvj%8f7}Hm`=JSpcY7px9EmGOsh?XeeP1h`
zZ2wrg<`iK}=oiJH-y%C&SU9lpxYB?Xsy{C|=|nVEv;2|QU`Vue?=}vDT)~m}$4`+%
zJH9<P95x~qSa8KeQF&}>rf*rHnRA`GW@tuc34PiJ4k?MdpO~YYlCz+!SBpXkB2c;x
z1YSP->Fo>7-UPcJ7D9bq@?IV7%2$B?IDD&g2PobDz`6T60A}qsxtg-X4JWS~(kh!i
zr3{L^TMfdGRd-9^bXoFKzyf><RGfSTaJsbSE2u51sczkPzEtp2r)?ke&F|k;Em!vr
zC0V%o=~A+y3SBqLiafR_$4<oKd!}!%mshW>EJGT$I;;sNjfd#$;q#9Jxe@A_-^tFH
zY4IE@?P%m{V5{R&%O~t{G5H4x0}g=CsR>S+MvdNY3*T^GbaC;P-J?rx>wBIy+F`^O
zfeHAuM7n5^4Lf!(z@Z%WxFuPw4`Aj7ZMhD_N68!VR+Z+%n-{hIAk0XG%!sRO>uUq#
z!)qa|4$!>@=3eeDmi~_%vEKuS^j=QUvCYt;KXCF}sM{aS<_fqYV!`L<tAuy^>mz9+
z&rBB|xP-_BTUka<?CgBhn>`S4u)oN&^tYa^7|ouQPty{P4p`Zq_9R)|_5g9;N}Mh=
zY~<Y@NLr)!e@q)Uso`PUE)0ICnme<$q+qvsN{Abn0G=9Zc&5Aije^TgV;t7Gx%dSf
zSP9BsyuIx-22E|<4MYJ|t3oyi5gUezXN##7XMTbE_+#18h!Kk777;%&@%*VEl-kee
zMCUsRyiS0pmjnwR9TvgeY3xRYnTN(j4jcEXHK<rEmX{dCD^e}!&O&FiK`bXUYA!iu
zGmYSP+M_qjCoB^f+gB33MZu?%393gYGJt|?5wrF*hWEF{yLnx!Uhign8z!)YyrQpb
zbC-q%yQ>5K6L-g9NW5XEbGz6*ZGWhAs+lVO#R3la)-2lQY_-GehYv4VSd_YJ26E9*
ztMG}F`_3<1!?2^}DvHvE;t6@mHBP{;;!Y2=@9kGr9r8gmHBQmi(q?9sJ=Gnka{%|~
zT5<FYmrJEdqFK9y1SLfmm^D?m0-BgA8P=9H&`~K3Hd`2mo{am@ng>X8&4L`(lM;-K
zn(;=$mH{4tf|8OW>BtUUf@Qf)!FZ}bWLSeO_9Q!2h2ca45ggraLcS;6{d;xI10Z5t
za=HERA=28bKVBJJZ<L+puYJ2K8Mx+whCgI7kXbhJP%gRRx#M}4-7+Je2f<?;oM?bt
zR?{1s0P35>l)V^dPBW`kD^x61WiCx9+d9@mHO_bs6h)*DT^IvnjhmV~Fn)p}=2pg5
zA?V2wH+tG7+PT8Q7m`J!;F$$gy~O-Ik^|~|x45>e5ofbR3AM^~Rf{k-O+F1a)>3J%
zegcmp#l^#TEL%ja-7Mfnl+mhd!O8o6u*-jjc77bdHy#7#=EgK<1M<jVe%e>$;%y#%
zgn`$`_kDhWeN*6Mb-6u`N8qFL&=&~~F~94y(HAajW2fUR9-&7P?GkZrvDKXO+2`U7
z8i#bt>2M3(N{>Uj3U~d>1{D}BTNUDax<BNo7`p%EqklcXF>E<HYr|94Wu#?b8+IKV
z?d|zYzPvt(s4CQ+rroL)o(mcs7x>+g^$RH}+UqK6Tf6cX6ldpnFx)F_s$ep}p|0<5
zJ-`PH&CbM4viPY|yLA-1R*Z|ig+qL&tYC9f)6kFy`8t>n-U8m-0r7%gGy`mY@zqYx
zbhI^za;e0m2zU?HiFJ4oJ3w);)Twqvt!uZ`b)s|ldDauYx+`p+{F0B)bwgJh`{=;b
zUfg7?7%@GXBNbg@xp;4>0BDC<i<qh?$`33S-dLb)|MW?cMFO|evLEnx#3!XBrMtTq
zxmTNxKiHcO(nkpQg}sAT8bT^cRr<MyBiYem)!Qfu!Tzq);a05y_h5tpd)Bvbhp#%p
z@7`S^1F;CcXUKF6lI-g#Ez;8^hH@)`1$D(Q07G#=uciTd3CGOiaUzBS6?mkjEx!9N
zS`@w!!NdwjC*r2=jrPt*Fqv9`?+iGG-g<n|aan9+Zefu?@Fj`KJPX`Oji}RYk%{Kv
zBTKA&y=%rrK<{Fy9aZAG$qrX^7_sa-B>%7)WE#~uP*$)X2og(W{}azoHPh*m*J_<)
z2g}LE*)8QiMk3{;Q@{v;Uo3tp$<3D9IVCKV`$p!U+i7E(k1^wEPkt~~j+<l|w|G7a
z8lTbDkm7d*Ez4~ua9&UyyY_));@vKsY8@+?Xnl$Z_t0B(K(!-%zP}OJ2U@_^OR|12
zk2JmcF9aFtj~$OWt!G;T;}5B{J1&rkHW)xTj|(7hQq#d&P`IyNWKp9m;o&k;!UPgH
zQN{eicjmzdpzEyn;*%nH=bUc}7Nt>fvS+@@%*qmKfGZc<f#kXQaG5xG1hrAGcA@+3
zBMc|VXaP;4pGl$fUZhNwag?*QL~dCcPZ?|Jb2W!t)^h9IWWQ6nM2^|~)g>KWjipi*
z;?nviVj(y|oND<18BcN>J|vCCzBlyl2+>}s-C%2rj9St{a{3e%y}$@M%I6{Q-duy>
z@CCjimA)h3C^t~R1?b&6*KY^Q#i;aA!Yo5HJf9`Ml!yoFftXrK+_;LJ4pi$5UIab3
zn<rM3J>x6>8Zhg1@z|X9Tn*XsMBT-J*n@|A<zS7sdqLj+UC{MxRqNH6vrd1nswpjP
z`wbzMzps~j-RlK4qKi>ro!v@uxZJ@%I)C?ViGN`Me2`bUZ!;4w=_qbe9@+o;Nui*i
z;JcAw6xD)o_JnsM_eB02){Ivj^rF?((Om54gs_i={GU*;ZXN5n8%UT5sNnwtja9RI
znJS6alokGHp71N;@^T`pySw6av$y0bO8Ju?e^&_X4)!BLqu=`>{0!aI@c=0&7eRBe
z|JDEcxg!#7LK|~1{sWFWivgHm_95@!6~FG!5&Utz1&D%7j5);|UZEoX_knHkcQ+4s
z-Wwycl72mS|9V+BhKzrmq5pTwa6+UgN^D0Ox#-m**Ki<aQqlRISXfbqZk~I|s0NF)
zYQo()d=YYeY39~%^5}waaSkmk&*Ug@=y>WUNKJ+*4*M^yreJ+?SjC+D(?3ELzmA0j
z2!XDYQ2da2`qKOfP$dqK0CgEsaUVEc0F?8z{x%Cw*01oi%o==z!JrkjXe%V0V-U_^
zPZR?_+ISy{(SvfxTj<h9=-E3WGh{xEH)4Bm*z<j3K%0W^`5Sjdp>H3a)*FBXMXxSL
zT^~x<ebBY0p8@1|4A+D6r-24vk&suRC4t%Qhc**JlE04o$7+(S1M=XW%BQ5r1;0h|
zcKg!XDED-+kWr~nBikP*pX#A5M#XU6LWYmO3ZzG^Qrd??Dk@hg_odb56E-8s&0C3k
zJf~o%&|3=>T{Mdt!#!E&1rHY-v`%I~V%fu|buB%ugH<!uwY{>Ek^^b__6Pf#dQLD1
zLm*qp_z<XoKmt9cbP-?$_P%(av?4KRSc%$O0$diuDC69}BN@!lscEL+@$L5R$&S$)
z;a0lLG3g#H^O(fn&bOjs;AU)8|EQE5AoFL8!BE9VJ7G~B<Px6IvprpW@wJAQp02C*
zd<iFw=Gk|>RmCktPK@K_LD19W!_|v^4zb{i?6p#p_P7cb&l=D52y+D-m1r5wqjOHz
zfiWgwjP0}KwNm_O2J_l2^}T8OiKF#_tl?NCO(W?GmzErIyXAc4ZpEBe{Zk`*;Zj73
zo2}qsfZa38)2<b61u>Tvw5e5RO7tYC0yP+UxH4VYbXixkSLSR%+?5>GBp7?UX0uvZ
z7jO54PBc=DV9H82^Ji_$I;tsHT90^YGgfnKqE7ax&{9*xI&W#7x<@8NJgPi<J6ByB
z&zNKo)v1^jDUrLeA0M+A@|^4mVPpDlL3>d;KxrmgT|o!bcr8kNN9F<}?F5*5MR2p!
z$!$wT2L4O;*S#;iJ(bO9Pa`9P_q1}1&uX!ABGzNFRdT;X08O=f8mDEFfZo;@yYKWQ
z=Qk=kHQBBEYRolHxE%(9*V#9eJJ`;NSgbVsj=FChZ8KO(K4RnsOa|cSTxQCNrF9m1
zXDjiUJdw0h@o<7bmmQ_>YhTo`LWVT(acz|p+eOUPn3&i~sTW_Bw|K&pMiCc&BEy>P
z+Pyex7MU085EMz5Ownvat2j*kuJAhDZw<%lR*+}H1$Hq~e?=lvH<(g>U7>DfYd%FB
z#`W~6&G!fw^HJ+s(3y_AdqYYq(C{fj&7}gHK9zTJsZhb8!j`SXt~G)Ha?bgv#L1B+
z(=54Pcy3$@hv61bp-glb5cCO(1`c<+*_+c6YimG{*okuSk`vBHwUSRo)}hOa-MxS(
zFwA6ZhrhmrO39GdU*?=L0lna^J<7uUP1mN62_Q)Qi68a*?-)?Mwo2-$<qWzsTsw&M
z7rT$|{JMAcvX$dlg(}5^r#LIibYgzd<1R}vq5~!rTw<vh`BDt1d!{EYWM8m`g>9>B
zp6@hClCP=9)vRURa7Rir{-Uwva&Qkpn1#-Bl%M5u;_Y8w7%Deonb375Wbp1?5)v)#
zqdnsVmTeC0-o}hus$4$04E`v!Myh=Mb;qYqIZ9<!zm>0-u5&~f?YY(!Ou~n%#(*l7
zqcJg04uxiIXU;H)M!9V#ZpkH!`hD=_bBh{|evnS69*qgaA2GYvMsd%y{YAp92)VO5
z*!+@Fxpyv(%Me{rWQRdsr1rRyrlgF@0nW#-;77mpuBf|%Oirw)C_>76=N_X>NtF}v
zyV9_;%cAomI9>N@&K_#qUK`C=h%23h)x2+SZwHQ~FzA~0Vz-~I<v~KNs(2CGdA)Gj
z+B)MYP!8>U-P$wKpR*?kHICVGK9fnQRF(`)HGg_Z2i#MMRtfzeAI;=oVW&4<S&WKs
zaXxVc++cuOp1^hhAdO<{@yc?1B}P;{ht_&6{BmmdX%%{+_RcKoW48N5SXi`-${WLQ
zb2Q7$t0YO?F>)HSNkzzbw4j<-p}ucieC%UJ^~u319W5>Qn#$plBa8l=%V^=#5$l2B
z6#MDS%nWiq|Fkt`&mQaB7|C=?>e+9Gqa;-#JD{2zT>>6^(lGeMkmZ;NW(O1|X_~k~
z&w6Lt&ftBipSu+iuZ_i&J&fzpv_#rc&m8M`bdQ{Ek}hZB8PJ3j;2V{{kM9rnQluNP
zd7dglm#8<U-mXzmf4Wl%W}9fER2UGIjWhojz!V_y12Cz}1ska8YdrqZ>xP;9XHGM3
zT-6W2Wa2rWwDcmgyX>EMsfhkM>i@LF2QNsTQ^5@0o##xJQ>*aiYO<<H5^TPq+qhsA
z!?))F`)1TEu@51^gDBmD2M@kDICwqYNJXRkQu?zgR2ofM*<V@!z;DjEw=wCNV+?UL
zNG@Iz_XJk>SI8iY^_->T-6v$#E#Un|tQdB~h<Oy5rmOJCK>Zz7pE`xXe`QMk;dKDq
z!;B1}-%i%Qt|S-*96-jgA=mynfM3QlfJJgGG3lP+U*GtRYf}d#X^DnHxBfAMUoP-K
zTn<oGyV6Ab7jU`*Oyj0~)Lq<Pm*Ce62$Jvt=xsGi{z`P?C-y@QD8vx>!2fk2UcbDq
zmggI%?nagTMQU`WuVbc%&YH^E_cu|u7Y7hnJ4LH!rbGIk=r_~5wX|v+d1A{|FM{@R
zUe4(>us!AGBs-qNM_Y+BwxQE9J?ptq1t$pgqZ2)zYk&bhz+I+7K>kwxb-#`-h=P>h
z2@^l{Q-zj@&|*%!-|$&m5&%Jqm!ZXG|Cs#Wt1=geR0AzENh2q|Qd|cJLZl)sO(G!?
z=Q?F?yj?Sax-gO9L+p<HJtEl$8)pvE(m6vq|ALAJ4IP-3OErkw<dbF&J<dRmii%+j
zHQ!Q_XYW<f);gHxRLIl;=m4}PSG2GGDy_M6^DLqTgHbztu-j{2wTpJv`E$y4CB|7R
zp9|Q9;0Le$k0FyN0W)D~7D09^5zI%~gO$=Nj;RaLZG0!|)zC+lv@?i0J6v^M8p1xA
zPU%&<meEUF6GVt%GEt-k`)nvjpi|{?p?k7F&L8|K6#Vg{Uz$_}qWI0k$smuf`$z^{
zY?grUD1Ye_P&01en`JFSqDDI%OZp|Rux<Um8o2Tittu;|^n5YQPkA9nqh`1}WohD&
zhc!4K%yt#hblg}*fGnmCDi?eYPo3fcsR2GWn)_R(S1S0`dTOH=*=I?UgdPl3ua6W}
zDgs^`CeJpJ`2|puu0Of)L$~ygX$xxC-ADiNPRhd&vV3;~u1;*30Yio2Wrlo>v~!$f
zcxcO>+q7>Yi!oz78z{g%@wtuFp_vC(3z||(mi&yEOXiB2Du0JvVbUf-qd?K>ZJuiB
zd*9WTfcTNGpkl9!DyewPW`Fd{95_(#MPO}EVbykHZcP~j&v!s8a&}r~uWg{kTAuMR
z%1=x#k8KTU$E5UhAPqoxy1LvQ)UBXPZHXj=eR2au(Bm;>)~63KlpS(@;1gV>{h=S{
z*FQG8U?p%T2Mxa>!9W`}uy3ZR7B;gq%qp05aNg%p>Gs~#Ss6)_(eU~3q3M&-5>QO(
z;%L)tclT~Ek(g?>BEKceVOU*pG=tWCopR?ua9{t|cS{VCmH>eYOOcX7vrH1>b#>%$
zUl*Hg6C3WLi%we`FEe=xQy=JKS|(+?FY>!G&OjA7ER32>kj}%CU_o2kqEAyyp)<kC
zX=(}j2aHNM^y)02H7bB}#l~LR<Ut#9{c2}#e~?M+d;iQxu<{0Uwc*&fpIIbhnpO*Z
zlExGLDQndehMU7Z9duO&1PBjRuWh{>k$j1Cc<Y|rw6MrA#ARaKvQfP#$8kdAb&@zd
z>>4MjcqV+ZrrG0$sK+u@gSu^p^4D;)T54sOgbJacj`@6;Qnn7?qGR;sPI9EmCI27b
zNQ-^|m@zsvp;_J?nrkK><!6GP08w1uTgtzkl<xqY;8HNMw|ofw&BeqIL|ayNml{uF
z2X}5`M6$ux2Vdy0AGa>nzR&;Awhh!QJv;PpVcS;|J|*I}T|>f$NtWxqw?I7Z2~%ZH
zYyJh0thulD>>c7<91(No-FG<B>WeT%6$^|7qn-jWj47#Mb;yfR03Y$BSBDn>K~v)7
z=lek572twq_=yTUkIUzB0&xK_VJ!xLiFJG9)Zf74O=aLgI%!0nTn0E^Kv0v%`PhJ|
zSL1PZneqr-KK8l!$e6laRAg4)OOM_}t}?~uXvQZI(O6c~&k<vv1|w(92Ujk(oVI*5
zVIAZ(EkU?uRz|AT29|Q$t~NHihij@*&C!lgG?5^~%mvEcHhBkp$IuT&))k7@STzH4
z&{7YgHN^6{%j3A5?c-HImbB;gs8jNfP`PiZRSDO6J4g<$p8g~}cYc&ZS>FiVh$B?(
z#6yO4>`~CQgLY^lD5q&u^t3+IrU<|2w#@9NxB?v7!_+DMWIae;vm%KWzq^aZ(=9St
z*u#|~c4<xh3@r^nMbD3!l{cq@!1JcotaNlYky|Y12i3yxPwW8vFoLqc8c~=uJrN38
z3jQtTrh(E`QuYP;cp%p|6ID8%`Q9(}k^VfS`a}S<P)XH~Op5teV@)!MJho*-f6q$%
z>*Lx0oLK+%68}Fg@Q0T)V4-?gaS8wZ2LMxM{}2#;`eR!D=LeYSfh?{;1N*;z^0%J?
zrg5``L9*nx1fajB)m8#{*3#kqKQf&Dww{0gC5Qu{h5z$HcyT-}0BBOTjC&elj)08^
z;#?Z>t9stG_)c60gD?5+2ZUUmj59I;YBqtM^oLek^Yuhm^RPK2T-|(lo2u8^&6O`{
zyRqknU*MDEkPs82O`FRGSkBAS{~?AjnVCM9FI&PDKjo=zX8{@=skcP~<Rrx-o|DA{
z#3}sd5b@uMSrvZJ^b--i>qkXuOjC48QLn0gNg{!;-w7!)V)~?_4)7(+M%Lxig~AmL
z@q1z+-vFIHAR?W@2o5p)2b-dS2lTg)HJtyhD#JZu)kj^MV%=<(i!9lyY`S6#=t#KH
zcwjx-^qZ{#iFqE$E&sx)D2k#&F~8aGW=|->z1yQ1bhFQO@MBj1<vZgoZ53a<=O!<`
z)2EepJFnY~yKas-$ggivP*BX=t2$e;Ngav8!|VDf1<k_iq8}uAJ9Cd(Ydps<K{ZMa
z5Q7E<#1@q}R_#lT_E2j(z46!<QPHIFe(5`<0f=4O(P8OTs?#%wsxe9hJfn;&5r#jm
z)c_LtT!^MHl1&v%{|l~EK6bPTGgd(q6jYh3_LP)%vs}W*dCKTIVh0zuRpQgw|8Im$
zG-K_F2=!=RnpALodU|>*M(&AC)3VZKLOz~Y*yz7fGG+kDZ((KS@qK6FVdE{?q)NeI
zk^ROJT>o193B*w7A<D+S)5fVfVERh7hf^*tZ?sxZRp%aP7utr0>(}2poKb>u^Kgw#
zB6W}o-<%atQBe<ft!FCNmlXEn^%hv=z`p?@Dwq#AqSkIL;PehtFe$Nal|rUjNA3uq
z+dNjWe+vW=2NQ+jP;w`xJQm)|2?wiP?va|3!rlHgfY_0$$~f{&PyG36ki>5#LR_CA
zlT3>qen38g)wixm>~)CU(g31|r*8q5(5<{mB}<tBaDH8OvgfeyT&3`o4`^wL(+qz?
zB3l4p59=&S!!pDmjsvfVD*t45^hC9<%O(rB(Cp+OMikSgK-E%?+Y^p6?^PtDffCXV
zCbJf=5nFpId$ryI>osq8*Md*&4-oL2gL?<Fij@(5PNuz}vtUM@O4ZeGCy<;%nQYMk
zqdj7Q@@TN#dDALbr9%z;sw_h7E>{!ZM*KBJaz>gB0QU4GFd`Bi_J|p=%A<QWM|jIe
zCeF94K)Uz8b7V$?3(4Xbb7!9ES`%@4ToGMXja>U%a#?Z!&}bgIugX-5)&esw5`+i3
zxNL`TIV==PRb`AW&5R<Ypd*M`jfm$ZL2|!E1ZKVhr=8QsUSx`2ohD{mWT&E0*sLle
zb4&#teX>As=xrD3*(U0Jpgg$8*-_2$@y!a~ZyJ$%;214`Y{ewY{V`tmgFWBR0hL<l
zP%A5|C76oP>N75rVNNe&M(y$^)o*w4R6eB$Uvoi+VwxElX{>ot15)Q|Wi(cS<Kt?A
zsqSHNAloH-)JpuiM&-fEQ9V%ljr<yDb<d&Q3aCZvw`3EcflKz3`&D!l-h}uMVdUPM
zI#gQro4Hf3VC!;Qr?<J)jv~DW@LZ`?T>Kv^6!n6m=8YLebZWVtLNZ)uDLJerBkA%S
zSbwIU{;+XB|M{W@oU?~!Ja>>L%~|StN9p4f&sZ9`1yDdt5}iczRSaaCRo;Q8xald}
zG&PVSg@G}zUK~Nm&FwmbAspe|zDB=jpD(Sq_dO*4T>Ot!_^2uv?}e-x&;n?_shuSr
zvIWX_6@eX>mCfX5%oJ*wa^;@Sou^H<o`VFoFpJK12oc2$2p*|C7j&sf-YmQ(F|n$V
z>=}<ip>D#gtAGNKW|Sm%4ItPa{MZzA*?0eywh9VYhz?6?UcB$nhtRp3c`5qhCs`%O
zQ{;AcbZm^%<=PkE`6H8_q?it~TV|k!J^iZJo5ZI^9tV3}nj^Bc`|1+zOQb!SKFMME
zHDNW%<{1&ctY(^<gsdG)#yx%<HLEVAvGEkcl)f6j?Ii9Ltv_<lNWfA5i&P%n12wbw
zo4fc(tX@sl5)?%Ogs`v326oRqu1Q=Y=697Ws<YiWY3&c+o(}G-Tnea+fFDL_#t59*
zMpWC%GlWIa#;6E`E<^-e_~u4uFKKXW68Laffouf@{dCD(T_5Iw^--HaEG#Tx>kr+!
z$9p{{xlC<y=A+vopZF2qDS?(TODYbl;}_l)`v|BVM>Q}pjaCIb@fKBvu*<EpS$m6Q
z1r`a8<k+gI+!r#-lCXxLV}UBTAQ7`!PQ_G}lsUlXT~z}5Abk+PIj)v3RGZCrFqQrd
z(9FCCb`|7Z*CSw8y-T_mK*%yQ)s^GiJ^?t)Kr+<&aBe!AJeqbCUCa|=;%&8DSiwUq
zpq<0;z<>~LE|8j)i@!uH;F7-QX1T_`QDoJKK5Ls60Zv1uOsaaI)m93gy8K$ruVDVi
zz}(>Fv<EJSHbq!`mQsz??gfRz{=|~$@HemA+&~85nih73;q%3=B0y1RyKVQi1Bz13
zN58iiwJQuKh<&~JG&%mZ905Luwo8yFUap>5XLT8&6J2pZ`-NQR%-(7J0+!L^gZ|a`
z8vsSdoReTY`keE(M4xJzYvCwdLIzNx_B?Al)g>emcpy2~2fLFml(juC^Y~AsTXRn{
z**lii;c_;cosh5Kl>Rm~_3E?c?0jvuVg>IwYZo(6jMeZO{j{5>3)9=^YIOzT?@w?2
zh2I1*fJ}15%Wj<?8abNkUo~>x7{6)c?(|hw*4=X)@Qr?8=JT^(-#gjsla3p`hNgg~
z*vZ6XtZQ8AHfTaP!zw>3R10=a@_jxyg#yRc(L{c`W|S4|g;x9*WM(h0B>iXhcU>lu
zct1QU;snMwM}O~wp8x@yQO70^JTdX!(aOkHxJTmb_eHLt<U5(uU&6H%=sCO=yJBS+
zW8&BihbCE#8UC8rU$C+SnRxlrQ~cvv;>}72Q&Qr@I5P`YKnIqsCalD^I$ona&K$S(
z!Xw|c`NPWVz#B@xClgu&8KMW1*v9-nF5i7U*<(P)?#Ay7OP&19qE&?WxO|x(=WlVo
zKZn!^z#7YPH?c+F83v5)Z~wg0L9*!Un@^Ez@Yghc{j2URa*?)X9&-K5w~<%;GKxHZ
zUES`W|AoD;T<5tKfV6$9oL*i9tbdJXr4%XAn<09SOqo59`Qo<C2t+s+2P@9z?Dg@1
zxLxik;b1Nv`<rT|(2fD8x-Spc&{*vyoCs9r0ml?5Luq1_0-pAqE0<0T0W!|cdVSA_
zjv6m<hmC5^>*}#!H0;GaYNw;KMg|~O(JO-!tRq1(+)eBc$&hmiuPcf52h13y3^@v2
zFZW@)L5j$}hulZ>t?6Qr=tV~){cwrRW=W~>b;ir1vkjHb48HOO#F=&DFuuVM`6h`v
zwT(U9SdIB)0+)<E!6E?g$@LlTnoDQ`O`OzQb@1XYcpWu9eHS5~Izm{j;7i+?-+A|2
zRB#6RZhSI14EM)94S4lM#ou>NqN)xE{90OCnvG;el+mOxm}(lOHDw#@x)iq>8h)TV
zs<B(vfiPI+=H?c0qW?xKJ|{tnJ^PFv{%G0#`8wc3bC?gew)6mPx+rY#s|OvlG&Oa+
zDqdn>TvgI#%S?!mntUFSuar(tr(5A;=~aZ1a8Y^i#1^hoK2m|i_ftKgYxmG&MLKxw
zaSs;TmD0S{?ga%@wrK(MW3KA@jZfo)RY^?=5fQ03AGnjJ$~MYY?7N+*SY|EMFE)zF
zQtzkNyw_g`I^A@zN2pJfAjtM4B1YI~&@i#EtbL|I2b_wnN0Kb+@3W{8<J}Rsfmfby
zpiCk{ZtSlrhcti6_oDKDL{3#^Jm=sKF^Gw0AZB~pq=*ElJWk=iDfMz|d_8#tt(Ko~
zxyys2h~b-LFex0_F7tRXqD6o|GD(vW)&84aOynvxY#B;6?$Tg(x|B@wpW?Ip2R=7f
z9+<0Hdu%u`JsFj1<_^TBF?cY{E<N}V`uMbJG>|tiio;tyvgk)Ylyz-2xY*d(YbqSp
z(+>NYC*1{Ii5VW3yzIlAl{e*nGetmZKP~6|KNDn*J+FrqMg~8k*JPDYdD@x`T%yXZ
z^I3(N`aOZoS<rFYU5$BB#IX-Ja7uj&5Zy&ghIC7pI=a)N{Y@fvnuH+;&(*hm{M9^%
zGExw=#y4b>F|GjNqex>dpe(c{Q9Ls46BpNkhtMfi2W7T<1}H;yxFKhe8S>osrjtNo
zi+%R$$zkdQpSP|aF~1~s1ClfPw})mXwzjreid&L$#MW}!zMP<?hOu3i-o)C2V;f~H
ztpqLNhlCee3^pTa)+3WQlWOee-|RFrn=1=*aX$)Ko}>L5c9RiyXiE=>3=IwQXw`(I
zqK`s0ikZbLigXkddhK!hx`#!Al-CCoO~WCt$B|&kPJdHF#eQ2v>gpL6AP6jLz-uh^
z>&VToUH5V;Ong5aEbq{}=lxL(D1#iHu-#$knZ#Y@aTK7NYOc7~sTnhPfBzKqTS|)9
z#q*aH`NAiJKpZnYR0Jrt_qfc*$3=B1s(+~0-q?l}E%c@DZL9I;*7e_pZ=)ym^#%O4
z)dPUANXhOdH7(NKUM36feiwnA`Jgh&Z6xt{s;eY2S`!_z)N)wQsDiIw?-B41y3{{^
zTd~^EUid}pduYcH1>|slnaLV`0+Il~^llvt+Sd7w7^_0f1P|nSEj)Yr{>z&$nXkW6
zWqzEV*4Bpv>DTBx1yJe3$EK&J$KHH>^5w~wH&1D9kv!dQS<u4$K7&fJV>}IW+8XTL
zCKx%L>1H{5)voZS-SDe&JL=sONI#TJjUn3&PLw$@do<+8Dv>o0+axtDElrSWm>SNG
z3U8WH%Xcvu_c6Nq7?7b~yWaO{fxie9xCbPv*ZjM1%|~-M4Vnxf=0sw_iLpGMk>D(0
zJ)T({MhrrJa&rHuJkQe&AH_&gv9f}KU`jddkbDT=wp@H6XU9tOXY8;Epo%*`Xz7ga
zS^teQ2R@Gm!?}>%u#XE94#Dbns+`>2QEZQFsN~0H9M797^z`&*Fx;bZ#~!Vhm1dd@
zg1`1I7z3gIu(J1Wmo~`hxkXq*?>KL{KlTfXNi}p!Q}2kNCIcEeR`xx)V%5ApFaVuf
zzs|lGL6XlV*f9dF?R1uFim>?e{MjcicfW$Y38*gJHtHM`PnX-2bQDE!7*)ly!uC+?
z5-QJ`$f_JF(6w)M@cfa|wW~Qev6rQuFFZn!Hfl9SUHUMeinS;z_~mEvuxzc)PK;qX
zS(#|e=1usf){^bK*)DS+jf!~<X!*sN&_iqah-5a}bluujQ$3X;^-i4*e4JtFuga16
z141K8X-4=bW+rB&qu#!<A?D<*A5#W%EV!hk0;)_GH1PaR<8D<}x?+wX;vTLbg+{-^
z0>Sq{I5DY93VWJ=il&}E5e3O#%}UM<Sqk8zVjZTSoM|)n#=HQ<-&CNb^e2CGwgqz#
zZhUn2P5mdMP=ImmA05>MN``;>Wb<wO5&r)OI?RN3@vWMM-9W}sP|>mP;TjG3lF^G>
ztDiGx<60LWhWn{Xvp<SClRQK%udFniN{si8Et$VrB1-kA%eRAeQ}q6(%l4)4zD08a
zMc2ixMyB7&n%;dO$oP~ljP0j_D`XBuGK$Lm@O#qDS~T{n07y^^=+fIN;$H^LU$6lu
zQy%)#<ehQDY^$f^+qu3^H*U+l99JG^ZpP!t32k%iaQqb(A)%7^D`fN6k&8D!Yj-l;
z8Ol`E;b&5o|2<hjK;<1lpFm`C`xQI(*CoB0Xo06{cSh6kzrvg6%D@Kt|J4=TNxkSN
zk1{$JcLHzu>pc<6P={rgeEj;%^bsHLJaco~slLfr@5GibUankVEK$a|wdFK~O1GK1
z#U*M&Em*0QlP##V;X5n;Ron0J4(Ps2{L?L~%cp&Ad<h<S9M^G5c9U*Y!0;>34KrIM
z<^7RTyfM8aa2rX*dfR-CYTj6!d|$G>d+B=%6mn;yM-_Mjt7fOEtsQ^8Bv^;27E^!!
zewiiSI@#zaU3mU>WQ~T4o!ca502Yx)!SY8TZH+@$`>);YmNqL-TGMSbUY%PR5~#hj
z`=>?m;zV6(uDJat^L?Ct9c@h|yqANJ`6-%F6o+xH50>Zm&r<hSurtO(7n!a9(gNJj
zg<j4fDBOmNd`*>Fv-Gv_TOIUl2$PTgu`&O+E+7by_X2;!QUi~T*9Xcum)7hzrBN-W
zmi`ero(oHxZTPQ>t;C@3hZWO%C=q~wODQXi6%R(k!8j+cbPtDKJDF7Oq@j784}KUv
zai$X-SGE$%CT5z#dXiQTAZe8pE}58YV*~nRDr!z_I-Tgzyp9j;`?<E!-7#q^1)<@k
zkM5(Qx-IS>44Zq>PiC7swwR8*=Y?ftlxiDjo-`aZOLhv^h;@8g-B-fl=X4ZhSS;R#
z*GopiLkHKhA*Ze1Rs!r%M%2tt7Qe-tz0Gf=jDD2E-q>X&=ASg+ab`UoNt4Wi6Zzs>
z>YTI7dQwC=y>@NM+d%cDqXGWoZk{wLlh=LFJa40PMk@30TLT*v@l|o!;=^g4QQ1Zc
z49ePz1Q10`a+KCBN6?Y|1|&lXF&^vR_7VcwR7;n~W~bD&IjJmCzOjnWh2r-yH>>ZU
zCC<`+PYn|iNxm+2a1TSEPv7~aMBMqlU36sQ!UP%qCriC~Jw4`zsf{#)^U_EUw<TBY
zi<zsW&haX640xW>zeZNOuIqgy9zMaUInq`19%wb*UTQ|2J8=k{i2|OklWlr6Mm;)t
zG_|&eMt%%807;t7;dh-A2x$3Qo|+X^DL=m)#45qs%#7J(t-;$(jY2N3SZ|OhYj58z
zRzP>FdwqGT+_qpF!R>Sk+8GB%$<XL`a0hLNfUVle{yL*|^1F9+RYa{$mYTeVr*ES7
z)s!u57YkU~!-$0|J`U{8r(}%hcA^obZ+gAazTwTvMeh(sDQ6nh!l@)WY?8!-u9Hw&
zvUGk|+nOM^^!1z1tQ3+erQ`ayZ#rXdBdQG325g@a56{CO!O1X7#i|pp;Z1Ev!-C>*
z#agAdGr`rzD{wQh&Ll1~WfLc>Xp#1Yt#zkNqjsRyYCxYmVr^wI8nZXiZ<1hk0CxIt
zcAY2>b(G4ItZf~%A)P{xif@(RWY}N%gh!Oxer2Ytw{yKC<5e<4R&G&hdy<Ul{$$eQ
zqIVXsXV*IvJjgojpi76Y0??Jdl*E@I<U90eiv?vR+a8DjEeH=pDUU~+>q*7Jx*G;B
z`=)7`xr>}NjzSoCCzx2k*H<-}PgY|@gHxhm5GS4SGq-xlb|L-7UbTuEPJaGn@0g>p
zQ+iLRrTM~aq)+=Fh0`4-`bt+U$Br<Hc>S($MJ%#B((&+34TuE^vHI{tB#W{+(Bd=h
zL*z8WW_NP$1iL5E@&ZHlh`a1z)!W_5F!Fowv*KdbC{M^XFRSPL1d3haVm9dO`A9`^
zG?i)_yjiM(>ig^E%?t4ke{5<hV#6H*!Z><$r~)%*G)>lguJ7roE2;0%z~CUg!jw*w
z&3stA7L|7bPX&30j~UFSMm(OU>ZNm<TIdWRDf|%b8pEuu(Rq*D-rhk;J;s<mn`^v8
zd$I-mkmj84l~9WugH~bAD@mceTUm-KanF@~nL7uY^%tz@aj5T7-IrFvC6kKGR)u9m
z^CxDYW7HNoYrC{wi+U{C0bwRZOpPep9o>&rlT%ZhnB|$<sC@0v*|=`-D$u-5qtc`Y
z?{S*C*HL#6M*Q(<l9TIXHJ%$vElAD0|7FVk)zmbZ;>x}JuDs9v89hnEc`^%Uw}Ydf
z9Q(C=ePi*~VRxcoT4Om+Q^hR1+dd(_CiOgvMA!dg$_Q{Xp0xguA^hUS&-vYb@a|G?
zNE&H%$(~&6<(a`e={646RJW<W&JIqSt$=@dXGt_XDuiNT<vOJR#luSvK|SFxlx+Oy
z|A_j!0AV~D8d^NR`Dz*AZ6W~=Y)nj=6DG+>s+|63;V!N>Zh+EavrNI!jHMmm&}kZf
zf~*nF@|Ig8Xl7b56$XXck2@s|iy~;=4CVyQWK3tB+;zVEzVV?VSXTGW&LJw|2}Aw&
z5csu$%gE&m`;%O9^y~u}>u7l6I)_<{f=aB02GuAgBYNe-!V7q>t~f)`eaGY*^%E~Y
zsHD`m%oRfh-*trh#p9IuPi{~=>|YbyJclV4VS<8qeVRU!6Ks1TUWg0Iiwg=)XpNVu
z3m&lB#+)8r_^l#9=l7)p$iH2z<vAThU9IVR&W${=65Z;N3TrQ25kWD^*u1>Fpz~xo
z0kB|!mY<(rb_W}S8lF^qp=Ym7h3op%c#v(3hOgO3QM7?!-<TTq&Mf;w;fn&|PZk~R
zCK3ndJBud^jTBnCr4`NfrEA8s{a{EQROfJ9U#3XpW)QhU(M@TX(EUpvWdXq<4V5nL
zZ{NcWn43wq8hudwHY_e`wMuDmHin+9u@<@`dN;r*O#`n~5*iNd@-S6C!TVXNCgEAU
z4iPG81E($2j6GUw4vP`#dP5_vpffYSlq-2ob7%KLZk(Q-GIImSHsk?{?Q+rS&eK;j
zOBr-JI^vlVB3lWnR-@KgP@S5kP+H@mmt6{F?u%owJ%sV2V1<6>coE+NBOM)#+T>3O
zWl@X$9*nx47mrRwsqKcd6m1&%TxpGYxgF-c5z+dcmDKn7eLuWRdd9lq-8(LoCUzcM
zQ4Ruk;lcuns~O}>Uq?~4`o|}M^BJwqmji=rG%^Yk?s3S#+`5HV55Lzk`b7x2)F#(L
z<X)F-5(ABBHiX}nst4J`ZN;;CygkoJtz;Og@L8N-XYVDsU6^v8maE9Hn}(PzToSxB
zG+tbD4BtidIGdSW551qA?hjt;j(6JQ?Y!o0i8pv9!as+957;KYG53+RuE;RGo}r`M
zo16?v=H#HG>pJu5EqWZUjK4lnal(Z&YRVEVuB>s%XLqEiCgW#Do&Y-C5cy=%S-)J{
z(&K(KwSC4U5yIpI{VXgdecC~7l{f8S*}N1D*_Qe^2wGrJ>ZGH7R`Zp~QkGVi1H*;m
zOH-nN$7fT?_vnK;vBaEW)roRN1_b!$khQU5%XQH(+>_%SiM{vGPCM0?!Fa8DS=`)5
z+8UM8NsQNQVlSpXa4DQZ4_zt&Y>0)JhPE#8ag11HmpUstkF|z4UE5O#GHTVE$v26k
z$cSv3ofSBYWZK%|aWsa{Q+ab?B$AkWz_Ywsi0>LyF}$*K>U}5>T;+F3VEEd?K)bfG
zMQ7l3!=lTcqa?(9Yl1Z$?Vrw29mgXQlva)=11hB3x_c)_ovFqgu7|Bko|{wDp?MF7
zK_`Es`)k2;7z!5PlHju27DXCHHSbeCqCGu9@h-IVct7}MwhE&&79s?=lyR(Jl?p}b
zw6p|OcGin9ZH?YGjSe8o^i_sx+L-UD9?Z6H%y6Ju-@8SEfJ-U#eIR>pFt5W5Md>yn
zFZ8Qx{Fl*70He|}j%P#6mc9yzRnbqARD6;`U)$XQYSxSB7`^h`6c9V*>OlR&PC5Ve
zU`f!2+(@v4ibh+7Da>_(^7A)O$2?Atk8ze!M3(}ehOJD;#-9VutFRk?#aorpIzbt?
zELZ1qt+uneNOIDdp^Wnq9tewmy?YpezS8uO<R=3>E)JVKEyT$=*n@`j@J374NS+L-
zE(bg^4UcSew3Ezp>^LPCUik5OO&l>Bs@+Pz&YSVuuJ@yFtm2}=tV>+HQV-=>BETK9
zh}=}R-U#Xx_CQmhz|yZkcLxo{K8kWbY<|K|6V&+PM=~JbYGqiRjlX)?t&MMpTJI6v
z#bPA>>g-Kv?U%YTBhS>%_~P^O7rM1&%WBq=ui?EoR$=su>ta$<q>tWas#h9>0+tpN
z&OT1~=P#L%&Mob#nwEh^x2QJpN3ydcV&YM7Q)$0>um-nUcP>d}K+%w1o!~R<w+;@&
z<vbj>Sxg)6ngssrEChrLvVkl_vGiw-06^gbZqZp=R#D1nlN+Z1oCnHbrLIbM$i%sL
zP_FKRH$rln^KgHBAIE8%Z>$FNsU?c_7xRU5B#)PX^SG9a`p<fjJH*%8N8N1?hUPe|
z2NyeZjK@pvqd>`sK4lNJ_Q^*}?8BY#--L8<0{%iIMexV<I}!yoE-eSw@~tWA1B(s+
z;gZa$Js|nxf_4gJ<OhZci9w-}BYK)_T_k*02O?0r9)G`?<k!VVe(L-WuSJ2^=;>ER
z`S(ll_rQ3==VXjKuYUDUBB3rA`KzQ6u{VI({r$ba|N8&j72cIy50Whg>Qa48cc_0>
zYJ6F&CF6Zl`|<hF1@L@zb;-Z|99r6%K0Rx|D0Uh&eyIt!W>$XxWU;w>@*8|)dDTgK
zGdNac0UO$SBgJN51<lHOQh+C1_`vp`NlaeJ&jkNC%_v}@1|Gzn>^ogRA5wdt^dh{w
ztep-KhL34t@>K)xP2>;rnim2krwF)QMHx!AAL~nvo&YFPW2};feo?~|3-f`q`*Bm+
z(XeqUZNYPEAHeiVN(4-k;z+*Qk>3v8w~b1Qh0cKo(6+aD(!n*JJI8B9fobkKK?A^E
zMC>eCE(VQ8S-aazr!=1M)g)_m3>Ks-!aNc4>6M$tG2`96+DCvlhi4qD>m3635<3fy
zRB3-n`+3yOb{@>!)2Rt}EZeH7t4w(5kk6o#(LJ}Fe6qDVW}T-ZF}@UaEAgU+$aGN3
z)ULzES9+1z&<osol7%{|Y{AZ#y9xMG-vaDxmN1z@QLJ;Ow+?G=PxNBeq_wt8clwWn
ze#M?pu0Gh-<rJDhX?yd{T?+?*ReUXBD{h|(V;_MZ`nTS|nxxaKe|ozTLt8a<<k13e
z)#Tx)DGRkp0mFs&bQ~H)H^$4ssv$U&Di32t$|7MpP3+}hca>OCg{H+51+!!wXxUfM
zb-<~#E5Z)f4e6^RNz?j18d~)d+Rtb`J3EoNE`Tj!Y|QYiH!S&#aQG$DWrLX((LWlM
zkWk-QA@`9f5<@=RUdMM?Gu34Hch}GOTv4FTCo2cdz%eUp9Da7Fy`6F+@%n|%h}Lt3
z3#}euO7W?J%eZk0brxOi5=SwAB0|PZDFCzALVAyu_y{T?*|l5APW*CCPAg6pbLDL*
z5|7ww5@ps1#+4WR{Cq6UC%XIS96CwYleH^sGU1uZu`EmG3c459zbjN#fs%1JtW@6O
zJu2+E&F@OBMCE<6*3;T7mfSjg!j0!})OM^U@%GJQs6~n4*B3Mk;VBtb=6h~u`&EE@
zz~<=bzO{F8(L*gQ^9*wT?)?%|MII1z$_dUT#t@D5z12?+%x)gwqF1HwolwTUIx*ic
zv*;RU{0Vv=aM_)lHq>^v>qic=1srOiwUe(Gq;W0cM*3NpEu5?}z!&;BqofxEcB8p?
zpbsnLOk3oxENNuyh0eUs3uT_d=7|N?$N&*k)!;DsdI~E`w^8Ueq_QQJ8R~L8=F)ad
zg5W5{k&9x-j27U3W1C2>R1`tIW_J{pGdRXuV;SFKW|URsuF+N-3IlL9zIkc)V1aK5
zVh&+s-pHV;(xDvBC+qPE{oskC#m?-o5f_c{Y8tDBgGGvMq86ePkzbyx&M{~at4Rce
zczI9yujxbBw+4o%)w?&YNN|Cj8`p|Ft_4YMUCX#@C&nWi{dpkma{}jH@*m?()Tn@O
zk9{!TNUW{d+{Y624RFSz^Uu2n(%G3Maiy@jn=#!iH>)K~qtlc_)tst<Cp#;Ppcf6G
z9qgKJEVFDA2}s4x(0O*=GW>t+y=7RGYuh#~Dk`F)sGvv+Lx*&S(p}Oe-Cfcm0wO&O
z-3>!YHz<-r=g=T9bPnC$HF~eL)b%{~_Wk_6cYFW1!6p;e8OM2?`?2r)A$q8IH3hhx
zg}=xwiw<eI=@7A7*8sN`e*=ea7>)YBp%OQZ5_#nbjJFFBZ~7g23I$%aE%`zOOOED{
z7UNWw+LS+qrgoK^Q?(O^G(Al~8BB%KJMXqY=YHl`rvaL2fjz{2J-Jjw*zkkf&4kdq
z4z8!m0ZNf2R8oqjli43Cwl<tM-?}uaCE*Wn*xR}(MN8d7Um(>19X;_#puvP|Ce^;`
z;m9s|!7x;9xO36iDQ>o<Z@gBJ5MFKa(p2X>x!CT}Nq?;580>NAG_PF%{<9gl<wu9f
z*V!HmNG8$?NKtsN5KXxqsfA~r#%D#LrYOAKRt7574e#ACprlG&p2Ur%ols0R+tNAd
z2z{MAZ}3Jh-{^qbEd)5{6)(DoEy+$Uw~shE*XYnpFkFpjV`PVSn)ZY_p^?lTU~whv
z3EJWfP%CQ=Dq2L)9<(X+z7XE$oHw{zS+N;d0>15qr7XdOOS5+p0tbQ~=DRlBLg1Yx
z6Ec+rdSunM_mGaDD|C&Rc1b54!tADDwbRilbv&P-U#Frh``FpQpBo@Y3AMD9=>r+x
zMV=0TB%=ha)*5DRs>E?fz3NrSi_oNCDrb7%oUh|D&A^`J#TBoqpm*s;BToMC2w8r1
zBBaKz^BWHA-F`J=cGd-TJc7#v;)b%uN{n!R!bdQ@qcFl$w4`)DuZyC6B}DBZ;ko&G
z5QdD847W8vGyhsJark@}(XMN1LB{WA_rTY2Fv<f!c`PSv<s>&B<w_&Il(0nIO4n=~
zrCE;jg6)|C)^oBaj4Wj*>$Zu7`1$2F1Hr5lWCFRb4QVtq-^XkvpGZ7A+~)>qN0mDW
zy%?WNeb*o_5gJ^Zp=ky>NvOS8nxA%5>3MR0RxQUKGeEP`*PZNyRx3%fh8&GMfRBb$
zQcmN2%Yascgu~Wkb2WBT#24FeZ35?tbx^7q71rAeJ>$ITYBLop6h>71YV#TE5;$r&
zt2cS6XY(5-5)$o>X~&`zNk}4cGjqEss0AD$loho*Wf#Kz1uhFiv{y6>I4S~uR(lFU
z2^pTA2){U62$b}^b(Ezbu~^PCn2r<=;Bna37k)TG#9u!Q9*F0yU&vZrt1u9(XD#)b
zD4pv7RYs&|<q+-ao5U1;T|$?X)cW@5J$|NS%1qwG1lFVVBaH>*s8PV6_Rz<cd2jh$
zRjBC4oV!@j?}{v#6?M5Yi+MVVw)o|c#bWu#!@Slmg%IlF2yr`)^NQ@sNW77?fprAq
zJx|A-ld}RmYAnIGCNX8l$Tv^2!i?7ujg392-b7^Qff<XVnvD@#j#!2)$E;m%j7jA^
zO{s`FhQiCG<dyc+;&n!!s0jbYoFsDvYWNf<8eKO~i^uV5fd*SxXqjrQonMX9<p`Z-
zU7_a`bc63)<+9ZHtlVQMwY|P4aWc(aNy~)UD9Cc*R;hc2gx*(1wlMn!cKB8fk0C^X
zh7)8)ca{)H>UfavWQiv^9*lkMGHm?QLqCaI3U&gW-X<7C>{IoVl=`kz(R~NjZYrB5
z!;%UjVtu7@(NTt?=M;~v_gp|w8q(|a2Rhmr6@sA$rgrMEr)C}amNDe}E5*#6-1pj*
zvOn#C(I>|o+dZa2>_V<t<xg3?0ZV{Q+iy$WS>0?{+5Nh@?2{)k&FivxIop4Jtq05|
z^t=E}_+4MjB+@k58Bbpn!vW?ps^?J)qtEdE&>qR$b0aI4?4!HOG&JAvQ^)ra#gIYt
zmmv+U93P?EBT@Ceg_DqU*lK*P8DO|5L?+y7h;--lo%%jUSgrhgRw91jn;VVjXUV%O
zj#a(OFhx<A?c(T-N?M&)NWPgVdotq!38d3kjrhasjV=^VBOLGUDQOiJO+H`bH21jI
z2#p05y2+E`gx(bC)_*#25Q!X|H%f|sp<<QCBkve3t$4fO+3O-6!{(FK0x}7DQk7(0
zWlnwiu>_FF%=dxmz2kg@EG|}PZ9CDMv>*mAtT2A;A@#juXEMe9_eeNywT_|4L3nz%
zM4F}e@bh}9f|7Re<Gl(OM5CHbEQ^;%`AA~nIy(RfD0MqAOiZUOb=~n@P`|gxK79hh
zC~wtK-9OFz%>)6vSRns$m*K%yY{3s%NwdamkJi>zCpL-0pr-?dJ&ztl4J>AROtji%
zsAD*p4{CcnJI1;MMHgGHwK`cgl6~2qw6)PsJOI#gFg#0q<o&Fd&J?+EM14q-Rh^}L
zyy66zTS=X;bct^J5mUSO<~Jl;Aqb(c=D6IP+sG$+qL;|abEa?du`sED>>8t#Ikmie
zX6A<g#GP_7M!EWW=^h4}qEk1=Hf|43bEO_c5IX-F6@hF}49jq{$Z?LgH>Iv9M)im~
zi#XGZg?zQ*w=;$8BNoAq;>pz0Cp?iG%`vL!2jC8XRCUpz;Go?4>Z|okW@)i9x)*5b
zgPBtYYrYi8_bpP7Hn9vQyDuu|>)$(?GQYNkg+W#Z+N<{$YFu?mk_{mt*xhG`P3o_P
znS7C~ts9c<<qNZf$mb2Fxx1Yhnux9Yml&%4{yJJU+EyMA{K0->`Nrrcl?<4H(zJY7
zQY8k(yiu#-n9k;do9p+)&z={3<>9ss893@VrpdmD({?;D$pw319X=x+)5=)gC$LTx
zvyRX(jY|FEmBg4SHxMJ%uG%yRQ^BBwtMeS6Knosh?Uv<IcIakkzKp_WK<7Hc*;yaX
zp=`uOw$G@RYOR3O;E3KQ;4AgR{det(>&J*-J6@SlUca9#PtZBg2uLx1HX>rgTwW#{
z4BRu~^bzw{(BIr9kO1wrW{qz!;WE57TooJM1`7ykPpY`AQszly?guMsCsYruwNvFr
zmZkw2U_OU#3^<%~KI1!>>x<>Fh`8%og@fR19vsX<8Y?5zI&tXZh7VZs=IYiDU)M$~
zmnC2i%Nl0XrEMVVBEii9+Jo6bWuO<?5`wAfF&~9PB1E3nnIzLYS;kWbBS79TVVHxd
zp=y9FjSdK_1fMY~tPH;=IFgy?`E~sH&}MwZl!u*}Mp`r2+cm@x!^JjjKw+l+^L$G^
ztQ?>jR)>|Ap?MaKD4!%uy$X4o?36%X)EJ?H+se`KDC>nd=xH#(jIHaJ7r#dL;8?c9
zSO22_0YsLc(Mkt~pmdG>UO&U{MlxHtt1R&<wB66H2yq^UKF%KKvgajfh_mk&V0${i
z{WE0+W?6;4JdJ_~1GJXS6m_VLvoR%4DH9rRs8$RS@+ZYHjX(T~5e?M9M0iHII-XxN
z?G%~q-Bi7(_+D%(i=fi+)G@g3@+{STntwO);R$$6P$4~s@Xj!DVN53C8?yTv5moqh
zWu2LV!X#yGM_#X;re@0Ow}>S=8pu!;!EgL$0R<f5D~XUTJ~xy`d5$)WCVRO46boX7
z)P9-V)?0=@H&y!%*RzNzgPoZz<WlmMA$<TJaO<KM{ObMy<M~B!mH4sGym2Xno?0zF
za-Wifx%%GueSGZuWDH7*1&Sdq)Krn6T>&Ao*Q_69?8KXQb{caD)7I(j!>^WH0g#Rr
zq;LY8hr{Z7vZ^pN#Ap%Ow@7Df5i9{owmVz;$upLeTH3Cz!k(t_ACwUf4Woh%jzQ}*
z{&A7)>-8?%s;{P3(|W-&LTX<+cE@1RADQBiO4!QnzGT~x`^Gef*3SqCO6xe&%Ydj{
zGKe^bHnBdAe{3>SwoPQIkAGmF8WOS~dcf%+f3;8Hc}J09l$7vu?Wmlyx++`A0QH8d
z?^IrdFD?#e-Ge4nYQ%(;v@<DP!a(st5NR#7I^_X}946bm*cPVp@%rX6k71MkmbslT
z%?GMbqkeair>)<<30~zFlT>?`z^LMQyhkPq!4zJ&xriVrqWtzLHN?u!#aef71u}^T
zSFsGoL=XyFJw(!fxxD!1-n}NS8+Q5ZSY<yi13&uS-P@n|$U(mWB?1O$3O3t3Kfsda
zmnr5;I2x4%HqMO?2?_aZVehes-j}b}8BSbG9#dP*<Zejb(#KbpL9@;uR=zjEwP&*A
zc0OXy?tCm%$10;|!&#s`xd-8SV&~yJ!`SgIHHbLCsx*?0{H8DwN3w^@=|xAs;tY=~
zcujG07Rava-BxLC@@HzAX=QaqmnLAZ2HTot$~{lTc8#KKwJSRqM@j?fw>b2AF8Gb+
z4%(E#b#aI7lfpxNToq0yx_<5463gN3sd?kgXU{{h+z9v(z)dV}Cz3i(!calOFno`=
z0nTHfi)&0@Y&j;E3(g>d6@n<K9+*`t52#UMR=v>g2X1+WXiS{};SrJab|Okl<el+r
zR{7JeIdCy?&NQK3eGR|sA3@XwCuDHxB&PaUgL38ZMwcU1a*xYBm$xR%#+R~NZ)hhA
z_BRM_7SYX6GKrp?fu`taqLig=TTLtKSY%auWR65b0FHmMh}0TzVs3pcW(MjplT*dX
z$!!Fn=*j^(tKtlQU`$0<@H|kv+jQ|`$!PP>1wgIXsl(L#;%MqL1#Z3YDuhI`dR-k1
zo|)L9tz2KMArQS8#L8en(d+XXk)y3WEl%lMwE4DUjm6q}D!cB39M~vkVgknf0^$7f
zV$aT_C5uwSUZZY0%XEsew_;%?ObWr&IksaDT>q$8%d)|gB7|CN?_Tu(#Rce4Ck+i-
zI2;|xj~6P8q@|1v#9@+(KUscf3-jQgbPmEFuB6oFU=xA;7U$7WvOXS+AFE6r{gvRi
zJJO9A;ls=&Q8<8FDPJ*9p`J_W<Zwd)AO?|=3c5Vgo#x?8bGk^H(V4Dh_{tEgtF+RK
zrdGXqzM$}FC<{mhk87%nXorcb8<Lvm7n%!KCvB%5Glzu6lx6FCb-YVpb9U;;i!Zle
zT%r8F$R(Mblw7fmoQwqf61$b#J#M}Gy3swLk9E9k_RUr}IQ7*%rs!vbIsx6{MS31J
zV#<?}m$cjiGmM#P>VaTiOa6MOJQKx`&S~g}M~VI+><k7pJ35^CP){83)INh#g^q2S
z>`=uFw&Fsa`uBrxGCL>yLsg>ki!>#_$nyzbu4~$!g)v~p)bE*ii2~3=WaR^iY9Y5?
zSsltH)w|sT3+7`flRD=^y@d_R&yTQAUXN4K9Pb`01z3!;<k8qVxjalKlZeuv4Q6Ku
zN?=Ksi^k#B*uU+1%;j7UH5A=f;`beD*sJr>ZN=u)itnGUSSdu<b!iR@&s_k8(~h;H
zG%RemT3Todq?!C@Mo49E35CDxgNWAyW_|+p6N3|EyME2lAbpX(JUI4Abc+30e{ze&
zy-h04XxY$268X3DT~7lKx3X?`cPiF5o_?-Y21yr`z?fYecU*@z-Fq}4%qy%oQXflZ
z!Vb3pwhZ~!C#eY1cms$s?~4Zv6bUS{$mHc`&&0`>ar{T9vok;^lMYJ*57V=(avto6
zMoS5=$8D;U`xZ0);W<Znm8&ztr9<h|hDHblWs%X?tX3ok`v#nB+(gm5ayBpzhp>d{
ze#Pg{Xwle1D`7)Fh+KZZ61j9ze-OEvPX;jeJ$|qxu)W{q<>j?%RdEU}B#@!||IOw4
zqo9uZwORDt6$kerpnLSMpY{tgEk*v_l`@g%za4<T{q6sKho7g+uj6p`{^}BgCg2j;
z5nI_*=WFiy6;b?a_sE~<{I76)7zg?%02|pv1aD4_-+9WnGv5{(U>~vmFU90_YzRQa
zy6#x3in7K?Q5KMut+Z<aZ_V61X>`e}Ac_3#%=<A@ztshfbg#O)x-zM#KA}kQdcyhe
zUxIgme4xyrpP7m>2NwHy^~T9b$$Cl(7KZIk{?mWe6|iH0FC*k6I0pE+k~yN$<k6Co
zw|1&nVcfYRv5K=!^sg6qRsb(Z_P7~?`Y(X0B_cv~8Ovxic{E18ayx;~ekVSp8zlz)
zZHWODp-B{Jusd)B_^&Sv^nlIFXzi8`K+5o3b1sltNozbZQzQJ>3MR8c1L&`(7bV=l
zqu5=Yp60Wjt}~yhu!TYV<k_}P=MaEkJtE=Ovp>CjuXra@02PC!F=n7+67e>{_4k6W
z42G8bjj1g977pFf^E~}IpZ-z*Mq!j6)qvg9^|Q?-#%p3)S}Eniq9R<6bKrB!yNn*x
zCt&}(GBeAK(R@GkNQRjaHKXso9OB%%caPJ3F9_g23}unaFS>57E!nP3!!i{c5AmM-
zdra@k0bGnlT@;Xo9q_L6m<C|{eQr;%MSe)_uUv3H)8vcSr1Q*sR{!aL{&b*1E%W&f
zijjI|;tddA`Rn#ST8_-bjfBful>f`Z7nqtEL4a2|BN)l}`)T;gqk$j1TO|3X@bt$|
zNA#%58zzm<|K|923wWNVf4u0QU;lse@*_v|y`cP1eBOr>ClwYG$@CF||I>hek;Mh-
zc7xVvn5buLi2agqoF}1TLj4WJDlTjstD4axR*M<@P;E<)s}<jh6U%Hiw$|D`f&Ka3
z?UNT~U3)X?`vWB^7TqCyJc_RRgRkw^nHZ@1cSmzZ|E*WQa@Fkm-q4Wz&*ocSdLOIS
z*v!eQeL2onSzBM896Mmo9yoUdue`0_Ii~7-qwve5{)k%GHGqu$;R%7kIj~mW8F>S&
z???37y(}JI0WY#LtC_<UW*sFICC>9&o7y6E1gxu2tmDM(kUI|=!kG+s<R~PKl?VYm
zJcL290tk@_V-H92R76rpYaQ*(i)Qjj9w-1MLF(6*u_KcWCb>5@H=QAN8mFsvFOJWA
z^U?{j0q9dXe;jJtPbFmmX_Z&7c{{xWRV~Q0Ro74}z;_wp2!VdhgI|QYC;9pMnhqki
zFzw^j;1}5gF%oK$N?qzDf*0iDdujhr4g{`Z_x1M&)QwZ>JnR!u{h`$f!~`})i}n3Z
zlsIaRIE=j9v?4z?Q*eYf7BDazgu|^zXE$+sH#zFOhJhHu<wTGHHS1sWsy)Du<!@Vo
z`SO0daaiTH<*ne@(^3wY7PSQ8@Bm!IBm&8SEXKQcZiA^YXyE3P<&K><R2ViB+1)1V
z(DQH^CUWpB5vv7(OQBvD%V_|q;lk%q8D_1?`2=rPtxh$SG5rMQ>pos-nQyB?H0>(Z
zx!kQ@zLs88#E^%_nGf$8>m+4=@!~~$<RFs^a>2;Rl*#y0TvhsIN@J-;v>S3ya+~*L
z77Cu{qxWT6$SWxiUYN=GT#d+W!yRVH`sb`6Cb_MuW)xVr4h+d$i0Y3ZXns5F{XD#m
zAs_W;A4A_Y`yxnr;e`ngsxL<yPjVaX5e(H^eWOoJ)pd2Pffu^9hcBhy9Dy*XXyPsO
z7-pKW8J^4mbsMQz4k;>IN{ehw4(Wu!I<-XYsfiAi06?CjlMOhMoK08zDoiw3Dgxvu
zM2&Qw-;}HSW**+|8Uwvn!=fv~Zz8k)cvo#=v3K5m(r`G=5~^#sssRsehx65Qdv<GD
z`^<D2BQt&VB@XE13;V#&o|#*2y)E7NYC-<stB2>$gBP{Uu>A#Ia@Y3t$tAbR8gQ%8
zGIhe6iy53y+W0dwAUt`Mb2qu7vNLN28^mfiM#Pd%qwU)MTIJWTU%@PbOx7`RSv7XU
zS}H0kSG)VO>sFmmteXDLslut6mCdJ|{(b;C0BWQhg##<k6^8;fsdVQ{7&eM0$KDI@
z<ep}~L3_4w6XGzSZUniAp?#h!mbe~S^Voz6cd#>b@~vAhd2jtWK9@N^0o^}g*3%a4
zm|^J?7sn&Vqn79nB<c%ZXArm@a@`Aa40UFvXwUl2<Uv^{Bx2sqk9*N4O%&T`3mFB4
zet*C?vc0{1N#1bE1b*GZVF4J+&M)`IvOwJN__U3c=s*bs`bE}ClzEX<uUC%m+}Ud!
zZVzu`>}QurH4me(l*yE1sJ2p$=n9?TKP9wh{M%*aucJCZ133HU8XDJ8ibS!+Ro8hB
zfiGnp-$0ha<hysmBZzS;dKs!YdJ^g%C3ZA~ZR|uW=~FoeXcrcf3E%eV>$@M^J;WYH
zMnc4Qy|eauq!IGftNjg9xCHTZ=Y(i{^nG%;xHfTpx0aW6rkm>9(Rt@y+MsUIP;&Ea
zw`29wG1EU4odN@o0F;Jhi@R0?NU_Pn{!z5>&K%V7Tej*AFJg|44Hc>tcM=JbJ=_Bz
z9DpmrW&Is5(@9{4KD$>FpTnSzY|^H7k<s9&S*3_n!R*dDeE$doH&atVtT(Q-so%7M
zEe@NT&tYK?hyp(E`Ai<7huC)g&GJ$a+4h_*wP?wD65pcAVY2)Iz!uDov76{C8VmME
zt6?7TZFz2jva(T-KIwdOs9z*q`{^BSr>9Tmh5iReB#C!dSg=sdF2mZ<$&j^gLL!7>
zK}O@LodPbFZx-$r>G0-RZNQLCU#{L`1ssH|VmIuumjL$b)<pIC<S|W4Cks@&HnG`K
z5f4wI4LIjBClO6bR7I}~_74(oZeSt?MQqx?Y=U{eWeE(wHgd{?Z_3RGE2ja}bRtvb
zbSt;&uoVcsxw2HF=ip!y)Sxt~9>Pu!C8G8$*IJJYrR+Cf7&C1dVdc13J}bNtm@ie5
z<A?OxRW4Lg-id#&{by1~hK`nq=%_PD-uPAkZn7F91s?2v`j^}ZPc|HKM&;bwKIinY
z#$71@B}iQ8&0tjh2G_o`Gk3z&s^n{~fb~Snzmo?HtuNiAb1%G4i0n&=eH<9;a=Gmo
z{zEA8{Na)2EkrxJx(c;*wz_9D;P<c(??0{C-+l4Ao)DV6)>lE*Z%l|1Ndb}JpMO|x
zFPmDt{LA;@Bkc?0DAIrNc8F7gub`P&LQH;Kp|*q3Hz)T28JQB~C9@%nBj<8!<}JD3
zzuMCNmSBc`KwlXCI7l8U)^x?<&;I4!WF!LjmdR}6$52|?zjoWNKW)#W-x9cdYj5<Y
z<;-6X1O5Oc-Tz;DhZJpr-u9FBe&*E)vc2&+L%gRMu=u9t)>H3LGX}oUWbpt9HzX&z
zkG=impV;?vUXIXF5Br|o7lgXG>^zEL_EK88EuCq9j3Vir%8!?uT7+|^A8Z)n0BnJB
zYogGoo$0{1>eh?lt#2AwG@Z0iHZ|HVKw41cZRYx)Gzb+r{~FmHoW4M3S*{<eiww^j
zFb*J(tN;Aqmu2yvFX9Mvg*{)J#8gIkHMlc)JH+Dqg~sXW<QHnb&KV!r4T&}*7Z)Ho
zX4jMYYTI?3pO7JAXcYZ3`2j+O7z2>i3>^JTYG?>lfSe{M3gni{y5>X)2lok@DV5^$
ze}Aq6v^Y>rv(TR}tKdXJoDZvL%F)ogJx)T)KU1SpB%}I!l~yxw@GOvb9h;2B{7VB!
zyj=?1oi1rz7E!hs4fX%2bVu2i8g-Dt!zok&qH)w+`()mlHxU%ZofTeCC>feCAj#Ux
zOt7~tP-@iQNki{Vo~|%%1DBafUGsULF&0d7Gt*;7&$l&bl?E4S3f!pnHW{Pt;IY}B
zEPU@J($Xw8_!J(VTDCG`e*}WBO|W$XLJT+0_(?#irqDDA;9(338d<MOZ!4)cbNr`F
z^3MzaH?Fl?sAQuWHy>rqb)@b+Liem)R79=TP6SfSRc0PXlb!kK9?>|n@$_xL&xmGD
zPN3UeF$>5MpzV-=ZxFV7z8ga<BPC|r@2r@zSm<>MtIpgeb}vqXYqzS16v0fLnt3A@
z{I;v^`%pxNa<_I_LdgFxaD%9&wx{vsDlp^TL?i&tAITJK$cB0C+Bvs#{qW6{qM9j-
ziJJaOEwzBTgYcVmPUp&R-@c`f{}hh7<;FW;G*C;}GtQF!Pp<jbLOat$19WBZpB-z6
z$nN9eK)c8oX8_41o^hlR-h_~8N_u)a_3;s-AC*FUoX{rn!sFeCrkVP>Bp%M=l(|pR
zZhtOFY`-g)@%*}z6w0WR&^_}@xp^hz!6fhI2VY-A&;GH1gT=RT+!9_-q`O5qmBNz`
zettr^(h;o-8?}cLsfU8eqbE=p=EM@#y?fyXgLoPu*4yn%xqx7^zq8S@Bc6TBAT2Dc
zxA@eWn<M>C&>-v)u*4{QYr6=6?doj+Ncm?f=4Yjydp&&;0KPM{w~<8q+KCgV$Ku=<
zlKITQ3D!`OZxju#8%1`Iqy1FUY{0RDe(Mgzrb0oxOzdm7#-Yd2{j;X6;W~74mNeYY
zrMX(Adcd9GaMQWL`SN?}w`}#wt<&xPhrtAy-gVxe?e>+&%g*B19+LNVT50uc#GS(L
zywdq|guo?07|d`7tfT<2g2Y>!cRcvq&8c7E?$vAjIok3ZW?c@vq~^!Bgo0}}5NU5?
zdtH(xqbTdFmr4M)ZZUD7MQ#$$zO<=H4ib;)b1gvKm-dF{cC7<`z^RZ+){@ZX^wLF2
zts?p8sO~j$pIXoT{F-u_%YOSRt?ziem-vz6EJ^^&WZdD5(emtkW_4x72nN|{lWL>=
zb?KwR5E<Xkqfuq!8|zu+Xn^(7I;xkG97X~_6x82I-fQl+egEThykF1r5|Yum@WQ!5
zf7i(IVY6A|;BydoIzztu>$MtTBCpk;7W0vfs`U~Y2_-cDxJ*eLwHI(ISKMC+lGr&Y
zjc70pJ3A(mn2L}G^S`;c!wK?(-Cw0pZLmKQU90$^mfRK=0NPkSWgp}yC^+<CIL-xy
zmqCKg%;S=@hbobLZWnW#^*6uy?Ol2B>yi2+cFxh=-}ka^b0hv4Wr??GFcUZ%I8Trz
zsxggTj-;;DkQierqU{r-Af^8y4~hcP^YRaAC}-WUcj#wH+A?4Aj92~~MB=bFfL<v4
zjWxkPR>D6c_uq%SrzNlp8xPKP9sl*>pQnMq`^P{I`G4G7fIoi;d{(I(Y05(9*gz#R
z0uV_>qDJM?_j4HsBR=2N_}hB<KjSrviwyu2m{WJ6ejIg~e*qLekRJerUD;a)_Fnb%
zFR2ejLz2P+-#Ua&wm4ouS(6V+3MDYBLzu=p8nfb!N{{Aya;IhKp8|7R&E{5)Ts)}I
z;jDF-8H2)sx)h)i6AwBCsJ%M;#6MaM{5mON*U|UDvq@u2sFPaY74CN9VTypi5kLeJ
zo)HT`n@Yn~_|q~8P;R2?GyJ}Z;;5)ZL>&flqXP7>kD(P(=2kjoudg{Da>Mox>j_yc
z`<cx{21HDexHdV}t{YC7nt0K9lbRC9$N3c|D<}9aFhFv!Rb7;<;MR3)k&Bd8h#f-|
z7x0*_HUa83v(i`q?-1paMd(=K<(V?GyXAf)?bu9eyKzZ}8?I<$kw2(S6_E6PK4>r>
z-32BqYhK%4f%IJojNIX6+ek{RZjbj5<=-+78$_l#zVhMAiT!uag8LsMfZ)Yp+mBMl
zA7!EsWUv8J`%+p)^C&4h0+#|B6>BXXud`iI+ydItJ)*Np1;o-JlUKuJJiNEs7V&20
z(s6U|bhdPfo<`|^6Fh=v9qU`QG%77@_UEPnhm&rN&#pTq!O(zz<c!bDO*<RbM-UYo
z966b9fSMI~@_`;06rq{ty1&iEP5fn$RyIT;!Vdsxg1VV0%NsY;NOVdgX$TE(_Y&M>
z=uua<zxYtd9x|f-f>9XnVWu}ANdpL#n;SgDXY-<4q}fwZRynn1eo4BwGe<ZSTLG%b
z>N1&R#GnEoljt-YL`nbt-o8J6dX5?P-e(DAI4Q<+6&p7yblrFZ_Eg?!_$P*t`S}Ni
za7WSXhqMpDCF*Y^8D$N*(~~K|B^Cgv00$a`ieEJ_Xv2gb+~l_25>?n_v6TU0sjH(k
z1-#l${TE<@sl7TvBTbW1XMV@}BI@n}DZ!e^gruhE?x8DXs=+Ukzf%yuV`Of+N|Y6G
zb<z}kEB}S3*opfH08B|e%hYtP_9QE09zb>7{ry=Up<Vr1P80y&|6EcgcVKD;UPaJ&
zA-GsrEKc$>C!Fx#o*k))i7f*FSEj@xW#}D#g6mOUidif{Rbt`KU%U{bpZtM8RO<~Z
zN5&m{&7eJrH#)5dMm*HmaHgxYlACYp0tIeBRh6kDGG9N4H*$R4mawn*bXbegLuss)
zGf(C7*7#~Iz0cP_^KPJ6kufXwo;{I{^qqjhqrTzc;D!xArv_Ygh5?1G4E~f&hoSKU
z|Ep%$T!50T^A;K!T1fh--;K9WJ^)`x4?UBN%;-r{l3`RyVq)?&g#zq(i^3U3B+|V{
zYlO8gI%9z7Z01a%(}?lcegES)yb6p<z$|$QIxt|wNmoTf5?3aRT?+6X)0L_jh*>Wp
z_T}aU4ty;_lO6g;X<dDsx31RJc}zE6jz`}YAySLS_DF|RufERZ&^4)#WF}0kN%_Qj
zs(r}8sAo6djR_L-_zV}b^ivpb$9#OQ-7wO?`wQaobBe^`fHNmz(Zd*y3O^qNHZ_&A
zd$rF1eH+kNfYoWSbjcG>>&C&F>)D4+Aj1JYXe(bMEM3gEafmA@j%FDxvGf9LE-JT%
z4nQBqgK`by<IO8|G>VTA8>biAp_A;JOyyl^b;B>nh;5u}`M@sUpc1j;ffPWc-_i0o
z8kZXSl!tQJ2QW?3kM=ejm-`9c{*_Fkt}cJmq{V8kK1{f=vbKWg(jW=7M9j{H!6GG0
z%P8e1J!g6h>2V8j7zT3`%15x}Di|QL`b9*2Urv`}fl~nK@)mhk9bg~12I#w(%Dqjg
zD?w|@(dK1o2E3OyL!VhD73D7h6>+W_S48VxbP>R(SBc-C1bGrVvlfnAc59fDwzaZW
zWc+1@`}d7XTvNc<g^7X0gvctgnPij?NN^0j6)VpzXr+cQum8u`;+a{*$1hoQZWE5H
zTboWCwMtQBC59D$gF0k*K>hRMx9h83UES~R3_O;fX`SDhC~+CcwH8DbO2a;)Yien+
zZuS6a%DBx{b<#)w(GDDizT4fgCm3e~opkB{*{<@P2pVrNoyof^BkyM}|KbAtybFe-
zFLv2oM_oUD-=k#@X0MmA{TC11kEN(U{og!rp8?Bx{J)t2_W+A+Uh2P?0b2s;wt4!0
zF$3lR@aquf|6&GQ_JH_GLGXVu1D>M=tTB52n;EbOP#FGeAjGz>0_;C)^MkgoJLuU@
z)Z8q_3(h?O4TgC1lGWz8^D(+ctJ|sVcqdA(0}k0EC_S&-439sL@jZ`GW3jr_VC7)6
zLnc_XAinbtxh+)UMcDp2?!*|kmqA~7f2gd8i*Ez^9kcEl0^<;CdYw#RRII+}S1um}
zq&q{_XQ%#^gfos?i)w)dnruq4Dn&}Q{J`aQo7KL$N5|2ADrBUMy(n*>DN8M}>2edX
znM7KMsmxzJd+_yAngV{!$i<$zR4hjIy<xa<kR}b{AH|NJQSN?l5F~0Tn|^Q7art;S
z9=MtvY;)z=e#J8m;CsK@hXD|90yLADw8oRLdPS|DW`h+&n0usS6nkt1fE*=beyw)e
zxb<>(`$J&<3xNA8?CMB4TI{lbra#%x`ZT@k`NsJcKhLP!hu&C8KO@smd+T!f*0{l?
zAL_7pH~~}Gg42bl%<jbWlLXt?z{d*w`{zDwvfMp;yH)ycz|;VF_A$jBab2@C2N#?5
zE+FMP*4}*~W@s_>Sp-nGuKFvO%~zgNlA70@&KN|6z5Bu}Q@X(EwYwc4?^;?XZ5B<q
z!w&>Xvx=vo^i1QO6Nia6FV9C?Sb2CR)2cjLFa!q?odt2i7jw@W3Fz(>cFPeL6?%Ke
zjYUF7J#|@~e&6>1Z5oK#7dWLaQ88N{!~N|py=2F8<;YHaA~wd8)>Yd0tlMeg_-uAQ
z@I%6k%2M$}QjLYCurC7f<mH1)ogU7~_Iv$$H1f=nd-TGWa4JBd0Y!Rf-B5#k4xOfz
z0fqKzH8jqsJ&uTM2<_FuxO)e>efS1Yy4Hsz@QvDkC~Rl|L@H2SU}R6k(|fTAaViQ-
z*#l-Pc}gzEBA@xYhDt<o>Nnu*5BHY*t>J+H{F=)jDxREV_{@Z{+b-d~sfl5o!(Q&>
z>{{+UZZ;duZuAG0ryag|@z0#-N55Cv>7P&x_Pfk)q<d2CV-A*BLyXKeJ$b^?i%7Ox
zIz_V?aL!BZx#B00&b~iINz@ae)2dVfqPQ#niv;F4a8%3s+Td%oPMknXg+B;KbO0h@
zjv<U{CP$ol+hVk=*739fwz?mbk7$B1b!uT5XD-C-j_IanY1VpnKDTcL8Z_Klo&dQZ
zKdwsw=aFiK-tLs!G*HxMg+?cHnW_TNyaGLGnT7Ti;Mqqo&gyZtFm`c`!Vha>?9eNb
zW%c^?>kaM*>nOJJ@bS_Fyf*pw)v`T00mX*uYwJ%j7XuZ_Yqf|%yWJqKIw**79aW?%
zO_f#XVL?ZV7ml$d#1goi3a-mu={(N(FQg)Bj<QKx!@cwpT29+nN*^xORe5snee;*P
z=k&N0t6Q@yWe<G6z#Xy)FuRVYtCaLFX5?=Kov`wp3G_a|O6aX~JEJvpWgfE|>pust
ztx$K9^?qxx5?n1vD9)8}QvxhiZrf`>9JaaaVD?KSpeqGNr}9g|d%Ue`3m^6|oqOrw
z_p&<-4YfyQ8epalpeqCuwAk4Vl{3}zh;t(syY}taK=XSIr!`Y|PVdvMQ*{r-7?pl5
z)agE5erjmCMBWqm@T-z>NI(PfPx%gDKU?v6nN)~A+(Rp_Ug~U6eTi~ul;1e`6LkE^
zRzsZHSv?`avxS8XcM*O=7$CY=O5l*%kG|&8B@>e5>bBNEd_3G9QM#^kZa0!|ViucO
zzDsUcL!0@joq4|IjdZtHa-a3EuuOU*vW~&_%z>@ifc|twLwo=XNS#{FR_7d%zztf?
zQ|Gp$mAvJFYUTnU=^4~F=CiM-r|2tHVF1KIwyu777ilR;aliG*6WhDG@J?p0GUo2{
zcLLbhe|e~U|KXuhvb)&53gmB_W5q&1m5Y8M{S#kp?MyDb${YX;3$-V?tq-bPFqIj!
zE96%YYisNlHiv=6&iK=f5?8wkYVRp<;?Ra!w+_h<8qos<KXyyxb|XcXlF~o2nHG<K
zWHX(oB%F*=d>buflH}DRCGZOJDWlklBI?2AgM({O`k&$#s+VPxj(I=@6tY|z#|VVJ
zw}5Oq!cr11KiS^#`#2??ega}+-WdCtrRN(*w`i@W>lPJ5TV%NuX%3J+?HjdqvG})h
zV%4Ed{GMk|@YFpHs$^8|0j?w~fF})LOQPV&Iba<mJva`ird62R{oxnb)yjCy`lkbo
zt!jYQ#t1@^D3lx-4&tHSF;pvX54Ob7l}hICO`P(_U7%_lErb<+_39M2WTlCww)ejZ
zwr$d%r+<2UuBa2hw^XPjy@CV;<7eKwg57NPbdvdiAG^$L8U$Le&bq}gx5@@=qi3T8
zFeLGqkH()VrjzQ%n~bsy6LZcC_(o=>ouSf}NarR#sx{2lT1zxRoBEQ7ZP=3GFs(bF
zK-!ru;!PR;GnKpLdEJ*}!y@~fG6eMNRGd}*_$eU`)B)1jQppGL&fzmuE)u-Xgpdi6
z<cWy`V>-pxX}wJHsq}ORXQ2x*Qg1uNq3~mmD0hPRHRrC^WpCmKC*sys^<r9CSeAFE
zf@T;j_RfF5Xa~pwckF<zq!Lo#23B(wTLQR&c>y=DaY~@ROPZVJ23(_p?Ga_`yNxn5
z%9h9V_L#?92SuLH2Y&ZfwJUX_`}$tg%lg~osnErPfT_<>N>2+2*a0p$0B45z++lHV
zvV%^7Vc3_g^J8)Fs#wv713ioT0CRr`W-EgcAaNXAKH*fc3PLNvABLF^vYW+kZ|6zE
zqlviXI{4*`UMCaKxlvmVb?LzmBpWcreZSY(bVp#S(9%RH+@;TUwa%YbcQt5^HQ(pw
zs;Mc*@sxS-JV0oDoFyuu9dzS@q~6MM>~tL_jiCm8`tp4M_HursQ%D@!YMx#^2#`iy
z?R!~t9*vv3(U<NKmk?Ewi)B3x<J=j&;eNPKed!~5h{XZdVb-vtBwA)%|DmeUdH=be
z8<vdkIZ<mTnx}1Na|8&Yngu&UR!O@T<SN|B7;VS;JwSnF6D7gecQ)MjQ_fQ7TE{oQ
zbm}GUx3mIYPEE0U@NE-%*jP#|e6R+*VSt-Wc<Y>(F`VSkk(+F)A`Vy`pV{G75qCOS
z7lR@`kPL`~@B^&Ul*O|hSE{=nMQ-h5+lx0x3}|q}Yc(H_gz`Wp+kp9gorH{Cn{YC%
za2q?o;Wak;*xp7*G5E|{>&XQDYXq=8qI4KBx@kamx3!fX!*x`H?fd^KF#X8Yuz@<*
zvXDK^*exJ~zHf|HX<lhn<5s9zt~5Nzqwk71fept40Bxh^{Ky*I+Q-KSAy&B1CzsYm
zrI7JL>cI}tRJN3<$<az<1J<3}3echa6hIn-lpma>$pc(fBJURjk$UTkC%L)wz>d&U
z0O7y`B)ve7KeZ%GZg$t#U5PmmzloPycQbtumrUZ>1tX8z+qdnf@7m+RIaXqC<SxXX
zMr0l|e-y_xqF0LBM^>ju^vqVzr+oMfBwe>KZr#SXB^FOpTNeIiGrU1RZe0^<o<iiZ
z&<>Yns3utE%O9ERkTCNdjiW-?iMT0eHNhOilQs~n4tPcwSeH-m((<wyOrPHwjPpbH
z&mqz=Lp-wIj(0A{kp|Nv%K_<3c3byr^b{Z+A$uQ2w_vF$sqnGR4Y@9s+$eL-Dm|ds
zzQFX}pg1h7O!IXT6LMscH;sA)tTVMElRTrI)(dlG!YK=vD{n1tsqzQ_cNVXCG-5@C
znq3EVen8E)W&_-+!~9wHlcj*k*>0aUB(iHsWy<g?ELlo#o&MfL+?mxxP4TMrvzdxO
zgXk!Zs*K%{{(eqQqmu(8FEJKP<jc0ICz;#T6VekS!9y%5|4>0tQ~VKSzF32SqSFf~
zJh*l1mJR-t^XM$0JR5+~D*+@7#Ebo$@AchX13<;day)IRP4;`^6R(9J;~)fo@r(5O
z0{Hic9Zi8|wP6EjLZ?|;eYo-1FJ3ijV$K~LsS8<h1>a$Fj(~T=N3cxBe>5tVWVwZQ
zB;phcEgq5CAtlh)>N6aOmRLzpcIj*JhQKS0D&{ojSu7EQZP^6bZWfbM7iaXDLU;hQ
zkUOyO0J~nPJ8$vTPsNJFHJ9=fv#?PkMpz8rm%~g?>U8C{=L$gE_DThI-<J!{BqGT)
zhBajaA_07o1$Eb%=7@IzXP5Wf$9VGx05EmSeV=PCrXVDQZ1OFCRU6<05{);a;ck#q
zHo_UHws50k%(%n-xenrO@v3Ks3Tq`T@-{HvNaJf5oluOsG(IM~K^;U``P9)?6>h=~
zPmdqAWGnVFUWzRSOP5a=(rf3yhQf8!-D~N=!c+Q#RvkNO3yXz(owl~#P%PP`%6vJd
zMRcmn#%b%CnqdY1UvK}7e!$k#ndkd_8%PXixiK?dya-e50_-=z80xH%9wZa<6k2IF
zQ?#_K>#%Nxo%Kk}Q^<NWdOB`Rql;;B3%WAv&qH+h<60lM7rA6qz@WuyL3e|gv!Y82
z!C~+;q2`r0E-D&9-5GMMff*<JoNl>*-4IOj;B0d1gTJrv=KkE`M%xm-q@F*e;L}X@
z2w6ze&9+`6Dy`RGWg3Jv;SnWn6hhLercP)0t#peKpzxtP6V=Ehdw!x>>64NAG2spw
ztX;lwb-7)BlG4}As6#X3-E|Q|=M^L(N;_0WE9~{qYHycOSucY(vXW00RP5&v{;d(a
zQ8}#_B^m2H-C2+-1eZS7v*hXkpqIAU`xrEx#e49>x=8fE&vj&d%}tsO5*N1tb&Sqy
zN*x_nSE`ku$f)9rXM+cz96Arg`6s+<ed9d(Pcg@)$2^4eHjzTYYJTnQ4GYBp!Az*|
z@d9wl7*fVCJcmnUQ0}v@V=r7TKHONkUuE}D2_sSeVZ?@57*~ZlD*^x#{XTqv#mfwr
zrT(^wu=C#4T=p>)Z^n9{s%PSI#Ktm`WBaY$ZZnNoC?M&<lhLBJorm<-{DY!}@Bso<
z*H41UYeaiE9qsyjha&F6NyXB+DKm~&{b-cssr^!3l}C0314)pjNI*BQv%QyNn<O3p
ze5n*7I0`g%G#dI1VefCY^@zP&w@Gd!<VcPrYbm~)Mh#r~ii5T<R(7}h<f_ADn~Mzz
z60Z_?*76wp8n8zlmR3t?rI-O31~~02i}~Wso(GI_YN2&z40e-pw~J^s<43ss!LQZl
zp#uwLuC{}U*e}I8YfnQuo}EGH?eNs+TA;FaQwvBZZgB<La_l=(uWRe;H07sfvn>`7
z8>;h*tGFpfQ5FbEvE^f%<bLe+h6?wHr5-`w+H!gRIHgP`z}rPk;;vfiBqWeIdbGkK
zr$O=nikRlz=jAl}Wbv}5N-CD2%?@NiSAW~-q}$_M#)W1cFvkE?68LAE9!VmsnUfVt
zf*2yT)*m@AHXV;3LXN|-saeXeicy+=aYS%9xLsJg*4h0?$VDyLAz))O?`e01qo7Ob
zT!=C+qPh4CBzTWtYvqWuw&wbv{YZY*Whe=-kp>(lr`+~nO{`219)7^_Ad&)>D#|^x
zR>{X7m3)!3bGO!jUcDVK_DR3iN;OZk$t}_Y)p&H75DKawc)T{zveYHKL^6*k2(l9t
z7QuesHo{@&;zQoJM5C${AN5;LCGTd6FBr?s&az_<P)DiHJD}!F(T3*ZFKq(PZPc9E
zw}}z~eVPDxJr;YTvAZ~h;blGOnB#jZQ}V#gr$qflTP{FpT4?bB`miDGn)pvSTVE{q
zQX(g9X9YsP!@4HoMai&C%M5i3)g$k84``kkw^WPUXOh)RZ;He(8W*W6&tH`dNuoxR
z&K!e*_YrfwODdodHK*4zf|t*#UswyzORZp*nUixeLf8Nwh)T08gHK_559~(D7g7kZ
zWNUJaqBXxEsX3{Jst7Z^wc<q@tTvGqH47)MK>pqSbg8|~O&?##&OwZ_&+)6-G38w{
zM<848&E?cv#}0kfp*CqU_}-^pR08ilCpoRP2SlYemq;{(j(x0Q&!&;lPMcfU?BUwU
zFb#)CM*+UR4hB11jcfm`%r|<e5Tb%<RHR(kROKzv`JN#DX2V+$RVs+z4nW_7E9n)$
zZemtpC+3&o(KuXK1lHQ^%1mMH#cNM)!m~aDzK3A^;{pE8kUeK9)2NX&1Kkc0I)clY
zX{|3xj+JQm(e%RTLIU!Py3|ffMqQhmg)2suT#j6}R*UPg%-PIFy6jHgls95jDR1Y9
zN!DW#I@L4SzNC;i+jQgi>^V>N^6ag4t6aM92=U8H)~p2E3Lmu82E~)-%Il@28Dv)o
z`Y%FZ-Is9;&M7=G@}A0!G}@|2&CXn0=Q<E2?aei4W8e^$+iDh>^|7in*~w&&3nCz(
zl-+~i@ZozUUxf`PfJU`|lLqOW!7y2>TZIg221KsKKAB+6FEBUBsSdC^*k2<)Zj&)H
zQ@9Bn>VLzUOv&#?RxJ(<m3Z|rjT*{}QB7xwBLU|p^wEihKFwq4cN*HAJaKC_Kg7+%
z-e2q+uf)Gs0;r!;h|A<J7>|Aerpc0DzR^&&r0&M~uEneLX##>gx$e2e|Gcif`ReB8
zCRJfiy1QnNxPnc_EnyUz|1*K~#(HGK>DlwOK`i@TH{WO8-}*Ze`v6#G&n#}(3d$1s
zM{Qt5HAS#CONC(rKC(E&Ik+RNXZB0YAS3h2C1Y4r&0g@YN8~SmV4#b3wNLG6uGHc0
zZ}97Q08fvCS+X<fJ^ud0UtW!ZwbfJst|Lyv5$&I3t-sz!OcMAA(_G1!KVJCPuL3wI
z38^mwpX8sl*1uBf0R`YA)K>@Ce?IbGFZ}zF!hC`6X#72}ci_)T&0m9BhT=c|zZ`~k
zy{j^cOYlOt__s6y8kX2fn{vO~Pfv#8Q^GbjZgzLhb97e4z@w&!4CzEgq^A3Iw?$W|
z1s&$R=A)L;kB_oeEcm-Aspv`QtYRMBl-B${a&V5B52K*Z{vAMXrv#8~W>}<N67W0%
zu&aSl`FYyei9-<rrT7#ka;^QTJ8(yZO~eeI%dQHS&2n>iy72<>egQatrNLn8r1Ifu
ztu_Ux@~V)Z9{~}+hvAr?eYYe7jr`J4)rtbxz<$38x3aFXe6z7HYwqgWZ4HfsyW4f?
zTx%ZNM>?z%U8Odf7Aogo!gd}M`3ybN)~X-7j8iGXbo1kNq?v|>+fnzO_D31<F2zNv
zE0is^aMCE?pMRqk^7}wQz$$D6x>k@odA8C*Bf-yLHEqAiWno&Zjy+soGPgD4K#1(J
zmfZ^XdX!Jy2|?VP_DYCTmPk~Tu{TWFEscW4X~xuBcuXDG+eM$H%avb0uj)Bflrm_F
zkKcRixTU))Dy}(bzPma6I9@`fbA7Gm{1j8vz$QnE{Og3ricUa0g&O!Row#zutGjwc
zHs8qDCG4V+!&5ge%a%#ul3@tt#=SQ6eZuQ5!nv-`OY0U??C8L2no13YB5T+6>@F#d
zJs7m6_8j5IE}ir+ot3`N$!SeZk#+$(dF=9yeRvHL;-0#S351XT+K@k%u{RmILj-N+
zkA9NGyBK8_(*n~g##*`;41~!}1xH#s_NQss+1w}RL!aN_21m)jdA<Q_C2m~ZnXg7%
zQsZ=anQCHuZ*6Pkx%5?{qxEHujI&unx(n?m>+`j>@OJ%~%e3iuA$dB9v8A$7rG27j
z1oib(0)nLpiJ=zmPRA#yx(`b=G`JkhQeCbR**H1(e!qZQkHnq`Zl?KOB|2HgdrFyD
zhk?OJ7gi)RK@PO)lQ67wI}N$F@7C|S#&o_;PC?N<J?$jWi&<Od;Gke}u`mhRI;X#p
z#W`dy;^#Y7X{q;JZf}zhci(P|#MAvO=*BL^5}nHGD3)Sn`NquJoVMi@L{yyTZZdOW
zty^gR=~|2)9o|We&IG?rP=FHQsgty0@LjhAd*xv-yXo_GvFx<&Rf<g#TXC?txTZ9f
zxXk)BtC$79FysQgp@RX$vRmSD<A!C};A_vfHpe^cybtFGc;`KX!mG}9Fqq>nIB9f(
zKk*q)86=Ur&`CI%r|UwD^1MRN*h}!AV%JpL9?lgsM4deFE~+eFRr#zPd;`-noT1;F
zWIiPLxcsX-MJA0F={Nc|Hk!6^*R6{dhUy})ABN3uN$CBfD?nT#dMEM_72|y{q!JI>
z$g(+^R#u0p6F5rbJq`wq=@Kj7D7_VGPPx!hXoU9lea2<D)@`@M!p0`yk$0UHbTB?_
z7^o0ar0yH-yjjbjHM6{NpgA_W#&p1rA>r5P9+_w3O`U$zqdzkeBAK#*u-sCQ5RIL{
z4G%TE=@5SBi7tco(^v#@x9S1GP8M?6+s?wwTrpqR=cZ^cW#ZN*<K$X0FRXa|Mx>9C
z`Qm7$^}%wpi&yW&c_CqsQbvl9IwF1jixPSYV$||0be5vm4!1N9!2;ceJ4O<264-Da
zoDZe6$zqP=nZAkBq8i%%X{@y3VcMu>%bjbaRh<tlQ92$#MulR#OHF=57_Kp#7mHAq
zOf1k1R@x)vuNhG6`{*0T7bTi&^~<laYjOxzjPUWz8)@X(%`L8iz|wj%Uy288BnOjL
z5v=6y6hy;^LNvyRSEJ4*i=!0ux}ESquhYTeuY%E~zN_%pJ=0En%Up-Oa+kQm@gwF{
zCQ#3N5AUYWjM+EW3F#ikzFZaCyX@bwFM(@Z?L(e=XQul=zqfF9Zr}~U!h0o@z>}06
z1)vU2ll!Odo{?)<tb1FN^EhylI{SwEj^QS1j3lrq1awk3Qz1lHD??=m^t5ujraVN6
z@VN`FrzC6ES!kzy<ml`|UueqDY=|zTLNht0$A5A*uc(5RD_3@0n^HIV32Nw?KTcL`
zfw3kT&|58O$Jvm;IL#62Qeoj_r*?Sv$u45g7Er2}s*kI$4oP64;)R65$G?vv)UoXT
z`3e;WUrdM}DzMi)1OzBUY>nkoG+ul(oXXwSXQL$Ysg)EVp_daUP~?<b=mn4AW?3$O
zg46NRX1zbqOGQx!oT!ENP~YV#?B)ARtFf9QxnlJRXF@5Ex5Z`Gj*}j?E@Yle!?*Dc
zOG$e{0$3|y@t&}TmFCbA^6RIWgGiG&3)e`+0XA7GHw<YBKQtFfSMM`cYKdkw83dh<
zdhckv`EKE8Ow4^9{s2B)%Lk29wPWMe>4MhLD-+^uqcHC}&<U+{QjJ#RI~2zI5_F6H
ztDY%65va!5>V)Wrp^|TEeIhqjq+B_~pYPCllPO;;qR2I2!cZ|cXlW5*FD}_WJQq0U
z>_nukURSZ85mt~3-Mb~uMd^#XR2Y^(#^hjK=}{8OJ;WdYGweh;D&5(O<f^#=EX!n_
zhQd@L#87y6#Kr_`G3~DKC)RoD=2kxYMshp}!?AKp3*E)F#Z<Gkou#bBHC%_$(#72P
zwvK>OmcyqH9~Yz(@$2U1>YEU^W5j(xud6Gcf2Y57ZxzuIjMO&oCq6)951M?&C@+5(
z_w0G4;k+SpVbKh|t$lZ=O5)?2$G+d-`zVK0iB!vOSWz7j^|311$Qg3_T6Gab5g8Fs
zk)(Y%IFT3pY_;NzBUn&VtytbOQr^mMG{+=&ceC{cOPJewOQX(G&gWa=m(O!K$)0|k
zVP(i<zpDev4U1#20GFoy-jrC3_RGEHX7V2f$xoF4Cx$3w)R?s@H#@7jYQ@|ZPWS5J
z+tbPm+^%yM|6P)O<s}&_B|hjqg+XJmqd`$l9Rkw)J|ds^)ZN-*@_0Bu0H&6AI|Qj5
zB6(=GRqR@NnEH@SX`ZlU#PbkJkk}9#ogIYVX*I_-F~__lVN&~Tx}3ZAP9)?3_BzdA
zk$rc-w+MVmB}#cM3<3Yf+nQSIt8-L;aRE}rk4bn9^UBv#qq_S2s_l}Jn2IU}m!C_o
zi6atxku!j|((YDbd4h<}%x6J<Q77>%5;X?s*^5zo$+K3oyVub9JqVAsix1JFan^9f
zGL!~Ln}tM%PkB8v#n~VN+3WrVENPATuc*a7YL3n4TgPd=Z;!?)>eNXGTUhZTSVSvk
zU?XrcZu!U4lQoB9h-W2AYWA$dYGZn|-zCF2`RxPNn>G<Oq9KvDsuZ$Mj&xx->t_1?
zfT6`o-WY#})8YabgIw*W1&@Z>C9&_VI<P@>>x<H*?zP!v_HeEfS137r#Om>GQ}Fz^
zB0Le7nerb|MugsV-f)LXZ=sNKxFFadybyVwvM^Fe9lhQKfH9Cz)>bc#oe4e(m*S|q
zjd85H`rqiWLD5Oi=ws5>8KW(Fu+z5?74W9im@|i+<s+8>2Z|@JJh8%vFz^^clY^9m
zMUVG|3sr)X{W?dCK>ZaNX5q?N=(`;<E`eas!WL~pa<PHFPoW3>7JEm$s0`>(39Lv3
z<R_X;zvm}tkyp@6tWaI<h}UjUR-dLwW>-~xuA|+J(a>n|%~aT39jgznQ&ePTbtLom
zTVSFeE0@moI)&USSv!lYbS4bbya^U&pHoVaj<l0d0aL5%6@kmuBqi4t7C5=bu~y%{
zslP6e8F9_0Ez)FA75wBnzsLVm-gibdwFd3lPyqo20g<W#N=K@6ln&B+SLrP%y(1zZ
zqI42^kzOM$bP%N`^xgwV=uLXh-QgV1r*h6(cdh&DTh|}11lY;DXU{wDlxLoCGT!S1
z=0(-acHZNbr{UqDXH=2WR1EjIHOmu~m8GKnwV^0L2d0nE?bjP*2UYz*2oNyWKFEMq
zSTC5fP3fp75D}T`#h0n<KkA$N6#i2CQ!AmJO|^&rhr5}KA@kk`5ZBm?U5|xpi{fdC
zthn~=XD5VHNoR8(q?iQ~#*UJzVyKlGJaS#qagbYi0xMEv3SW_cKMq=|RuP)aZ58Jc
zMWBmJf&xEqadgrh4wO1Nq~7~(66uejSW1q5n`3g7&QUTP0ip5ge<<eUh*l^_eMMCa
zFe2;kdG4dJ@{Ek2d1DVC!jFR&8d9a1@T_F)_BlFd8iZ&3Tfr+k9looGfh%qzAFknr
zT*GVEPYX4DippDl4%vftlJQn-xl*h|sR8+NJ>l)m_yc=-8B6@(E1oVh#;Jm);R~q#
zgey;;KQ~mfh|4VToW4W*G4SZ%?vw>8@=_!@G}_f=uak7{gn_hjBt(pwN+gpe*Und3
zez>1?bR7ysD!Uqc??;bmGW>Y?2eCR@;`O;L@9xx77*HWrNlDQ{j*zy3p^fU|ecfo|
ziJ_jf07n$ZwkbO8_EsAdw*Xz5Uw`2~cA<=@joDm^tm(DD;nvL`wCCT1D^^T-WD=(@
ziSWCoh$iGvG4cA<c+kmk7Fjf!RO69x&U86P<a{L0xU+6)ZE>ece7lI8Da5?0#3i5h
zVQ5z2j59b!`h#wi{}b+qH&jC+=;y1a*S*p!n}rM&3^qbVQD0gF%N%mWlhVaEXyn>-
zp7a#)Y4+QE^&Kj|{xY2He3;p8Yk^H5q1@#~39OtJU!tg3w<iA@{awc94PyzE=uVIS
z<?69@6Avfc;c3qii(tVM1uFe$W3-BS=)EfOQ4^z5!N0kd%3A#*yjt1L!vkp{Y?;PP
zZXbVqdy=@1TYflQ3N)9DD}|@GY~GREwN7$aLxbTDVh6)#HqssKFyTdu8p<`?usu<0
z9kJ*}FA1<SO^DdZZk9w97wPLv5aNQ9NM^djWX~OJv2Eh^<!e-Gj-`j0AATd6V{0=Y
zfmrG>>5j2cpmXSJeM};12f;#y?QXlCVN^2~Z#VE=XYUJa(J5A@Nh*)u${~Z-Bp?dD
zECmRwe45IQj3rk7Ej4jnx&}yW_vtDV0TD@y^#utW((1WmCG99d&91rDVzmPHN00hM
zCQYbtIf)_&ysxHwpzEG%mv@_a<?v4K`VZR%c{nwd!1tl5)QvF_8Kvtk=rDD^@_=o>
zE45$|REi~BFiI#<d1`7ynS-D~;)!~Kxdnn}F&eG79s101fLIoB>4M;zbgc#7_FkWa
z%*#8TaF}5$6API;(UoL6@+M!SADujr^lTucCWjJ}kes>t1h!-$^P%5cPr8jPYa*}X
z^}x5)+!9H2sxS_p2vTb+O_{E^4P}6C$!F#(cz<-@pez^+)(-rNy-1p+U)q@t&@F8{
zjv|QG;dqOQ#$`YJbacY0f%qu*QgXU@xFO=f`#P0+^npC;$~p8>86CdW##+-pEd<IH
z_AW<IR=G${jwkR^P-XQC-?RlK6JTaI^N$Buc9uZ338A?S*1`lN0nMGWxdzJNflT9!
zVS4i6fgP=D4~kTE8Nk>rRQBq`6+dXTi#=}QY?IG6CLCf{-VkG<v~dMJ|Fl}nP{Cc0
zKgxIo&aDC^BBQuHf83H{WDhvm>at@tZwN)uq+wyoJm`~+uos?;|G@t+9w7;-G>?T5
ziSzS)%sY+i^T@JZ*vb__p|yslCWWL@uDjFnjG8r$hbN!#9i1O#?%a7R<HS_;nwNK#
zHO>Y>urTGkGHXwu=-MpAy=rr<V=gcE?G){^`wP)xNzFoU6b%N55w~VLTphO9WKrMl
z(IZY?#KB*=-pA>O5-%^^Cl@gs+whvV+d0akD`L@kQX_+(e^ZuL?MY{NqZVuc$ONEZ
zn<;h|t6CYbu{5ZJl-xqauRvFYU4Xc5Z*PHcB}z5?@spxAE}-|L!XD^#hNNQ9?E_5(
z;-ezTjyL<XLhq33Y%$SG)gp3Ep!9eQ|I!m$4yGHHd|(HX9BjS#sv~$3xyc0%cwmw#
zqr7odnekKb2fQM&qpq$bTGTs2Aw|$_LK<*Z$zpzfs*Uk;`l?q^2T*FEu*YH^NzIZH
zjfZufmyIfX^leuJT^zSf!@`W|d#Xjp7jy1(Jk_TmXeR;}_maR#7SM>yus*?#PA%rT
z2ZF*Yl~ubf=b!?MG7)tBfdKcC)A{@6u`V~;tz;}`%8LNQKIz}8UY?BpILcwRu(Mig
zwDC-)Ke<&OjzI9nCzYy!+4Srd=rWyt41A2#aKf`fq>|bm)oh{?4im`}Y;8s}1>Y+1
z$j-6oswDa_Ah7~p8R{0()%OT$SeMuiGS}C5+KltGs<HAm4I@b^*z^ronr$P+AKER!
ziMUZDmCj#G+z)*Kj73qQ)gB|={cJ|tVW-!=M#ndEl`)9!e^Qj!l`ajPZ%@Dk8pd`$
zSy|>{z0MZKjvs?s-#CNx2TFcG+T#Yuxjz}!NREH_h=;Ox3#7+AWrHxO(|Lw_1-Vqz
zp;6zTD~?~Yi-oJ6(7vcD5vLTo=R2KGPP$hV%keN!xXj+b^~LnEykWD%`+UYo%QCB|
zoAAQ7ad8Flo>RLfkP|H??W;K4S?Y6;HEuSkyAJtf%tDWr@3$)5A&;?=r%G>_O;b;w
zI;QO{8U3m*CCLW_xv*><1r<5D3feI9!sjW1b6u!r<OZ05;fG;hxD}Oz%7c>eLKTi9
z_$ol}%=f<3T+7VT!*U^6N^wBLCWQ;~I<=a~Yp`t9)(9#8tR9}48vitpIV$s%W{Is$
zoBj}>S+e7E0BOtFhg-FCBEa%JkEQ2Tv(wvVs^&Cli!6|}F%83XTWo>hCgd)0-r(%}
z?GJjP5%!RjDK-OQ8-u#ph8qlccMltC=y(gQ)ykN4i^dE3i`w=2#ivgWhKmv3_XwRg
zYEx-fAOD@rP#M=bbag4nA5hU%)C9bpFuhVr;R?B!Z}iZ&(QGHRf*j0keFGVb1Y$WK
zsIs2sEk@f;oYZn?-W{PI07psTsrk*u<;N6zua}G9XmGPc8?Lr8G4bSR%-J`o@1%Lx
zIOx3Dmh^ucAA3|K$ix9j$e)SQ7-xS)a6i6K3m{vHxg}S$pb)_Gpel{qBPu*XEvn9o
zQtitCeWRt?|0oOQ)y?zy{llvW<<6lu?@lwe8k2qb=iK8cVj*byFDy_K%cSni3Z@QB
zn<tstWQE~t`T86y&5qR`hLf_0Yn9hCPP50MQCNc2Z&dWW42oZRZsNq|x(Z?EXbTR{
z8JmL;+8Ec9=xTXYRc1L($i^!RMw$AsyElLFQl~HJ1t-~mX6wlo<9zgsIs@$}YQSI+
z1-hI4KY!|z$J&*m-<u2Bv9j7^3)MbWc!puv_!(rU0i##Fq-%(||0COb{?ddP;0C!r
zQzrgx<NP8Onr$HYs%k4C|Ley3<@e`&b}{n<sI=7noS*(PC;i)T{OgtfeC4DNfK0Bt
zLZbek%T!?lumsy0egD;~eBFiM{DrPH9|`sUTxK6o5K#EP76nZL?((qn)4}rS$M}aQ
zzTQvgR88D|k?g6Ajj@0))t+K3mIV9^#-DlVJeX6Bg5A*q#B;I>8~dboupCHBhihP(
zoP2jJqxDRHM$mUOP*jk&T)_p@pPxyy-U<lAo5S)lX3Xf%=ltudA~4|H<T=)81FoyF
zyw85nKxFRNSl`#~ua!>*6YqH>?PpWKK*%+%6d9*tm3<ubr5>a5oFnzgB~Xo|*02Ux
z1C`4Kk%#A~HtTh0<c@2^-elYF|1gYr@#4iyUj|DR-L3?Humd_tQKAzP%S#!L-p?X#
z+`hdt)U0{Zr}we=%#uSvn99ef+_wf`y*|4nf9G+y5J{b~!Rjl=M;Dqtk}bPA%}pII
zB?@{DRG|sr*=C)`bnvk{+xyVmfL(ql^S;C@^@yZ|Sy#7lp>pSyez`+>`8^Hw)dkl~
z*SHgXfwJo9O6MPM3`y9Itr~OM?O;ZSra*RRclk(FN=gcU#&Zxs*QlKK=4U?0$MPoX
z8DhZG?|uJB?dG#LcEbO({{OrIQOO%!?GK1dFm;7<7Z`A)^|U5bY`%?DEJkG>394-W
zXr{glj9zAAWYp2rY;JDm<>1KCj)2lWV_D+}#?P^w*rnzJ!ysjmH<?2f)rB1oJ_WDD
z;Zu%@$-ckI%6>E|Y&Bp**;N+dUtw`eLMK6>Lfs;lzpINl^UPzVF#^b#I<y9ZhB1qz
zzWZ_?{t=k$1Hf@N`*V|lnX=M7*IKQfTgHwTmWZ|ACT3Cxc=Ej3;Zbmh#jddt#t;rs
z<OC(ZGkVp3E+Mv`sbyFaZ|MPwO4D{?y}HJ9oTp!KLr2FvF~VP&i+33l;c^d7of1d=
zG!>@`on{7*U8c?DejCF)$Pk)I>h&V8)Kx<IiR$MmOBD$S5;S8%Q$rIS2rS<vMUaQA
zaLlGfYL%MGRmjRG9b!EYgPCifC)&RQ9h_HPe&jeFK92B?$&3u}_ve?tokBaTbh1_9
zt+C0>{ozx^9kVmrohB7iwVT%r-N)3>7yu(_NPvxZ>^Zx~M)6)7)xO!cJ5F>pJsk#f
z`nX7Z|7fp$Uv<>*3RaSkvrK<NLtd4mMX6h38?_|fSjEz36$9AQR)AsSK5v>&ZLKvF
zJa?TwEBSfkOlA1S<Yd<&fya|4E>}}7(<+?lOfJAE^b+FR3`P!U)@NpB0KuvKMxVsO
z;(*N>a;`vWdtq_*$I_Mv?c-)6YGnTsOm<o8O&?r4GaJ`w4WP?O329b`0=)%bmQ6pE
zljD|?X2p24*Rm}z^>&dP3T#?wdG!E4+-4!^mzyH)be0r1en>J5vcI40w;8Xk%Mu%>
z>;Sx^VxlublCHy`Z|esAV=$|xmPj@adm~3Gzrt&tC+O1EL=P3@S+5FHknQBNn|b7V
zFbz-z_=-IVA}&32A3u5_fy<CdYuhyRqu1o3UGOsfNAmszA)|N|gLJ!L&yHMr`Is`7
zVK=dh7p0^Qr@p!6&T4-dFwN<mfA~FPd!AD^c+IV%g#j<sBND3z`%H~7P4}<!bH=TS
z<Y}3z@e5#IiR$3SR}w$7jS$;>V0&R~L#Ih3S<zm;!%Naf=rGuEo`Y)!wcYvXivRzx
zsY!QUpfY&Opuh&zF0XaPYVWU3ywuMODyYE62*c+o^W^Gk;`E{*JWhu4e`>-$*X||f
z=hKm8$=g8y3KkFl7%rkek0hE+fR5<irh%>orWx5-$fwD05YKxhYI~sl{h!Jxoq1vT
zwL&JTzr~;00f_z7V36qp#a79>H*Nnyu6BCP0UvQGxp%?uxz10E^V@C%gd+)XcqMd0
zX*U0}pqmXCdk44Y(IjW2{ns%c+Ks8`ZZWkS{dog_AGJOXjKJBMU~ntrZ2#9^%QAKV
zjxn-h91ib)J#PSaB?04h{1io!%Co8IQl~~M^4O6izNH<8W)tQ!7q*OHYPP%ECYUB^
zpk@n%ct*{gw>Yxg*MpY&bJe9Q&U2r!g6Dkt05hnNKvas^c5O`S8|u$oT*MP}q8uF^
zIo24pG0odQrT^C}kITT?lg=mH!Dxm9-E|_Odz;<eQ|KE#{U*;j{`_m>%jdu1#Y{04
zVe)^Ibywf|Nl4p!de)$Oux-wY&!+*n2ckG7OpCDb9iPvi*BzJ2Vxn&i6ElYTf!kHi
zTrnAOb>1sn`POOqnnnmGzV2m(<oFIhKR<#L9V=Az$}Rq`{h4Fk=L06O{lQ~98ekZp
zSw~*VQDZ$EK^g(o4`gsW1qH<cl0TLE%$?JODgo;E<c2WDRBFq985+uRALJqQ+^I#g
z%dx~ao;mHl+{ZX-*r8;n9F2njiQ;7rU|jj#-fiX>iZdT?EQ(Qz^-m8?FrrGunO|%Y
zBB0^tpH1D7HTzSpz$50l&;_t90xvX3*?AErFJ3q-@A2_GHrv+q+5Qs{v0e!1thcrD
z0fyj)Bla~IJkVzG9n7qo^sRbpfwO?j=Ae!ASC{8hQ+lAHV}@0;r&=7^h;?~ug?5cO
z_{+xG$B>Hq`QkxpM9*&{8Gcn9(fD)c%~yX?^qlcYeYk)=w*>k;hxdQ%*MHsu<7M3c
z!#xAGi#*`LWnwcWoOuL4uLp<<sm^@s&l{E|0wizoRW|dil>ff|QgX$WvzzDd>wClj
zwTS)PgPB_O`(F9^7P$4(zx7e1O}5fo1_*VM%s+qNY)d7YGb1An3Vh%3NYyms&#Tik
zfX}r|&pL&WCSPUNDJpPFaI(|GU@H`a<U&9;)_E+dh9VWQf1xnmHWZ;~D)_URck5os
zy{S{4x{*oW`D&GeD=J?Y#2r!XiYZp7=WkP2$rD)ZhsY)K{k~w)S)#6X54jf-rwdt7
zeTFJpSg?PQ<g8&zhr=s5yJ>Jy@(-&i&3WEQG?R>l@^ni)o&3k;<tcs1Y?xkQt)g-M
z*34(f5qY5M%aR3lEe6dKt};fbrCl4!x^%>*I4+9OU?Z2T7}D6#kmk?H&wo%DvWC#~
z$<EG8=?KR6b#^>-(v3U8&0{)R7@C~$BHe};SsXO^Qws3o$Cyo(vl}*&d#|Z=R02LK
z0IINWm(9=aIhyd<qjz@;85>?8SKmC>DbRD&$YRUzgYP?IGhE;?PVkq*5EJ}OX2g;5
z=S81-5y@)&@B_J^{*AE`ruq`i$bz*(JEJ#G&bY6k3K%tuz^&)PSj%ho0HT>}8!xLE
z(20kJU0&>Nr^2RS%_`Mc)y`tNX9T@RZfznEc4T#p25OdD9KV?)9h{+@pHr^U@nc)k
zP+fF!o3NP3@E+`7ftIi8S5HD335WDcwfo093SI{mR$oKWJWdLsIwWD#uxcys1C<VR
z4|b}TzXro#VcM)jxo9~8J9~gM^<pKy`=Z8nKz(?^y{(G61Fg)=HkR(n?n!sEN{aFL
zVkIv=RH0>W#e%m7pQqlM+#%Dom6b8qtU9x?@Rd>CO<@;7jz?-1tEG-1Kv5g0zVAmv
z-5R@7$^=%?O!bVkbS(hZ<|A`kWx~(^Xpj+GlKM7}^5T#h!*1X9dpFd&rVn&gs3iL~
zY5Cx1@TKF;KY2ua6zKutJ4MNMQ9!Rm>2HJr#UGQ0<O3b*hT*%%Qo-pfC>B2~+!?uc
z%k3=(6brX^Jp1=y&N}^32vdHBf?;2wXK#wHdrR|OKiq3*SZA!G?v<^Tw0I$BJF7Ro
zeIKHX6UHQPx2v4Q71VDH2t39L+#vy}Y2wg5-i$$#7$85V_N;s5@Jqz;zMSuSA{-lI
zs)?hh7^69A;SiRwJ(K!2ZEcx<W`DOsM<ErrADV7u?&6G84iraZ>jJY&mPhF8wXlUJ
zhCU1N@a!x})EV~zGs^Xy56VmXb$E0(;x5J7g2tKXHpaf{j_wY|aW2G+a{E#Yx32`r
zrudhdQw5)i-qI2P52K_w-3+kvG*;MKE8{8lyK5kqiEQnfC%y;V<lK1?@a?q`d*kl#
zIt9wn_+GAno`&y>?c|ANgL$JFi+7;u5|(aEYV3yLy7{WTJdXhZ;N-~8>;X`tMdCar
zh&uWf$vQ{Fpe^$C!wrq7rQ5e#3WIA6fI1)uG<yHMxvRpn*MsAPE3uY|A;|tXpNSCD
zn46l=or5VNY|*6nM{?ngV?*=HrLLM$YghIwU0a?SUn!f#=fiN%{<LYBS6}7`fdj5$
zh75Cd0C|6w*#0`_%{_qk2cKGKyz)4?5J?crHC1(!biot-YRyZ8IeN3W$WbSo`u6Qb
zE{lfphhi$$iB7}-uu?6dS-e(20|(EpsTm#>5_abm84o}8Fb2QUpju=*Xzd>GINVQc
zhfS{fky-ssSb&tjKgm&!+u^tsp#w259t#V4i8m?Uo=M>I((%2_q)PqvT^{shwm<!(
zp3HOZ89j53&owaG=zlZR6Fy#9qEqu?mLT==>X_rBM((!(QV#PRB>+vNP!-xx<9(5d
zER~3>aN}$slemNg(tDC<eOi55bxrr~XlN9DVRv_t4IgC0f4)H<)ndz{okqtgIjyRq
zk_=J@z)jA()DfOt__jo^%)PY14Et@z2LM>_Qh&*|Lp~g`F;*?-&ouC9%GW5<Qy=;O
zJDJ=0ftg_)KDe1vlKy>K=1?fkZxRO{z!52MTA?LEV5h%WyA+?nI#jbe?;9XYrCEbd
z!LJQ#BV}0paPZtxydf@IRr1P}0Js1x?Nf`5e~XFc7<TB1X`6KVQVNVC7359Y9WQ_;
zq5^Pgt5-Z<Oy|8Dd`wqW(xYS;{!EQZXdTGQYib;^wDKp$JBtW=9oWqI$`Y|qCIAWA
zggE+|akg$)pubn7DqR(<hm&Vy7!{XE%8IyD4O^b*bx*UC{o2m)b|wl|pw=|^LAQm|
zn@_q>ESueC_JylpYO{K0pIQb$Q2nch0r8gH>zfqRa^V<GP$2o1oSVz(bmTDnI{sdj
z%y&sgv(8(Y@1ABJ2P&OANAgTY{IOcR;N0MX_k(6b-X(@BC`44{OSdYD^7u#2o8Yo2
z8xvIC%xnDh8ro)cM#%VFwPjDFYY-%#my7+SLkV@_{2d>Qb{k|tYj2Qdhk`Ec=ttc=
z!)Ng-gqE)2DFtCEzvYY*4YFd>!~#qqko>ZI{l*5ykeu~3w*-%lN(O3g-jD7sMvZF+
z1IIRbj}>|quJD$Bh}%&N5)Q`}=P?v;FfUMxxJgZF%Er`}41QZ}!wA7^i4hYCkg<Gl
z;iB)%1#NBZj0_IPKfR7UtqVH2#p94#x29V6zMkgA*i*rLxchQZ<8@6tI(<uCaFh2u
z$dv`@hfk!LOv{PAJkLHv3zhK2Qsrp>Bnz=stFiP;_kP;W#q{FNPho!vz;<!LN*`iB
zjQ|Ndca&`Bw`sFXUv1v3`g8$!CZXC`W8>qhda+WjoY~*-=WnKD{pIV3Hj%jOjG+N^
zP?hshOd+Ix`49JyBN;Gv*Ic@zPdS0kU0AzELlAJy)A75fj?$k#r%%W|fY1B;qaIw0
z8i<+_nwPr1GS$Jidi;m)H))S;?p@$>YIy$DucNWYBsRtdA^raqOeV<#iCD8#vuA&r
zh`&YtzwZ-hBCxl}*fZn<>SL^xsbBH&maXWnDmjB?engp&d%Y~{(D$dh#j)xeSEu=n
z_wgNIoLelU`4#xpLnuoXGS_ArPW}0az&zY#jNrk3WD7OBQ0(tpkxWjM*GL|6nlZcT
z;p8JBH;|8ZpNsj9?kgC~Hag5eURz8gQ9US6m6m>}8TN+z{>P*7zFNo<RS?^IM7-g+
z=S!D{nK@06cr`v;o855u{5YIoA#7TQwaviEeejNjNocP_%W*NoKnV0Yx%+w?wz?#N
z!*Z{(F7FB2!*HzH8E(<hiwp7f@E~t<X6%I)=ah-ANnHt$U+4R7Y7Wl*%3H(uaUL=)
z%Al|u**j+6OVV$5o26ID4RCUfN_wk-659b^5h>`%WZc3C@2P#(<;qI8Vl+3@fOO|p
zEUJ%_N8#0lSVr2?qfJhT3&;WAV_j>oh23!by<^5nXq9=2a{_I@c<*)FPCwyYL;XSv
zai#TlkU^A@@ymHZ1P8WGe;jA_*cXsW^e3(N-?ACs3U1ny9gg~@n%xz9vN@Qg<~=b3
zz>zX*UEjp!GI9Obt<GnB`qGwm6;sk19mSVcnn2h<{lp$JI3(=Op-|*+k_0&mVa&am
zswm|j+(2>EiEMKzVso{yu#hJTF_5s6S|O&KT?gQY%~l8d+?ggSm4mi%(~LED*Afk?
z?*?(h*n!jKd46l^R#Ef#E$3aTs9ds1*ZcJJ{EDrF04x#!sN$txLCR@{pdYOaqn7yH
z+<H18oJ|OnLiHte8DsOInC#89RlbdbZdI~$0KeOR-y_$|I!#R)#B!ToO`$b?xTjh(
z#f^KE52~ha5Lu@Zp<WE&S)6zGR^ysURhQrXc7Clt2LgPNwvU*@7bxf$(C~A>VW#N-
zFc7R%^tNBm>qx${q1>U<DVCIkjKmZP3-lA~t~%7?8dMV@-<ehypImyfZFPILBb(8i
zi139DP14(;ogK1t13n&pH}@(Z!krZl<5clge7v~m@sXYsRowP(7KuYZDXn_9DytcC
z@!tW?J?0Az{SPp1>;sde-VTk;@@&4inGK05_^vOl5;@szFVMj!@7Uc%=aqNh;NYI;
z;qodJR>;?dgc6>1Q$;GOgF~O2`OMUruwhhW3u-0Wp6TMnTJMdrHHSu>9kP%?1G<m}
zGhRME3)ov<cY~pH9fZ4MIsl8vb8aojkNQrrpU=JfOgA<BfMc8#y3MzgA)ZvjvnDM3
z+_YE343(>_jAQaQ+V~zN$X2AQZ=iCsTV7{mL`q6=cp$^jTalE(7Iv`P^7*BScwnY2
zXspI17aA3k0pr1^jE&LKuJzgyzpy&x1C7gz&W=C$B*(N#DB-ZRU0^#@m~VronsdTH
zf8D)wbG-;ZfId$`0IYbCD|#r}kS?*{Ip1$!@(rTy?loXe84A|-nFNm#p1lt736MI9
zFSC|u?|<~0k7z*)WWqi^TfnrWwDep67zVUIo3~GSE>TRZW(&^RIgK@FYeL6M3SrBG
znZ5Hjj!Q~Qd2NP;*5iH%Ps}}iI$g#K&hN{!_+F`+Aem`Cci5)5sD)~ecp;BROe<;%
zqE6y$s8opo+S-I4Iq^51D_LHR6z=TQ$w@KWRxN6GHL2L!8y~S`K}Bl6suG3}G_}`x
zShym5-eUE~3G%-(;Q6vs<)-Ci1K`PJg@G7Sj`%fLzosbV5QsE~yADt#)ImJ9$tC^l
z4`nh6Z6}9jt>!=$BdXk?NzEVU-|<FC5pZ!J=zJOhz<CR+GHQ91>RZjpa4Ln|2_Bz0
z%rw~Z&~!24sRwg}gYIWpr;%A!Q%!`0+7xt2mJ$!4iL@;+vo4>?4JO<G!*0jYQmNH6
zc((E{WWG%0&pB7}R)d9-Qq7UILmM=htP$*?AscwPa3(Y&Ues862*5u34OV_iRWmPt
z38%)&{TuoW8ydQZeCjf9C#m&;xvh47Oa(S&wbXQFn7T4vi0>5`SsDkQFdm*`CDQN@
zO`_;COPndsdE(i-oC7a>_|T3LfftN+$5v!D0GEIE3@EoULl!LfY0Ck92@$}8{0%2|
zz$|SWETO6ZNPM{a`R7Z=DAQ26<i%m5e)|0cQ62#%I!7<cREm~e07iBQ0q3a-lUQs-
z<pcuYy}<#SZ9aQtw;eubhCa04vKvo_Q6fuR!s|71_F2Tj_el9J8CFBD@P)-9i3JwJ
zQXICmF=xZd+U`+XT|28VAPP8`Q7oRx_=rPLR-gx)SeDsfQI%hq<o%8ySY<_~^46#1
zJi-6fVVaD<4!w8~q0D(5<H5*WvO{r|dREbKV$jYC)j3F0W`h!!m9UFTQS-%_a|yFH
z2hJ;F8}FAU8gad}tGA%Uxjb^Y8Z5UL7Zz=huA&R|-*W~_mw4SBta3g21Z6++uPpT~
zMY_z-$QpNMgt>xP@~tayNV~cR6_r@%8Fk*M))r{y1GHWR0R*hPOv)|}^DFfeuL|{t
zGZ>p?x3t9q6vqo>zbJg_l%>S})+%g{&CEz`3qrEF^SLJ?QC)?8Y2u+R8U6*4s#1~)
zFx$a~qBhb+?oBWoOAKB$&sun*n8z`#rFMyg2QvmG&C$u>DbQ;AoG;Y*eYaVlT4LNu
zKm&=p;fUdLb6cQwGm4flTiZ+P3xbJ>mrPg3*qi*ef_y}S9QcTU)XR{yf{idqMb<b{
zR{;Of&T6P0*7nBk6ENixq4~hWcXdz)ylZK>bCB<Luix1`Ra5(hRo5b6TW#I6y*)~I
zwcr{p(ZoPTo!A_>MsHUZ3mfTPeQfZ6O@@G@^Q&@?Uy$Wf<H&<CE@}iDQGIP^lu(CC
zFU%CBIYD6JTSp<{xb5P)=0nH~)<?U_4kMj}ZxNHQt^on{98_8PQztfmUD1nFYa0y~
zmJ@61yh~6l&L6uHm3D?O;RE?JyW&Pk3AqSo4*$z4Q;qrVDp{`kITkImCijBI;LS4w
zcg^S;mY2Npx50Gdiff_yy}G*FfjA*bI{La*>Z~>44s`X4b|b{0V;mc)eiXEi8c!#e
zpC;^p|MuSf<#4aMH8r6%SEZI?3owz$PlvmzuS`ba5a_)NNBu^Dib<yNLX%yU4HVy4
zl0fQE-*7QD@Y7%Ibz`a3F@1Niq~0r?;vuFlsT`3iMgOY0KmA=ofMMBJ7n4B#cQ^Nc
zN#^t4*8l%W()a)I)@j<YcnsGW_-DKH>q5Dx1J9pP1R5di`Haj~c2Z0}NgucRT43JH
z%%`W_qM8DRpw!EBo7eW?9St<SC&gTX9H!gZSE`_U!s`URz5PYpoFFX@#X5dJ<NbvL
zm4|$1v`m`%LJW_2xUfqM7EqFT;=@nJyf~tJ$zQ_2ZQU{(af~3iI7pBejXfB{qAR){
zw~81C?O)a`LX2m^Oorm-t%RWjdhRFkHD6=wYM6iTal+`ca3v5MhA7Ae0Oq+B3qBO<
z1O??X+l>v7hwDve*uKQhU5>FGHiGHZ9W%S=9EPtjj$~=<(lgR;=0_5r3G75~V~Sb#
zv??Xe`7qy6N`DE$78Sw$pmd?D`(Yt&$k?byw^X=eB;1T2W>L6-WzTSZZmlN11|2-u
zOLI}k#yyw9x2`DHppW@3W5&$hJ>06OS3sd^cw7^9YmgZvToF~1p6$~k%O5E}pv!u&
zcUf`<VKbEK=0n9jZG_B$fd~xvszjnf2+5L$zSh1=5A?r*iu9MsF)Sume4|%=q#ISH
z5h5&y<yksIUPOKnk~%?{#>3rbqtj%mminpbfM520{gkq*GjhavJEj1p5oD)PG;@i!
zA(5#TH^c?GOVFM)`cicK$qExnPRS?aXXyS<PA(MtlJs;8HtStEz&>@-ud~xUZGv(0
zs+h9dbmr4Fua+^I3Dvp=uD8r5BG~pX`y&_vm3DO(SnG!aSyrwLl=k+(>3_WFPrGkj
zb?5w&-#CSt6SFHy`5C$&LMNFQ?`T)cH#eCuLdWa{GGTLNkB_e*p{UKQ9Z7;AU5@T9
z?<%ANnfS#-Lvy71s;n;FJ$l~OOYaCh!QsJC5g&2aHeGnOpiHiI^XR@$;?0b}uv204
zcGS>bpc#4T!idJ;eM&|YdH3g*_RRWCwD(9rfe7`<uDbiua!~={z_9nxoPR?R(bL!e
zdf!9m6aKz$MaJtlZ?HT^efj)Aa}9zBK|;|IR06n0F+L3*gNd$OmCD^GjySE&P&w^^
zqwR+GL<IC)Y_Iy~9JP$M_GTM{P#+O}-B72;+hlVb199Wokt(0^)47euqg2Z-0+_*0
z#Clz)5Y<-tcosAWt{sSlSpDAETupcW9hdSV`TU~vjE<D9oUkz7hv<^=&7I=w*vs_1
zp8zFLlnGuFCI}OeL-EQh6?jC7ZnhnlnRxGR7@%kqS=rokm%k0TQ*3S=!taEneH6C)
zrs(8~7T7#$pG{~d*(=D@K3r|NFz3L^B2iReYTwB!=%LsUP7(Cv%#Lj-2dd~D<%7X7
z_kjHD4K2rw$L)rSJPGz1u={e%E?$~aCRF!9`@p*4e)e_vLE&Y!!7v+8s#S;~Lc2<^
ziBKDCO&lJ5_eWYT$wO7*0Y(sOGwE7QqzK(LN+R;nzHV7Zn5#CEOufg3#%niEpc{+M
zukHKv<VpRF4KurYmeFZBiYOY|yRvRPJwb}uVUx?gua$<6#~U6(0bMA@lheLEZ%MuV
zVU*XiUI27rr(uzvo2rfua;`^7v3*@V@RPnwh$VZ%oFFonZ&n}HZ46QP()Qblj4>P>
z)#n6~IgjX!&jSVAKrC7uX4}9EP=QTpr^6h(yK;K!raewmSlj#JwelItv>~m)r~%dZ
z8XyZcXbCI2s8i~v-4SaxsLB1XXE1EHIJumrs1s3+pKsSR=L<Gkiud2h<OuB%ugPz4
zO=q9Axyf5`gZrt<g3@*-?X@tM%7&``2;tlg_^LG@%uRqAMc2J3$ajsZ=4w<(r$KYO
zVNAZA28UyoC8MjH*SM$LM9vewbzC>2h$a1i#mq<lgS+_qNcXvh0Sx#WJi>q(ljKDS
zLDFLtIyX3F-U!;P<+F$}<|>-VbQbYlLmsE9^I$QV(RDXK@JSGQtBA{sHU)|U1UXr>
ztD(h&GwN%Pzt-vuPnecUZ@q8dv3-y7R$QpV<G;V(!~Vi9LT#;iXT{6X^~<wX4;izm
z(BhmAowDC9^{UzggNrNqvC&`K%kbW}+@t81QX|N?UvU@bk6a#bz<k4|{czQ|9E<%q
zpn8+VS6hTlT053cXq2|M1Wk4e01MfmuD(`;WtWp-7V}MX<FNn%^!9DCnwjXboTL5G
z<F9Zgn!S$=sp&-f=2j%T*5B?!r+02Mu_3>d$L`x@I>o)5zM&eQX30#)zw9xrss70;
zxou@3w_Ioh&cw(+AOga*AB#89+gJ6}Ke63)U}B3a+vM%()d&bTQvYnA9&xtD+%kXa
z!FA4CJv%vLG=COs7nEL8b}g)bVy8Q^qyBnIG@MtD2rTZhgf-f`Q=bF=$w(-O7d(0P
G=KlcCg=5qJ

literal 0
HcmV?d00001


From 82436c442ea6832bbe8ab4054b359e912e27540b Mon Sep 17 00:00:00 2001
From: Paolo Capriotti <paolo@capriotti.io>
Date: Wed, 12 Jan 2022 11:12:59 +0100
Subject: [PATCH 62/74] Fix Remote Asset Downloading via Better Resource
 Handling (#2037)

* Add failing test

* Initial fix for Cargohold streaming bug
---
 .../3-bug-fixes/fix-cargohold-streaming       |  1 +
 .../cargohold/src/CargoHold/Federation.hs     | 44 ++++++++++++++-----
 services/cargohold/test/integration/API.hs    | 16 ++++---
 3 files changed, 45 insertions(+), 16 deletions(-)
 create mode 100644 changelog.d/3-bug-fixes/fix-cargohold-streaming

diff --git a/changelog.d/3-bug-fixes/fix-cargohold-streaming b/changelog.d/3-bug-fixes/fix-cargohold-streaming
new file mode 100644
index 00000000000..53c7e539750
--- /dev/null
+++ b/changelog.d/3-bug-fixes/fix-cargohold-streaming
@@ -0,0 +1 @@
+Fix an issue with remote asset streaming
diff --git a/services/cargohold/src/CargoHold/Federation.hs b/services/cargohold/src/CargoHold/Federation.hs
index 352e5fc0437..d608bb385e7 100644
--- a/services/cargohold/src/CargoHold/Federation.hs
+++ b/services/cargohold/src/CargoHold/Federation.hs
@@ -20,11 +20,14 @@ module CargoHold.Federation where
 import CargoHold.App
 import CargoHold.Options
 import Control.Error
+import Control.Exception (throw)
 import Control.Lens
+import Control.Monad.Codensity
 import Data.Id
 import Data.Qualified
 import Imports hiding (head)
 import Servant.API
+import Servant.Types.SourceT
 import Wire.API.Asset
 import Wire.API.Federation.API
 import Wire.API.Federation.API.Cargohold
@@ -60,22 +63,41 @@ downloadRemoteAsset usr rkey tok = do
     fmap gaAvailable . executeFederated rkey $
       getAsset clientRoutes ga
   if exists
-    then do
-      fmap (Just . toSourceIO) . executeFederated rkey $
-        streamAsset clientRoutes ga
+    then Just <$> executeFederatedStreaming rkey (toSourceIO <$> streamAsset clientRoutes ga)
     else pure Nothing
 
-executeFederated :: Remote x -> FederatorClient 'Cargohold a -> Handler a
-executeFederated remote c = do
+mkFederatorClientEnv :: Remote x -> Handler FederatorClientEnv
+mkFederatorClientEnv remote = do
   loc <- view localUnit
   endpoint <-
     view (options . optFederator)
       >>= maybe (throwE federationNotConfigured) pure
-  let env =
-        FederatorClientEnv
-          { ceOriginDomain = tDomain loc,
-            ceTargetDomain = tDomain remote,
-            ceFederator = endpoint
-          }
+  pure
+    FederatorClientEnv
+      { ceOriginDomain = tDomain loc,
+        ceTargetDomain = tDomain remote,
+        ceFederator = endpoint
+      }
+
+executeFederated :: Remote x -> FederatorClient 'Cargohold a -> Handler a
+executeFederated remote c = do
+  env <- mkFederatorClientEnv remote
   liftIO (runFederatorClient @'Cargohold env c)
     >>= either (throwE . federationErrorToWai . FederationCallFailure) pure
+
+executeFederatedStreaming ::
+  Remote x ->
+  FederatorClient 'Cargohold (SourceIO ByteString) ->
+  Handler (SourceIO ByteString)
+executeFederatedStreaming remote c = do
+  env <- mkFederatorClientEnv remote
+  -- To clean up resources correctly, we exploit the Codensity wrapper around
+  -- StepT to embed the result of @runFederatorClientToCodensity@. This works, but
+  -- using this within a Servant handler has the effect of delaying exceptions to
+  -- the point where response streaming has already started (i.e. we have already
+  -- committed to a successful response).
+  pure $
+    SourceT $ \k ->
+      runCodensity
+        (runFederatorClientToCodensity @'Cargohold env c)
+        (either throw (flip unSourceT k))
diff --git a/services/cargohold/test/integration/API.hs b/services/cargohold/test/integration/API.hs
index a4787321034..274f96f6c3a 100644
--- a/services/cargohold/test/integration/API.hs
+++ b/services/cargohold/test/integration/API.hs
@@ -29,6 +29,7 @@ import qualified Codec.MIME.Type as MIME
 import Control.Exception (throw)
 import Control.Lens hiding (sets)
 import qualified Data.Aeson as Aeson
+import Data.ByteString.Builder
 import qualified Data.ByteString.Char8 as C8
 import Data.ByteString.Conversion
 import Data.Domain
@@ -66,7 +67,12 @@ tests s =
         "remote"
         [ test s "remote download wrong domain" testRemoteDownloadWrongDomain,
           test s "remote download no asset" testRemoteDownloadNoAsset,
-          test s "remote download" testRemoteDownload
+          test s "remote download" (testRemoteDownload "asset content"),
+          test s "large remote download" $
+            testRemoteDownload
+              ( toLazyByteString
+                  (mconcat (replicate 20000 (byteString "hello world\n")))
+              )
         ]
     ]
 
@@ -288,8 +294,8 @@ testRemoteDownloadNoAsset = do
               }
           ]
 
-testRemoteDownload :: TestM ()
-testRemoteDownload = do
+testRemoteDownload :: LByteString -> TestM ()
+testRemoteDownload assetContent = do
   assetId <- liftIO $ Id <$> nextRandom
   uid <- liftIO $ Id <$> nextRandom
 
@@ -298,11 +304,11 @@ testRemoteDownload = do
       respond req
         | frRPC req == "get-asset" =
           pure ("application" // "json", Aeson.encode (GetAssetResponse True))
-        | otherwise = pure ("application" // "octet-stream", "asset content")
+        | otherwise = pure ("application" // "octet-stream", assetContent)
   (_, reqs) <- withMockFederator respond $ do
     downloadAsset uid qkey () !!! do
       const 200 === statusCode
-      const (Just "asset content") === responseBody
+      const (Just assetContent) === responseBody
 
   localDomain <- viewFederationDomain
   let ga = Aeson.encode (GetAsset uid key Nothing)

From b9844bbfecebb6ee4a9484d56a53a82b70e4b701 Mon Sep 17 00:00:00 2001
From: Stefan Matting <smatting@users.noreply.github.com>
Date: Wed, 12 Jan 2022 17:12:00 +0100
Subject: [PATCH 63/74] integration.yaml add missing backendTwo.carghold
 (#2039)

* integration.yaml add missing backendTwo.carghold

* changelog
---
 changelog.d/5-internal/fix-integration-yaml | 1 +
 services/integration.yaml                   | 3 +++
 2 files changed, 4 insertions(+)
 create mode 100644 changelog.d/5-internal/fix-integration-yaml

diff --git a/changelog.d/5-internal/fix-integration-yaml b/changelog.d/5-internal/fix-integration-yaml
new file mode 100644
index 00000000000..789f497c98f
--- /dev/null
+++ b/changelog.d/5-internal/fix-integration-yaml
@@ -0,0 +1 @@
+Add missing backendTwo.carghold in integration.yaml
diff --git a/services/integration.yaml b/services/integration.yaml
index f2e135bc461..0b51304dd6c 100644
--- a/services/integration.yaml
+++ b/services/integration.yaml
@@ -84,3 +84,6 @@ backendTwo:
   federatorExternal:
     host: 127.0.0.1 # in kubernetes, federator.<NAMESPACE>.svc.cluster.local
     port: 9097
+  cargohold:
+    host: 127.0.0.1
+    port: 9084

From 3c683edf65a75ca437a2cd07d5164d3707afbf78 Mon Sep 17 00:00:00 2001
From: Paolo Capriotti <paolo@capriotti.io>
Date: Wed, 12 Jan 2022 17:28:15 +0100
Subject: [PATCH 64/74] Followup to remote asset download fix (#2038)

* Add federator failure test in cargohold

Also turn the exception being thrown by streaming clients into a proper Wai error.
---
 .../3-bug-fixes/fix-cargohold-streaming       |  2 +-
 .../cargohold/src/CargoHold/Federation.hs     |  6 +++++-
 services/cargohold/test/integration/API.hs    | 20 +++++++++++++++++++
 3 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/changelog.d/3-bug-fixes/fix-cargohold-streaming b/changelog.d/3-bug-fixes/fix-cargohold-streaming
index 53c7e539750..38d8b2fe84d 100644
--- a/changelog.d/3-bug-fixes/fix-cargohold-streaming
+++ b/changelog.d/3-bug-fixes/fix-cargohold-streaming
@@ -1 +1 @@
-Fix an issue with remote asset streaming
+Fix an issue with remote asset streaming (#2037, #2038)
diff --git a/services/cargohold/src/CargoHold/Federation.hs b/services/cargohold/src/CargoHold/Federation.hs
index d608bb385e7..4a82ea2481b 100644
--- a/services/cargohold/src/CargoHold/Federation.hs
+++ b/services/cargohold/src/CargoHold/Federation.hs
@@ -96,8 +96,12 @@ executeFederatedStreaming remote c = do
   -- using this within a Servant handler has the effect of delaying exceptions to
   -- the point where response streaming has already started (i.e. we have already
   -- committed to a successful response).
+  -- Fortunately, Warp does not actually send out the response headers until it
+  -- sees at least one chunk, so by throwing the exception in IO and having a
+  -- catch middleware in place, we make sure that the correct error response
+  -- ends up being generated.
   pure $
     SourceT $ \k ->
       runCodensity
         (runFederatorClientToCodensity @'Cargohold env c)
-        (either throw (flip unSourceT k))
+        (either (throw . federationErrorToWai . FederationCallFailure) (flip unSourceT k))
diff --git a/services/cargohold/test/integration/API.hs b/services/cargohold/test/integration/API.hs
index 274f96f6c3a..2442e4fa047 100644
--- a/services/cargohold/test/integration/API.hs
+++ b/services/cargohold/test/integration/API.hs
@@ -46,6 +46,7 @@ import Network.HTTP.Client (parseUrlThrow)
 import Network.HTTP.Media ((//))
 import qualified Network.HTTP.Types as HTTP
 import Network.Wai.Utilities (Error (label))
+import qualified Network.Wai.Utilities.Error as Wai
 import Test.Tasty
 import Test.Tasty.HUnit
 import TestSetup
@@ -67,6 +68,7 @@ tests s =
         "remote"
         [ test s "remote download wrong domain" testRemoteDownloadWrongDomain,
           test s "remote download no asset" testRemoteDownloadNoAsset,
+          test s "federator failure on remote download" testRemoteDownloadFederationFailure,
           test s "remote download" (testRemoteDownload "asset content"),
           test s "large remote download" $
             testRemoteDownload
@@ -294,6 +296,24 @@ testRemoteDownloadNoAsset = do
               }
           ]
 
+testRemoteDownloadFederationFailure :: TestM ()
+testRemoteDownloadFederationFailure = do
+  assetId <- liftIO $ Id <$> nextRandom
+  uid <- liftIO $ Id <$> nextRandom
+  let key = AssetKeyV3 assetId AssetPersistent
+      qkey = Qualified key (Domain "faraway.example.com")
+      respond req
+        | frRPC req == "get-asset" =
+          pure ("application" // "json", Aeson.encode (GetAssetResponse True))
+        | otherwise = throw (MockErrorResponse HTTP.status500 "mock error")
+  (resp, _) <-
+    withMockFederator respond $ do
+      responseJsonError =<< downloadAsset uid qkey () <!! do
+        const 500 === statusCode
+  liftIO $ do
+    Wai.label resp @?= "mock-error"
+    Wai.message resp @?= "mock error"
+
 testRemoteDownload :: LByteString -> TestM ()
 testRemoteDownload assetContent = do
   assetId <- liftIO $ Id <$> nextRandom

From 8015566118616e5953292fc364a4b4841131835a Mon Sep 17 00:00:00 2001
From: Stefan Matting <smatting@users.noreply.github.com>
Date: Thu, 13 Jan 2022 09:57:22 +0100
Subject: [PATCH 65/74] Publish restund helm chart (#2036)

* Add restund to CHARTS_INTEGRATION

* add changelog

* Add restund to CHARTS_RELEASE

* update changelog
---
 Makefile                                      | 6 +++---
 changelog.d/5-internal/restund-chart-followup | 1 +
 2 files changed, 4 insertions(+), 3 deletions(-)
 create mode 100644 changelog.d/5-internal/restund-chart-followup

diff --git a/Makefile b/Makefile
index 6d54583ecf8..2ab3f77b378 100644
--- a/Makefile
+++ b/Makefile
@@ -7,14 +7,14 @@ NAMESPACE             ?= test-$(USER)
 DOCKER_TAG            ?= $(USER)
 # default helm chart version must be 0.0.42 for local development (because 42 is the answer to the universe and everything)
 HELM_SEMVER           ?= 0.0.42
-# The list of helm charts needed for integration tests on kubernetes
-CHARTS_INTEGRATION    := wire-server databases-ephemeral fake-aws nginx-ingress-controller nginx-ingress-services wire-server-metrics fluent-bit kibana sftd
+# The list of helm charts needed on internal kubernetes testing environments
+CHARTS_INTEGRATION    := wire-server databases-ephemeral fake-aws nginx-ingress-controller nginx-ingress-services wire-server-metrics fluent-bit kibana sftd restund
 # The list of helm charts to publish on S3
 # FUTUREWORK: after we "inline local subcharts",
 # (e.g. move charts/brig to charts/wire-server/brig)
 # this list could be generated from the folder names under ./charts/ like so:
 # CHARTS_RELEASE := $(shell find charts/ -maxdepth 1 -type d | xargs -n 1 basename | grep -v charts)
-CHARTS_RELEASE        := wire-server redis-ephemeral databases-ephemeral fake-aws fake-aws-s3 fake-aws-sqs aws-ingress  fluent-bit kibana backoffice calling-test demo-smtp elasticsearch-curator elasticsearch-external elasticsearch-ephemeral minio-external cassandra-external nginx-ingress-controller nginx-ingress-services reaper wire-server-metrics sftd
+CHARTS_RELEASE        := wire-server redis-ephemeral databases-ephemeral fake-aws fake-aws-s3 fake-aws-sqs aws-ingress  fluent-bit kibana backoffice calling-test demo-smtp elasticsearch-curator elasticsearch-external elasticsearch-ephemeral minio-external cassandra-external nginx-ingress-controller nginx-ingress-services reaper wire-server-metrics sftd restund
 BUILDAH_PUSH          ?= 0
 KIND_CLUSTER_NAME     := wire-server
 BUILDAH_KIND_LOAD     ?= 1
diff --git a/changelog.d/5-internal/restund-chart-followup b/changelog.d/5-internal/restund-chart-followup
new file mode 100644
index 00000000000..d702a17ab53
--- /dev/null
+++ b/changelog.d/5-internal/restund-chart-followup
@@ -0,0 +1 @@
+Publish restund helm chart

From c63de7ecbbed441fb9cd2f6be8ee7182782fd6c9 Mon Sep 17 00:00:00 2001
From: Paolo Capriotti <paolo@capriotti.io>
Date: Fri, 14 Jan 2022 10:17:31 +0100
Subject: [PATCH 66/74] Use named routes in Federation API (#2033)

* Replace servant-generic with Named in fed API

* Fix usage of fed API in brig

* Add domain to all federation endpoints

* Fix usage of fed API in galley

* Fix usage of fed API in cargohold

* Fix usage of fed API in federator
---
 changelog.d/6-federation/named-fed-api-routes |   1 +
 .../src/Wire/API/Federation/API.hs            |  46 +++--
 .../src/Wire/API/Federation/API/Brig.hs       |  67 ++-----
 .../src/Wire/API/Federation/API/Cargohold.hs  |  18 +-
 .../src/Wire/API/Federation/API/Galley.hs     |  61 ++-----
 .../src/Wire/API/Federation/Endpoint.hs       |  47 +++++
 .../wire-api-federation.cabal                 |   3 +-
 services/brig/brig.cabal                      |   3 +-
 services/brig/package.yaml                    |   1 +
 services/brig/src/Brig/API/Federation.hs      |  57 +++---
 services/brig/src/Brig/Federation/Client.hs   |  47 +++--
 .../brig/test/integration/API/Federation.hs   |  72 ++++----
 services/brig/test/integration/API/User.hs    |  15 +-
 .../test/integration/API/User/Connection.hs   | 105 ++++++-----
 .../brig/test/integration/API/User/Util.hs    |   4 +-
 services/brig/test/integration/Main.hs        |  57 +-----
 services/brig/test/integration/Util.hs        |  46 ++++-
 .../cargohold/src/CargoHold/API/Federation.hs |  21 +--
 .../cargohold/src/CargoHold/Federation.hs     |  10 +-
 .../test/integration/API/Federation.hs        |  16 +-
 .../cargohold/test/integration/TestSetup.hs   |  15 +-
 .../test/unit/Test/Federator/Client.hs        |  11 +-
 services/galley/galley.cabal                  |   5 +-
 services/galley/src/Galley/API/Action.hs      |   6 +-
 services/galley/src/Galley/API/Federation.hs  |  22 +--
 services/galley/src/Galley/API/Internal.hs    |   6 +-
 services/galley/src/Galley/API/Message.hs     |   6 +-
 services/galley/src/Galley/API/Query.hs       |   5 +-
 services/galley/src/Galley/API/Update.hs      |   2 +-
 services/galley/src/Galley/API/Util.hs        |   2 +-
 services/galley/test/integration/API.hs       | 164 +++++++-----------
 .../galley/test/integration/API/Federation.hs |  39 ++---
 .../test/integration/API/Federation/Util.hs   |  91 ++++++++++
 services/galley/test/integration/API/Util.hs  |  61 +++----
 services/galley/test/integration/Main.hs      |   2 +-
 services/galley/test/integration/TestSetup.hs |  51 +++---
 36 files changed, 623 insertions(+), 562 deletions(-)
 create mode 100644 changelog.d/6-federation/named-fed-api-routes
 create mode 100644 libs/wire-api-federation/src/Wire/API/Federation/Endpoint.hs
 create mode 100644 services/galley/test/integration/API/Federation/Util.hs

diff --git a/changelog.d/6-federation/named-fed-api-routes b/changelog.d/6-federation/named-fed-api-routes
new file mode 100644
index 00000000000..c41471a3636
--- /dev/null
+++ b/changelog.d/6-federation/named-fed-api-routes
@@ -0,0 +1 @@
+Use `Named` routes for the federation API
diff --git a/libs/wire-api-federation/src/Wire/API/Federation/API.hs b/libs/wire-api-federation/src/Wire/API/Federation/API.hs
index 961859a06ff..719af7baca0 100644
--- a/libs/wire-api-federation/src/Wire/API/Federation/API.hs
+++ b/libs/wire-api-federation/src/Wire/API/Federation/API.hs
@@ -17,34 +17,48 @@
 
 module Wire.API.Federation.API
   ( FedApi,
-    clientRoutes,
+    HasFedEndpoint,
+    fedClient,
+    fedClientIn,
 
     -- * Re-exports
     Component (..),
   )
 where
 
-import Servant.Client.Generic
+import Data.Proxy
+import GHC.TypeLits
+import Imports
+import Servant.Client
+import Servant.Client.Core
 import Wire.API.Federation.API.Brig
 import Wire.API.Federation.API.Cargohold
 import Wire.API.Federation.API.Galley
 import Wire.API.Federation.Client
 import Wire.API.Federation.Component
+import Wire.API.Federation.Endpoint
 
-class HasFederationAPI (comp :: Component) where
-  -- Note: this type family being injective means that in most cases there is no need
-  -- to add component annotations when invoking the federator client
-  type FedApi comp = (api :: * -> *) | api -> comp
-  clientRoutes :: FedApi comp (AsClientT (FederatorClient comp))
+-- Note: this type family being injective means that in most cases there is no need
+-- to add component annotations when invoking the federator client
+type family FedApi (comp :: Component) = (api :: *) | api -> comp
 
-instance HasFederationAPI 'Galley where
-  type FedApi 'Galley = GalleyApi
-  clientRoutes = genericClient
+type instance FedApi 'Galley = GalleyApi
 
-instance HasFederationAPI 'Brig where
-  type FedApi 'Brig = BrigApi
-  clientRoutes = genericClient
+type instance FedApi 'Brig = BrigApi
 
-instance HasFederationAPI 'Cargohold where
-  type FedApi 'Cargohold = CargoholdApi
-  clientRoutes = genericClient
+type instance FedApi 'Cargohold = CargoholdApi
+
+type HasFedEndpoint comp api name = ('Just api ~ LookupEndpoint (FedApi comp) name)
+
+-- | Return a client for a named endpoint.
+fedClient ::
+  forall (comp :: Component) (name :: Symbol) m api.
+  (HasFedEndpoint comp api name, HasClient m api, m ~ FederatorClient comp) =>
+  Client m api
+fedClient = clientIn (Proxy @api) (Proxy @m)
+
+fedClientIn ::
+  forall (comp :: Component) (name :: Symbol) m api.
+  (HasFedEndpoint comp api name, HasClient m api) =>
+  Client m api
+fedClientIn = clientIn (Proxy @api) (Proxy @m)
diff --git a/libs/wire-api-federation/src/Wire/API/Federation/API/Brig.hs b/libs/wire-api-federation/src/Wire/API/Federation/API/Brig.hs
index 38fa01ad792..3c90019f9f9 100644
--- a/libs/wire-api-federation/src/Wire/API/Federation/API/Brig.hs
+++ b/libs/wire-api-federation/src/Wire/API/Federation/API/Brig.hs
@@ -23,11 +23,10 @@ import Data.Id
 import Data.Range
 import Imports
 import Servant.API
-import Servant.API.Generic
 import Test.QuickCheck (Arbitrary)
 import Wire.API.Arbitrary (GenericUniform (..))
 import Wire.API.Federation.API.Common
-import Wire.API.Federation.Domain (OriginDomainHeader)
+import Wire.API.Federation.Endpoint
 import Wire.API.Message (UserClients)
 import Wire.API.User (UserProfile)
 import Wire.API.User.Client (PubClient, UserClientPrekeyMap)
@@ -47,58 +46,18 @@ instance FromJSON SearchRequest
 -- | For conventions see /docs/developer/federation-api-conventions.md
 --
 -- Maybe this module should be called Brig
-data BrigApi routes = BrigApi
-  { getUserByHandle ::
-      routes
-        :- "get-user-by-handle"
-        :> ReqBody '[JSON] Handle
-        :> Post '[JSON] (Maybe UserProfile),
-    getUsersByIds ::
-      routes
-        :- "get-users-by-ids"
-        :> ReqBody '[JSON] [UserId]
-        :> Post '[JSON] [UserProfile],
-    claimPrekey ::
-      routes
-        :- "claim-prekey"
-        :> ReqBody '[JSON] (UserId, ClientId)
-        :> Post '[JSON] (Maybe ClientPrekey),
-    claimPrekeyBundle ::
-      routes
-        :- "claim-prekey-bundle"
-        :> ReqBody '[JSON] UserId
-        :> Post '[JSON] PrekeyBundle,
-    claimMultiPrekeyBundle ::
-      routes
-        :- "claim-multi-prekey-bundle"
-        :> ReqBody '[JSON] UserClients
-        :> Post '[JSON] UserClientPrekeyMap,
-    searchUsers ::
-      routes
-        :- "search-users"
-        -- FUTUREWORK(federation): do we want to perform some type-level validation like length checks?
-        -- (handles can be up to 256 chars currently)
-        :> ReqBody '[JSON] SearchRequest
-        :> Post '[JSON] [Contact],
-    getUserClients ::
-      routes
-        :- "get-user-clients"
-        :> ReqBody '[JSON] GetUserClients
-        :> Post '[JSON] (UserMap (Set PubClient)),
-    sendConnectionAction ::
-      routes
-        :- "send-connection-action"
-        :> OriginDomainHeader
-        :> ReqBody '[JSON] NewConnectionRequest
-        :> Post '[JSON] NewConnectionResponse,
-    onUserDeleted ::
-      routes
-        :- "on-user-deleted-connections"
-        :> OriginDomainHeader
-        :> ReqBody '[JSON] UserDeletedConnectionsNotification
-        :> Post '[JSON] EmptyResponse
-  }
-  deriving (Generic)
+type BrigApi =
+  FedEndpoint "get-user-by-handle" Handle (Maybe UserProfile)
+    :<|> FedEndpoint "get-users-by-ids" [UserId] [UserProfile]
+    :<|> FedEndpoint "claim-prekey" (UserId, ClientId) (Maybe ClientPrekey)
+    :<|> FedEndpoint "claim-prekey-bundle" UserId PrekeyBundle
+    :<|> FedEndpoint "claim-multi-prekey-bundle" UserClients UserClientPrekeyMap
+    -- FUTUREWORK(federation): do we want to perform some type-level validation like length checks?
+    -- (handles can be up to 256 chars currently)
+    :<|> FedEndpoint "search-users" SearchRequest [Contact]
+    :<|> FedEndpoint "get-user-clients" GetUserClients (UserMap (Set PubClient))
+    :<|> FedEndpoint "send-connection-action" NewConnectionRequest NewConnectionResponse
+    :<|> FedEndpoint "on-user-deleted-connections" UserDeletedConnectionsNotification EmptyResponse
 
 newtype GetUserClients = GetUserClients
   { gucUsers :: [UserId]
diff --git a/libs/wire-api-federation/src/Wire/API/Federation/API/Cargohold.hs b/libs/wire-api-federation/src/Wire/API/Federation/API/Cargohold.hs
index 26efda07526..44a3e022b7f 100644
--- a/libs/wire-api-federation/src/Wire/API/Federation/API/Cargohold.hs
+++ b/libs/wire-api-federation/src/Wire/API/Federation/API/Cargohold.hs
@@ -21,9 +21,9 @@ import Data.Aeson (FromJSON (..), ToJSON (..))
 import Data.Id
 import Imports
 import Servant.API
-import Servant.API.Generic
 import Wire.API.Arbitrary (Arbitrary, GenericUniform (..))
 import Wire.API.Asset
+import Wire.API.Federation.Endpoint
 import Wire.API.Routes.AssetBody
 import Wire.API.Util.Aeson
 
@@ -46,16 +46,6 @@ data GetAssetResponse = GetAssetResponse
   deriving (Arbitrary) via (GenericUniform GetAssetResponse)
   deriving (ToJSON, FromJSON) via (CustomEncoded GetAssetResponse)
 
-data CargoholdApi routes = CargoholdApi
-  { getAsset ::
-      routes
-        :- "get-asset"
-        :> ReqBody '[JSON] GetAsset
-        :> Post '[JSON] GetAssetResponse,
-    streamAsset ::
-      routes
-        :- "stream-asset"
-        :> ReqBody '[JSON] GetAsset
-        :> StreamPost NoFraming OctetStream AssetSource
-  }
-  deriving (Generic)
+type CargoholdApi =
+  FedEndpoint "get-asset" GetAsset GetAssetResponse
+    :<|> StreamingFedEndpoint "stream-asset" GetAsset AssetSource
diff --git a/libs/wire-api-federation/src/Wire/API/Federation/API/Galley.hs b/libs/wire-api-federation/src/Wire/API/Federation/API/Galley.hs
index d2d74e5e9d4..85862695ceb 100644
--- a/libs/wire-api-federation/src/Wire/API/Federation/API/Galley.hs
+++ b/libs/wire-api-federation/src/Wire/API/Federation/API/Galley.hs
@@ -25,8 +25,7 @@ import Data.Qualified
 import Data.Range
 import Data.Time.Clock (UTCTime)
 import Imports
-import Servant.API (JSON, Post, ReqBody, Summary, (:>))
-import Servant.API.Generic
+import Servant.API
 import Wire.API.Arbitrary (Arbitrary, GenericUniform (..))
 import Wire.API.Conversation
   ( Access,
@@ -39,7 +38,7 @@ import Wire.API.Conversation.Action
 import Wire.API.Conversation.Member (OtherMember)
 import Wire.API.Conversation.Role (RoleName)
 import Wire.API.Federation.API.Common
-import Wire.API.Federation.Domain (OriginDomainHeader)
+import Wire.API.Federation.Endpoint
 import Wire.API.Message (MessageNotSent, MessageSendingStatus, PostOtrResponse, Priority)
 import Wire.API.User.Client (UserClientMap)
 import Wire.API.Util.Aeson (CustomEncoded (..))
@@ -49,59 +48,21 @@ import Wire.API.Util.Aeson (CustomEncoded (..))
 -- for the current list we need.
 
 -- | For conventions see /docs/developer/federation-api-conventions.md
-data GalleyApi routes = GalleyApi
-  { -- | Register a new conversation
-    onConversationCreated ::
-      routes
-        :- Summary "Register users to be in a new remote conversation"
-        :> "on-conversation-created"
-        :> OriginDomainHeader
-        :> ReqBody '[JSON] (NewRemoteConversation ConvId)
-        :> Post '[JSON] (),
-    getConversations ::
-      routes
-        :- "get-conversations"
-        :> OriginDomainHeader
-        :> ReqBody '[JSON] GetConversationsRequest
-        :> Post '[JSON] GetConversationsResponse,
+type GalleyApi =
+  -- | Register a new conversation
+  FedEndpoint "on-conversation-created" (NewRemoteConversation ConvId) ()
+    :<|> FedEndpoint "get-conversations" GetConversationsRequest GetConversationsResponse
     -- used by the backend that owns a conversation to inform this backend of
     -- changes to the conversation
-    onConversationUpdated ::
-      routes
-        :- "on-conversation-updated"
-        :> OriginDomainHeader
-        :> ReqBody '[JSON] ConversationUpdate
-        :> Post '[JSON] (),
-    leaveConversation ::
-      routes
-        :- "leave-conversation"
-        :> OriginDomainHeader
-        :> ReqBody '[JSON] LeaveConversationRequest
-        :> Post '[JSON] LeaveConversationResponse,
+    :<|> FedEndpoint "on-conversation-updated" ConversationUpdate ()
+    :<|> FedEndpoint "leave-conversation" LeaveConversationRequest LeaveConversationResponse
     -- used to notify this backend that a new message has been posted to a
     -- remote conversation
-    onMessageSent ::
-      routes
-        :- "on-message-sent"
-        :> OriginDomainHeader
-        :> ReqBody '[JSON] (RemoteMessage ConvId)
-        :> Post '[JSON] (),
+    :<|> FedEndpoint "on-message-sent" (RemoteMessage ConvId) ()
     -- used by a remote backend to send a message to a conversation owned by
     -- this backend
-    sendMessage ::
-      routes
-        :- "send-message"
-        :> OriginDomainHeader
-        :> ReqBody '[JSON] MessageSendRequest
-        :> Post '[JSON] MessageSendResponse,
-    onUserDeleted ::
-      routes
-        :- "on-user-deleted-conversations"
-        :> OriginDomainHeader
-        :> ReqBody '[JSON] UserDeletedConversationsNotification
-        :> Post '[JSON] EmptyResponse
-  }
-  deriving (Generic)
+    :<|> FedEndpoint "send-message" MessageSendRequest MessageSendResponse
+    :<|> FedEndpoint "on-user-deleted-conversations" UserDeletedConversationsNotification EmptyResponse
 
 data GetConversationsRequest = GetConversationsRequest
   { gcrUserId :: UserId,
diff --git a/libs/wire-api-federation/src/Wire/API/Federation/Endpoint.hs b/libs/wire-api-federation/src/Wire/API/Federation/Endpoint.hs
new file mode 100644
index 00000000000..2a8864e4f00
--- /dev/null
+++ b/libs/wire-api-federation/src/Wire/API/Federation/Endpoint.hs
@@ -0,0 +1,47 @@
+-- This file is part of the Wire Server implementation.
+--
+-- Copyright (C) 2022 Wire Swiss GmbH <opensource@wire.com>
+--
+-- This program is free software: you can redistribute it and/or modify it under
+-- the terms of the GNU Affero General Public License as published by the Free
+-- Software Foundation, either version 3 of the License, or (at your option) any
+-- later version.
+--
+-- This program is distributed in the hope that it will be useful, but WITHOUT
+-- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+-- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+-- details.
+--
+-- You should have received a copy of the GNU Affero General Public License along
+-- with this program. If not, see <https://www.gnu.org/licenses/>.
+
+module Wire.API.Federation.Endpoint where
+
+import Imports
+import Servant.API
+import Wire.API.Federation.Domain
+import Wire.API.Routes.Named
+
+type FedEndpoint name input output =
+  Named
+    name
+    (name :> OriginDomainHeader :> ReqBody '[JSON] input :> Post '[JSON] output)
+
+type StreamingFedEndpoint name input output =
+  Named
+    name
+    ( name :> OriginDomainHeader :> ReqBody '[JSON] input
+        :> StreamPost NoFraming OctetStream output
+    )
+
+type family MappendMaybe (x :: Maybe k) (y :: Maybe k) :: Maybe k where
+  MappendMaybe 'Nothing y = y
+  MappendMaybe ('Just x) y = 'Just x
+
+type family LookupEndpoint api name :: Maybe * where
+  LookupEndpoint (Named name endpoint) name = 'Just endpoint
+  LookupEndpoint (api1 :<|> api2) name =
+    MappendMaybe
+      (LookupEndpoint api1 name)
+      (LookupEndpoint api2 name)
+  LookupEndpoint api name = 'Nothing
diff --git a/libs/wire-api-federation/wire-api-federation.cabal b/libs/wire-api-federation/wire-api-federation.cabal
index 5d665a791a6..362aa467ca5 100644
--- a/libs/wire-api-federation/wire-api-federation.cabal
+++ b/libs/wire-api-federation/wire-api-federation.cabal
@@ -4,7 +4,7 @@ cabal-version: 1.12
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: f62744549c34b54e9900b31c33a4ebad5c51ac13ec44010ad2da6c6ca67fdc29
+-- hash: 41830e5193234bf215634c6d48cfa68be3a633d1f2750d9f8e3c237f37021709
 
 name:           wire-api-federation
 version:        0.1.0
@@ -28,6 +28,7 @@ library
       Wire.API.Federation.Client
       Wire.API.Federation.Component
       Wire.API.Federation.Domain
+      Wire.API.Federation.Endpoint
       Wire.API.Federation.Error
       Wire.API.Federation.Event
   other-modules:
diff --git a/services/brig/brig.cabal b/services/brig/brig.cabal
index b94d7fc4127..4bd10ed3417 100644
--- a/services/brig/brig.cabal
+++ b/services/brig/brig.cabal
@@ -4,7 +4,7 @@ cabal-version: 2.0
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 2a5e368730d4530d05df5395f6b3157536513b1049130b541d257aa79296cb75
+-- hash: ebb0470fb0502f00b8e472c5afbb27c0cad11b42d703d7330b43c75f80ea8257
 
 name:           brig
 version:        2.0
@@ -214,6 +214,7 @@ library
     , scrypt >=0.5
     , servant
     , servant-client
+    , servant-client-core
     , servant-server
     , servant-swagger
     , servant-swagger-ui
diff --git a/services/brig/package.yaml b/services/brig/package.yaml
index ae6c5a8f8b0..56bce3568b8 100644
--- a/services/brig/package.yaml
+++ b/services/brig/package.yaml
@@ -108,6 +108,7 @@ library:
   - scrypt >=0.5
   - servant
   - servant-client
+  - servant-client-core
   - servant-server
   - servant-swagger
   - servant-swagger-ui
diff --git a/services/brig/src/Brig/API/Federation.hs b/services/brig/src/Brig/API/Federation.hs
index 12bec5d32f2..84c482c7b75 100644
--- a/services/brig/src/Brig/API/Federation.hs
+++ b/services/brig/src/Brig/API/Federation.hs
@@ -43,14 +43,12 @@ import Imports
 import Network.Wai.Utilities.Error ((!>>))
 import Servant (ServerT)
 import Servant.API
-import Servant.API.Generic (ToServantApi)
-import Servant.Server.Generic (genericServerT)
 import UnliftIO.Async (pooledForConcurrentlyN_)
-import Wire.API.Federation.API.Brig hiding (BrigApi (..))
-import qualified Wire.API.Federation.API.Brig as F
+import Wire.API.Federation.API.Brig
 import Wire.API.Federation.API.Common
 import Wire.API.Message (UserClients)
 import Wire.API.Routes.Internal.Brig.Connection
+import Wire.API.Routes.Named
 import Wire.API.Team.LegalHold (LegalholdProtectee (LegalholdPlusFederationNotImplemented))
 import Wire.API.User (UserProfile)
 import Wire.API.User.Client (PubClient, UserClientPrekeyMap)
@@ -58,22 +56,19 @@ import Wire.API.User.Client.Prekey (ClientPrekey)
 import Wire.API.User.Search
 import Wire.API.UserMap (UserMap)
 
-type FederationAPI = "federation" :> ToServantApi F.BrigApi
+type FederationAPI = "federation" :> BrigApi
 
 federationSitemap :: ServerT FederationAPI Handler
 federationSitemap =
-  genericServerT $
-    F.BrigApi
-      { F.getUserByHandle = getUserByHandle,
-        F.getUsersByIds = getUsersByIds,
-        F.claimPrekey = claimPrekey,
-        F.claimPrekeyBundle = claimPrekeyBundle,
-        F.claimMultiPrekeyBundle = claimMultiPrekeyBundle,
-        F.searchUsers = searchUsers,
-        F.getUserClients = getUserClients,
-        F.sendConnectionAction = sendConnectionAction,
-        F.onUserDeleted = onUserDeleted
-      }
+  Named @"get-user-by-handle" getUserByHandle
+    :<|> Named @"get-users-by-ids" getUsersByIds
+    :<|> Named @"claim-prekey" claimPrekey
+    :<|> Named @"claim-prekey-bundle" claimPrekeyBundle
+    :<|> Named @"claim-multi-prekey-bundle" claimMultiPrekeyBundle
+    :<|> Named @"search-users" searchUsers
+    :<|> Named @"get-user-clients" getUserClients
+    :<|> Named @"send-connection-action" sendConnectionAction
+    :<|> Named @"on-user-deleted-connections" onUserDeleted
 
 sendConnectionAction :: Domain -> NewConnectionRequest -> Handler NewConnectionResponse
 sendConnectionAction originDomain NewConnectionRequest {..} = do
@@ -87,8 +82,8 @@ sendConnectionAction originDomain NewConnectionRequest {..} = do
       pure $ NewConnectionResponseOk maction
     else pure NewConnectionResponseUserNotActivated
 
-getUserByHandle :: Handle -> Handler (Maybe UserProfile)
-getUserByHandle handle = lift $ do
+getUserByHandle :: Domain -> Handle -> Handler (Maybe UserProfile)
+getUserByHandle _ handle = lift $ do
   maybeOwnerId <- API.lookupHandle handle
   case maybeOwnerId of
     Nothing ->
@@ -96,34 +91,34 @@ getUserByHandle handle = lift $ do
     Just ownerId ->
       listToMaybe <$> API.lookupLocalProfiles Nothing [ownerId]
 
-getUsersByIds :: [UserId] -> Handler [UserProfile]
-getUsersByIds uids =
+getUsersByIds :: Domain -> [UserId] -> Handler [UserProfile]
+getUsersByIds _ uids =
   lift (API.lookupLocalProfiles Nothing uids)
 
-claimPrekey :: (UserId, ClientId) -> Handler (Maybe ClientPrekey)
-claimPrekey (user, client) = do
+claimPrekey :: Domain -> (UserId, ClientId) -> Handler (Maybe ClientPrekey)
+claimPrekey _ (user, client) = do
   API.claimLocalPrekey LegalholdPlusFederationNotImplemented user client !>> clientError
 
-claimPrekeyBundle :: UserId -> Handler PrekeyBundle
-claimPrekeyBundle user =
+claimPrekeyBundle :: Domain -> UserId -> Handler PrekeyBundle
+claimPrekeyBundle _ user =
   API.claimLocalPrekeyBundle LegalholdPlusFederationNotImplemented user !>> clientError
 
-claimMultiPrekeyBundle :: UserClients -> Handler UserClientPrekeyMap
-claimMultiPrekeyBundle uc = API.claimLocalMultiPrekeyBundles LegalholdPlusFederationNotImplemented uc !>> clientError
+claimMultiPrekeyBundle :: Domain -> UserClients -> Handler UserClientPrekeyMap
+claimMultiPrekeyBundle _ uc = API.claimLocalMultiPrekeyBundles LegalholdPlusFederationNotImplemented uc !>> clientError
 
 -- | Searching for federated users on a remote backend should
 -- only search by exact handle search, not in elasticsearch.
 -- (This decision may change in the future)
-searchUsers :: SearchRequest -> Handler [Contact]
-searchUsers (SearchRequest searchTerm) = do
+searchUsers :: Domain -> SearchRequest -> Handler [Contact]
+searchUsers _ (SearchRequest searchTerm) = do
   let maybeHandle = parseHandle searchTerm
   maybeOwnerId <- maybe (pure Nothing) (lift . API.lookupHandle) maybeHandle
   case maybeOwnerId of
     Nothing -> pure []
     Just foundUser -> lift $ contactFromProfile <$$> API.lookupLocalProfiles Nothing [foundUser]
 
-getUserClients :: GetUserClients -> Handler (UserMap (Set PubClient))
-getUserClients (GetUserClients uids) = API.lookupLocalPubClientsBulk uids !>> clientError
+getUserClients :: Domain -> GetUserClients -> Handler (UserMap (Set PubClient))
+getUserClients _ (GetUserClients uids) = API.lookupLocalPubClientsBulk uids !>> clientError
 
 onUserDeleted :: Domain -> UserDeletedConnectionsNotification -> Handler EmptyResponse
 onUserDeleted origDomain udcn = lift $ do
diff --git a/services/brig/src/Brig/Federation/Client.hs b/services/brig/src/Brig/Federation/Client.hs
index cc38a065a82..57451d169c7 100644
--- a/services/brig/src/Brig/Federation/Client.hs
+++ b/services/brig/src/Brig/Federation/Client.hs
@@ -32,10 +32,14 @@ import Control.Monad.Trans.Except (ExceptT (..), throwE)
 import Data.Domain
 import Data.Handle
 import Data.Id (ClientId, UserId)
+import Data.Proxy
 import Data.Qualified
 import Data.Range (Range)
 import qualified Data.Text as T
+import GHC.TypeLits
 import Imports
+import Servant.Client hiding (client)
+import Servant.Client.Core
 import qualified System.Logger.Class as Log
 import Wire.API.Federation.API
 import Wire.API.Federation.API.Brig as FederatedBrig
@@ -48,29 +52,25 @@ import Wire.API.UserMap (UserMap)
 
 type FederationAppIO = ExceptT FederationError AppIO
 
--- FUTUREWORK: Maybe find a way to tranform 'clientRoutes' into a client which
--- only uses 'FederationAppIO' monad, then boilerplate in this module can all be
--- deleted.
 getUserHandleInfo :: Remote Handle -> FederationAppIO (Maybe UserProfile)
 getUserHandleInfo (qUntagged -> Qualified handle domain) = do
   Log.info $ Log.msg $ T.pack "Brig-federation: handle lookup call on remote backend"
-  executeFederated domain $ getUserByHandle clientRoutes handle
+  executeFederated @"get-user-by-handle" domain handle
 
 getUsersByIds :: Domain -> [UserId] -> FederationAppIO [UserProfile]
 getUsersByIds domain uids = do
   Log.info $ Log.msg ("Brig-federation: get users by ids on remote backends" :: ByteString)
-  executeFederated domain $ FederatedBrig.getUsersByIds clientRoutes uids
+  executeFederated @"get-users-by-ids" domain uids
 
--- FUTUREWORK(federation): Abstract out all the rpc boilerplate and error handling
 claimPrekey :: Qualified UserId -> ClientId -> FederationAppIO (Maybe ClientPrekey)
 claimPrekey (Qualified user domain) client = do
   Log.info $ Log.msg @Text "Brig-federation: claiming remote prekey"
-  executeFederated domain $ FederatedBrig.claimPrekey clientRoutes (user, client)
+  executeFederated @"claim-prekey" domain (user, client)
 
 claimPrekeyBundle :: Qualified UserId -> FederationAppIO PrekeyBundle
 claimPrekeyBundle (Qualified user domain) = do
   Log.info $ Log.msg @Text "Brig-federation: claiming remote prekey bundle"
-  executeFederated domain $ FederatedBrig.claimPrekeyBundle clientRoutes user
+  executeFederated @"claim-prekey-bundle" domain user
 
 claimMultiPrekeyBundle ::
   Domain ->
@@ -78,17 +78,17 @@ claimMultiPrekeyBundle ::
   FederationAppIO UserClientPrekeyMap
 claimMultiPrekeyBundle domain uc = do
   Log.info $ Log.msg @Text "Brig-federation: claiming remote multi-user prekey bundle"
-  executeFederated domain $ FederatedBrig.claimMultiPrekeyBundle clientRoutes uc
+  executeFederated @"claim-multi-prekey-bundle" domain uc
 
 searchUsers :: Domain -> SearchRequest -> FederationAppIO [Public.Contact]
 searchUsers domain searchTerm = do
   Log.warn $ Log.msg $ T.pack "Brig-federation: search call on remote backend"
-  executeFederated domain $ FederatedBrig.searchUsers clientRoutes searchTerm
+  executeFederated @"search-users" domain searchTerm
 
 getUserClients :: Domain -> GetUserClients -> FederationAppIO (UserMap (Set PubClient))
 getUserClients domain guc = do
   Log.info $ Log.msg @Text "Brig-federation: get users' clients from remote backend"
-  executeFederated domain $ FederatedBrig.getUserClients clientRoutes guc
+  executeFederated @"get-user-clients" domain guc
 
 sendConnectionAction ::
   Local UserId ->
@@ -98,7 +98,7 @@ sendConnectionAction ::
 sendConnectionAction self (qUntagged -> other) action = do
   let req = NewConnectionRequest (tUnqualified self) (qUnqualified other) action
   Log.info $ Log.msg @Text "Brig-federation: sending connection action to remote backend"
-  executeFederated (qDomain other) $ FederatedBrig.sendConnectionAction clientRoutes req
+  executeFederated @"send-connection-action" (qDomain other) req
 
 notifyUserDeleted ::
   Local UserId ->
@@ -106,13 +106,12 @@ notifyUserDeleted ::
   FederationAppIO ()
 notifyUserDeleted self remotes = do
   let remoteConnections = tUnqualified remotes
-  let fedRPC =
-        FederatedBrig.onUserDeleted clientRoutes $
-          UserDeletedConnectionsNotification (tUnqualified self) remoteConnections
-  void $ executeFederated (tDomain remotes) fedRPC
+  void $
+    executeFederated @"on-user-deleted-connections" (tDomain remotes) $
+      UserDeletedConnectionsNotification (tUnqualified self) remoteConnections
 
-executeFederated :: Domain -> FederatorClient 'Brig a -> FederationAppIO a
-executeFederated targetDomain action = do
+runBrigFederatorClient :: Domain -> FederatorClient 'Brig a -> FederationAppIO a
+runBrigFederatorClient targetDomain action = do
   ownDomain <- viewFederationDomain
   endpoint <- view federator >>= maybe (throwE FederationNotConfigured) pure
   let env =
@@ -123,3 +122,15 @@ executeFederated targetDomain action = do
           }
   liftIO (runFederatorClient env action)
     >>= either (throwE . FederationCallFailure) pure
+
+executeFederated ::
+  forall (name :: Symbol) api.
+  ( HasFedEndpoint 'Brig api name,
+    HasClient ClientM api,
+    HasClient (FederatorClient 'Brig) api
+  ) =>
+  Domain ->
+  Client FederationAppIO api
+executeFederated domain =
+  hoistClient (Proxy @api) (runBrigFederatorClient domain) $
+    clientIn (Proxy @api) (Proxy @(FederatorClient 'Brig))
diff --git a/services/brig/test/integration/API/Federation.hs b/services/brig/test/integration/API/Federation.hs
index a8f44b11136..616ac1c61ec 100644
--- a/services/brig/test/integration/API/Federation.hs
+++ b/services/brig/test/integration/API/Federation.hs
@@ -45,12 +45,13 @@ import Test.Tasty.HUnit (assertEqual, assertFailure)
 import Util
 import Wire.API.Federation.API.Brig (GetUserClients (..), SearchRequest (SearchRequest), UserDeletedConnectionsNotification (..))
 import qualified Wire.API.Federation.API.Brig as FedBrig
+import Wire.API.Federation.Component
 import Wire.API.Message (UserClients (..))
 import Wire.API.User.Client (mkUserClientPrekeyMap)
 import Wire.API.UserMap (UserMap (UserMap))
 
 -- Note: POST /federation/send-connection-action is implicitly tested in API.User.Connection
-tests :: Manager -> Opt.Opts -> Brig -> Cannon -> FedBrigClient -> IO TestTree
+tests :: Manager -> Opt.Opts -> Brig -> Cannon -> FedClient 'Brig -> IO TestTree
 tests m opts brig cannon fedBrigClient =
   return $
     testGroup
@@ -71,7 +72,7 @@ tests m opts brig cannon fedBrigClient =
         test m "POST /federation/on-user-deleted-connections : 200" (testRemoteUserGetsDeleted opts brig cannon fedBrigClient)
       ]
 
-testSearchSuccess :: Brig -> FedBrigClient -> Http ()
+testSearchSuccess :: Brig -> FedClient 'Brig -> Http ()
 testSearchSuccess brig fedBrigClient = do
   (handle, user) <- createUserWithHandle brig
   let quid = userQualifiedId user
@@ -87,26 +88,32 @@ testSearchSuccess brig fedBrigClient = do
   put (brig . path "/self" . contentJson . zUser (userId identityThief) . zConn "c" . body update) !!! const 200 === statusCode
   refreshIndex brig
 
-  searchResult <- FedBrig.searchUsers (fedBrigClient (Domain "example.com")) (SearchRequest (fromHandle handle))
+  searchResult <-
+    runFedClient @"search-users" fedBrigClient (Domain "example.com") $
+      SearchRequest (fromHandle handle)
   liftIO $ do
     let contacts = contactQualifiedId <$> searchResult
     assertEqual "should return only the first user id but not the identityThief" [quid] contacts
 
-testSearchNotFound :: FedBrigClient -> Http ()
+testSearchNotFound :: FedClient 'Brig -> Http ()
 testSearchNotFound fedBrigClient = do
-  searchResult <- FedBrig.searchUsers (fedBrigClient (Domain "example.com")) $ SearchRequest "this-handle-should-not-exist"
+  searchResult <-
+    runFedClient @"search-users" fedBrigClient (Domain "example.com") $
+      SearchRequest "this-handle-should-not-exist"
   liftIO $ assertEqual "should return empty array of users" [] searchResult
 
-testSearchNotFoundEmpty :: FedBrigClient -> Http ()
+testSearchNotFoundEmpty :: FedClient 'Brig -> Http ()
 testSearchNotFoundEmpty fedBrigClient = do
-  searchResult <- FedBrig.searchUsers (fedBrigClient (Domain "example.com")) $ SearchRequest ""
+  searchResult <-
+    runFedClient @"search-users" fedBrigClient (Domain "example.com") $
+      SearchRequest ""
   liftIO $ assertEqual "should return empty array of users" [] searchResult
 
-testGetUserByHandleSuccess :: Brig -> FedBrigClient -> Http ()
+testGetUserByHandleSuccess :: Brig -> FedClient 'Brig -> Http ()
 testGetUserByHandleSuccess brig fedBrigClient = do
   (handle, user) <- createUserWithHandle brig
   let quid = userQualifiedId user
-  maybeProfile <- FedBrig.getUserByHandle (fedBrigClient (Domain "example.com")) handle
+  maybeProfile <- runFedClient @"get-user-by-handle" fedBrigClient (Domain "example.com") handle
   liftIO $ do
     case maybeProfile of
       Nothing -> assertFailure "Expected to find profile, found Nothing"
@@ -114,13 +121,15 @@ testGetUserByHandleSuccess brig fedBrigClient = do
         assertEqual "should return correct user Id" quid (profileQualifiedId profile)
         assertEqual "should not have email address" Nothing (profileEmail profile)
 
-testGetUserByHandleNotFound :: FedBrigClient -> Http ()
+testGetUserByHandleNotFound :: FedClient 'Brig -> Http ()
 testGetUserByHandleNotFound fedBrigClient = do
   hdl <- randomHandle
-  maybeProfile <- FedBrig.getUserByHandle (fedBrigClient (Domain "example.com")) (Handle hdl)
+  maybeProfile <-
+    runFedClient @"get-user-by-handle" fedBrigClient (Domain "example.com") $
+      Handle hdl
   liftIO $ assertEqual "should not return any UserProfile" Nothing maybeProfile
 
-testGetUsersByIdsSuccess :: Brig -> FedBrigClient -> Http ()
+testGetUsersByIdsSuccess :: Brig -> FedClient 'Brig -> Http ()
 testGetUsersByIdsSuccess brig fedBrigClient = do
   user1 <- randomUser brig
   user2 <- randomUser brig
@@ -128,53 +137,55 @@ testGetUsersByIdsSuccess brig fedBrigClient = do
       quid1 = userQualifiedId user1
       uid2 = userId user2
       quid2 = userQualifiedId user2
-  profiles <- FedBrig.getUsersByIds (fedBrigClient (Domain "example.com")) [uid1, uid2]
+  profiles <- runFedClient @"get-users-by-ids" fedBrigClient (Domain "example.com") [uid1, uid2]
   liftIO $ do
     assertEqual "should return correct user Id" (Set.fromList [quid1, quid2]) (Set.fromList $ profileQualifiedId <$> profiles)
     assertEqual "should not have email address" [Nothing, Nothing] (map profileEmail profiles)
 
-testGetUsersByIdsPartial :: Brig -> FedBrigClient -> Http ()
+testGetUsersByIdsPartial :: Brig -> FedClient 'Brig -> Http ()
 testGetUsersByIdsPartial brig fedBrigClient = do
   presentUser <- randomUser brig
   absentUserId :: UserId <- Id <$> lift UUIDv4.nextRandom
-  profiles <- FedBrig.getUsersByIds (fedBrigClient (Domain "example.com")) [userId presentUser, absentUserId]
+  profiles <-
+    runFedClient @"get-users-by-ids" fedBrigClient (Domain "example.com") $
+      [userId presentUser, absentUserId]
   liftIO $
     assertEqual "should return the present user and skip the absent ones" [userQualifiedId presentUser] (profileQualifiedId <$> profiles)
 
-testGetUsersByIdsNoneFound :: FedBrigClient -> Http ()
+testGetUsersByIdsNoneFound :: FedClient 'Brig -> Http ()
 testGetUsersByIdsNoneFound fedBrigClient = do
   absentUserId1 :: UserId <- Id <$> lift UUIDv4.nextRandom
   absentUserId2 :: UserId <- Id <$> lift UUIDv4.nextRandom
-  profiles <- FedBrig.getUsersByIds (fedBrigClient (Domain "example.com")) [absentUserId1, absentUserId2]
+  profiles <- runFedClient @"get-users-by-ids" fedBrigClient (Domain "example.com") [absentUserId1, absentUserId2]
   liftIO $
     assertEqual "should return empty list" [] profiles
 
-testClaimPrekeySuccess :: Brig -> FedBrigClient -> Http ()
+testClaimPrekeySuccess :: Brig -> FedClient 'Brig -> Http ()
 testClaimPrekeySuccess brig fedBrigClient = do
   user <- randomUser brig
   let uid = userId user
   let new = defNewClient PermanentClientType [head somePrekeys] (head someLastPrekeys)
   c <- responseJsonError =<< addClient brig uid new
-  mkey <- FedBrig.claimPrekey (fedBrigClient (Domain "example.com")) (uid, clientId c)
+  mkey <- runFedClient @"claim-prekey" fedBrigClient (Domain "example.com") (uid, clientId c)
   liftIO $
     assertEqual
       "should return prekey 1"
       (Just (PrekeyId 1))
       (fmap (prekeyId . prekeyData) mkey)
 
-testClaimPrekeyBundleSuccess :: Brig -> FedBrigClient -> Http ()
+testClaimPrekeyBundleSuccess :: Brig -> FedClient 'Brig -> Http ()
 testClaimPrekeyBundleSuccess brig fedBrigClient = do
   let prekeys = take 5 (zip somePrekeys someLastPrekeys)
   (quid, clients) <- generateClientPrekeys brig prekeys
   let sortClients = sortBy (compare `on` prekeyClient)
-  bundle <- FedBrig.claimPrekeyBundle (fedBrigClient (Domain "example.com")) (qUnqualified quid)
+  bundle <- runFedClient @"claim-prekey-bundle" fedBrigClient (Domain "example.com") (qUnqualified quid)
   liftIO $
     assertEqual
       "bundle should contain the clients"
       (sortClients clients)
       (sortClients . prekeyClients $ bundle)
 
-testClaimMultiPrekeyBundleSuccess :: Brig -> FedBrigClient -> Http ()
+testClaimMultiPrekeyBundleSuccess :: Brig -> FedClient 'Brig -> Http ()
 testClaimMultiPrekeyBundleSuccess brig fedBrigClient = do
   let prekeys = zip somePrekeys someLastPrekeys
       (prekeys1, prekeys') = splitAt 5 prekeys
@@ -185,7 +196,7 @@ testClaimMultiPrekeyBundleSuccess brig fedBrigClient = do
   c2 <- first qUnqualified <$> generateClientPrekeys brig prekeys2
   let uc = UserClients (Map.fromList [mkClients <$> c1, mkClients <$> c2])
       ucm = mkUserClientPrekeyMap (Map.fromList [mkClientMap <$> c1, mkClientMap <$> c2])
-  ucmResponse <- FedBrig.claimMultiPrekeyBundle (fedBrigClient (Domain "example.com")) uc
+  ucmResponse <- runFedClient @"claim-multi-prekey-bundle" fedBrigClient (Domain "example.com") uc
   liftIO $
     assertEqual
       "should return the UserClientMap"
@@ -199,28 +210,28 @@ addTestClients brig uid idxs =
     client :: Client <- responseJsonError =<< addClient brig uid (defNewClient PermanentClientType [pk] lk)
     pure client
 
-testGetUserClients :: Brig -> FedBrigClient -> Http ()
+testGetUserClients :: Brig -> FedClient 'Brig -> Http ()
 testGetUserClients brig fedBrigClient = do
   uid1 <- userId <$> randomUser brig
   clients :: [Client] <- addTestClients brig uid1 [0, 1, 2]
-  UserMap userClients <- FedBrig.getUserClients (fedBrigClient (Domain "example.com")) (GetUserClients [uid1])
+  UserMap userClients <- runFedClient @"get-user-clients" fedBrigClient (Domain "example.com") (GetUserClients [uid1])
   liftIO $
     assertEqual
       "client set for user should match"
       (Just (Set.fromList (fmap clientId clients)))
       (fmap (Set.map pubClientId) . Map.lookup uid1 $ userClients)
 
-testGetUserClientsNotFound :: FedBrigClient -> Http ()
+testGetUserClientsNotFound :: FedClient 'Brig -> Http ()
 testGetUserClientsNotFound fedBrigClient = do
   absentUserId <- randomId
-  UserMap userClients <- FedBrig.getUserClients (fedBrigClient (Domain "example.com")) (GetUserClients [absentUserId])
+  UserMap userClients <- runFedClient @"get-user-clients" fedBrigClient (Domain "example.com") (GetUserClients [absentUserId])
   liftIO $
     assertEqual
       "client set for user should match"
       (Just (Set.fromList []))
       (fmap (Set.map pubClientId) . Map.lookup absentUserId $ userClients)
 
-testRemoteUserGetsDeleted :: Opt.Opts -> Brig -> Cannon -> FedBrigClient -> Http ()
+testRemoteUserGetsDeleted :: Opt.Opts -> Brig -> Cannon -> FedClient 'Brig -> Http ()
 testRemoteUserGetsDeleted opts brig cannon fedBrigClient = do
   connectedUser <- userId <$> randomUser brig
   pendingUser <- userId <$> randomUser brig
@@ -236,9 +247,8 @@ testRemoteUserGetsDeleted opts brig cannon fedBrigClient = do
   let localUsers = [connectedUser, pendingUser, blockedUser, unconnectedUser]
   void . WS.bracketRN cannon localUsers $ \[cc, pc, bc, uc] -> do
     _ <-
-      FedBrig.onUserDeleted
-        (fedBrigClient (qDomain remoteUser))
-        (UserDeletedConnectionsNotification (qUnqualified remoteUser) (unsafeRange localUsers))
+      runFedClient @"on-user-deleted-connections" fedBrigClient (qDomain remoteUser) $
+        UserDeletedConnectionsNotification (qUnqualified remoteUser) (unsafeRange localUsers)
 
     WS.assertMatchN_ (5 # Second) [cc] $ matchDeleteUserNotification remoteUser
     WS.assertNoEvent (1 # Second) [pc, bc, uc]
diff --git a/services/brig/test/integration/API/User.hs b/services/brig/test/integration/API/User.hs
index 8d3a357312d..ed1863c4a59 100644
--- a/services/brig/test/integration/API/User.hs
+++ b/services/brig/test/integration/API/User.hs
@@ -40,8 +40,21 @@ import Imports
 import Test.Tasty hiding (Timeout)
 import Util
 import Util.Options.Common
+import Wire.API.Federation.Component
 
-tests :: Opt.Opts -> FedBrigClient -> FedGalleyClient -> Manager -> Brig -> Cannon -> CargoHold -> Galley -> Nginz -> AWS.Env -> DB.ClientState -> IO TestTree
+tests ::
+  Opt.Opts ->
+  FedClient 'Brig ->
+  FedClient 'Galley ->
+  Manager ->
+  Brig ->
+  Cannon ->
+  CargoHold ->
+  Galley ->
+  Nginz ->
+  AWS.Env ->
+  DB.ClientState ->
+  IO TestTree
 tests conf fbc fgc p b c ch g n aws db = do
   let cl = ConnectionLimit $ Opt.setUserMaxConnections (Opt.optSettings conf)
   let at = Opt.setActivationTimeout (Opt.optSettings conf)
diff --git a/services/brig/test/integration/API/User/Connection.hs b/services/brig/test/integration/API/User/Connection.hs
index 199d41228d7..8ab59976bd7 100644
--- a/services/brig/test/integration/API/User/Connection.hs
+++ b/services/brig/test/integration/API/User/Connection.hs
@@ -44,13 +44,24 @@ import Test.Tasty hiding (Timeout)
 import Test.Tasty.HUnit
 import Util
 import Wire.API.Connection
-import qualified Wire.API.Federation.API.Brig as F
+import Wire.API.Federation.API.Brig
 import Wire.API.Federation.API.Galley (GetConversationsRequest (..), GetConversationsResponse (gcresConvs), RemoteConvMembers (rcmOthers), RemoteConversation (rcnvMembers))
-import qualified Wire.API.Federation.API.Galley as F
+import Wire.API.Federation.Component
 import Wire.API.Routes.Internal.Brig.Connection
 import Wire.API.Routes.MultiTablePaging
 
-tests :: ConnectionLimit -> Opt.Timeout -> Opt.Opts -> Manager -> Brig -> Cannon -> Galley -> FedBrigClient -> FedGalleyClient -> DB.ClientState -> TestTree
+tests ::
+  ConnectionLimit ->
+  Opt.Timeout ->
+  Opt.Opts ->
+  Manager ->
+  Brig ->
+  Cannon ->
+  Galley ->
+  FedClient 'Brig ->
+  FedClient 'Galley ->
+  DB.ClientState ->
+  TestTree
 tests cl _at opts p b _c g fedBrigClient fedGalleyClient db =
   testGroup
     "connection"
@@ -713,23 +724,25 @@ testConnectFederationNotAvailable brig = do
   postConnectionQualified brig uid1 quid2
     !!! const 422 === statusCode
 
-testConnectOK :: Brig -> Galley -> FedBrigClient -> Http ()
+testConnectOK :: Brig -> Galley -> FedClient 'Brig -> Http ()
 testConnectOK brig galley fedBrigClient = do
   let convIsLocal = True
   (uid1, quid2, convId) <- localAndRemoteUserWithConvId brig convIsLocal
-  receiveConnectionAction brig fedBrigClient uid1 quid2 F.RemoteConnect Nothing Pending
+  receiveConnectionAction brig fedBrigClient uid1 quid2 RemoteConnect Nothing Pending
 
   -- The conversation exists uid1 is not a participant however
   getConversationQualified galley uid1 convId
     !!! statusCode === const 403
 
-testConnectWithAnon :: Brig -> FedBrigClient -> Http ()
+testConnectWithAnon :: Brig -> FedClient 'Brig -> Http ()
 testConnectWithAnon brig fedBrigClient = do
   fromUser <- randomId
   toUser <- userId <$> createAnonUser "anon1234" brig
-  res <- F.sendConnectionAction (fedBrigClient (Domain "far-away.example.com")) (F.NewConnectionRequest fromUser toUser F.RemoteConnect)
+  res <-
+    runFedClient @"send-connection-action" fedBrigClient (Domain "far-away.example.com") $
+      NewConnectionRequest fromUser toUser RemoteConnect
   liftIO $
-    assertEqual "The response should specify that the user is not activated" F.NewConnectionResponseUserNotActivated res
+    assertEqual "The response should specify that the user is not activated" NewConnectionResponseUserNotActivated res
 
 testConnectFromAnon :: Brig -> Http ()
 testConnectFromAnon brig = do
@@ -737,7 +750,7 @@ testConnectFromAnon brig = do
   remoteUser <- fakeRemoteUser
   postConnectionQualified brig anonUser remoteUser !!! const 403 === statusCode
 
-testConnectMutualLocalActionThenRemoteAction :: Opt.Opts -> Brig -> Galley -> FedBrigClient -> Http ()
+testConnectMutualLocalActionThenRemoteAction :: Opt.Opts -> Brig -> Galley -> FedClient 'Brig -> Http ()
 testConnectMutualLocalActionThenRemoteAction opts brig galley fedBrigClient = do
   let convIsLocal = True
   (uid1, quid2, convId) <- localAndRemoteUserWithConvId brig convIsLocal
@@ -756,7 +769,7 @@ testConnectMutualLocalActionThenRemoteAction opts brig galley fedBrigClient = do
 
   -- The response should have 'RemoteConnect' as action, because we cannot be
   -- sure if the remote was previously in Ignored state or not
-  receiveConnectionAction brig fedBrigClient uid1 quid2 F.RemoteConnect (Just F.RemoteConnect) Accepted
+  receiveConnectionAction brig fedBrigClient uid1 quid2 RemoteConnect (Just RemoteConnect) Accepted
 
   do
     res <-
@@ -766,14 +779,14 @@ testConnectMutualLocalActionThenRemoteAction opts brig galley fedBrigClient = do
     liftIO $
       (fmap omQualifiedId . cmOthers . cnvMembers) conv @?= [quid2]
 
-testConnectMutualRemoteActionThenLocalAction :: Opt.Opts -> Brig -> FedBrigClient -> FedGalleyClient -> Http ()
+testConnectMutualRemoteActionThenLocalAction :: Opt.Opts -> Brig -> FedClient 'Brig -> FedClient 'Galley -> Http ()
 testConnectMutualRemoteActionThenLocalAction opts brig fedBrigClient fedGalleyClient = do
   let convIsLocal = True
   (uid1, quid2, convId) <- localAndRemoteUserWithConvId brig convIsLocal
 
   -- First create a connection request from remote to local user, as this test
   -- aims to test the behaviour of sending a mutual request to remote
-  receiveConnectionAction brig fedBrigClient uid1 quid2 F.RemoteConnect Nothing Pending
+  receiveConnectionAction brig fedBrigClient uid1 quid2 RemoteConnect Nothing Pending
 
   let request =
         GetConversationsRequest
@@ -781,58 +794,58 @@ testConnectMutualRemoteActionThenLocalAction opts brig fedBrigClient fedGalleyCl
             gcrConvIds = [qUnqualified convId]
           }
 
-  res <- F.getConversations (fedGalleyClient (qDomain quid2)) request
+  res <- runFedClient @"get-conversations" fedGalleyClient (qDomain quid2) request
   liftIO $
     fmap (fmap omQualifiedId . rcmOthers . rcnvMembers) (gcresConvs res) @?= [[]]
 
   -- The mock response has 'RemoteConnect' as action, because the remote backend
   -- cannot be sure if the local backend was previously in Ignored state or not
-  sendConnectionAction brig opts uid1 quid2 (Just F.RemoteConnect) Accepted
+  sendConnectionAction brig opts uid1 quid2 (Just RemoteConnect) Accepted
 
-testConnectFromPending :: Brig -> FedBrigClient -> Http ()
+testConnectFromPending :: Brig -> FedClient 'Brig -> Http ()
 testConnectFromPending brig fedBrigClient = do
   (uid1, quid2) <- localAndRemoteUser brig
-  receiveConnectionAction brig fedBrigClient uid1 quid2 F.RemoteConnect Nothing Pending
-  receiveConnectionAction brig fedBrigClient uid1 quid2 F.RemoteConnect Nothing Pending
-  receiveConnectionAction brig fedBrigClient uid1 quid2 F.RemoteRescind Nothing Cancelled
+  receiveConnectionAction brig fedBrigClient uid1 quid2 RemoteConnect Nothing Pending
+  receiveConnectionAction brig fedBrigClient uid1 quid2 RemoteConnect Nothing Pending
+  receiveConnectionAction brig fedBrigClient uid1 quid2 RemoteRescind Nothing Cancelled
 
-testConnectFromIgnored :: Opt.Opts -> Brig -> FedBrigClient -> Http ()
+testConnectFromIgnored :: Opt.Opts -> Brig -> FedClient 'Brig -> Http ()
 testConnectFromIgnored opts brig fedBrigClient = do
   (uid1, quid2) <- localAndRemoteUser brig
 
   -- set up an initial 'Ignored' state
-  receiveConnectionAction brig fedBrigClient uid1 quid2 F.RemoteConnect Nothing Pending
+  receiveConnectionAction brig fedBrigClient uid1 quid2 RemoteConnect Nothing Pending
   putConnectionQualified brig uid1 quid2 Ignored !!! statusCode === const 200
   assertConnectionQualified brig uid1 quid2 Ignored
 
   -- if the remote side sends a new connection request, we go back to 'Pending'
-  receiveConnectionAction brig fedBrigClient uid1 quid2 F.RemoteConnect Nothing Pending
+  receiveConnectionAction brig fedBrigClient uid1 quid2 RemoteConnect Nothing Pending
 
   -- if we accept, and the remote side still wants to connect, we transition to 'Accepted'
-  sendConnectionAction brig opts uid1 quid2 (Just F.RemoteConnect) Accepted
+  sendConnectionAction brig opts uid1 quid2 (Just RemoteConnect) Accepted
 
-testSentFromIgnored :: Opt.Opts -> Brig -> FedBrigClient -> Http ()
+testSentFromIgnored :: Opt.Opts -> Brig -> FedClient 'Brig -> Http ()
 testSentFromIgnored opts brig fedBrigClient = do
   (uid1, quid2) <- localAndRemoteUser brig
 
   -- set up an initial 'Ignored' state
-  receiveConnectionAction brig fedBrigClient uid1 quid2 F.RemoteConnect Nothing Pending
+  receiveConnectionAction brig fedBrigClient uid1 quid2 RemoteConnect Nothing Pending
   putConnectionQualified brig uid1 quid2 Ignored !!! statusCode === const 200
   assertConnectionQualified brig uid1 quid2 Ignored
 
   -- if the remote side rescinds, we stay in 'Ignored'
-  receiveConnectionAction brig fedBrigClient uid1 quid2 F.RemoteRescind Nothing Ignored
+  receiveConnectionAction brig fedBrigClient uid1 quid2 RemoteRescind Nothing Ignored
 
   -- if we accept, and the remote does not want to connect anymore, we transition to 'Sent'
   sendConnectionAction brig opts uid1 quid2 Nothing Sent
 
-testConnectFromBlocked :: Opt.Opts -> Brig -> Galley -> FedBrigClient -> Http ()
+testConnectFromBlocked :: Opt.Opts -> Brig -> Galley -> FedClient 'Brig -> Http ()
 testConnectFromBlocked opts brig galley fedBrigClient = do
   let convIsLocal = True
   (uid1, quid2, convId) <- localAndRemoteUserWithConvId brig convIsLocal
 
   -- set up an initial 'Blocked' state
-  receiveConnectionAction brig fedBrigClient uid1 quid2 F.RemoteConnect Nothing Pending
+  receiveConnectionAction brig fedBrigClient uid1 quid2 RemoteConnect Nothing Pending
   putConnectionQualified brig uid1 quid2 Blocked !!! statusCode === const 200
   assertConnectionQualified brig uid1 quid2 Blocked
 
@@ -840,11 +853,11 @@ testConnectFromBlocked opts brig galley fedBrigClient = do
     !!! statusCode === const 403
 
   -- if the remote side sends a new connection request, we ignore it
-  receiveConnectionAction brig fedBrigClient uid1 quid2 F.RemoteConnect Nothing Blocked
+  receiveConnectionAction brig fedBrigClient uid1 quid2 RemoteConnect Nothing Blocked
 
   -- if we accept (or send a connection request), and the remote side still
   -- wants to connect, we transition to 'Accepted'
-  sendConnectionAction brig opts uid1 quid2 (Just F.RemoteConnect) Accepted
+  sendConnectionAction brig opts uid1 quid2 (Just RemoteConnect) Accepted
 
   do
     res <-
@@ -854,17 +867,17 @@ testConnectFromBlocked opts brig galley fedBrigClient = do
     liftIO $
       (fmap omQualifiedId . cmOthers . cnvMembers) conv @?= [quid2]
 
-testSentFromBlocked :: Opt.Opts -> Brig -> FedBrigClient -> Http ()
+testSentFromBlocked :: Opt.Opts -> Brig -> FedClient 'Brig -> Http ()
 testSentFromBlocked opts brig fedBrigClient = do
   (uid1, quid2) <- localAndRemoteUser brig
 
   -- set up an initial 'Blocked' state
-  receiveConnectionAction brig fedBrigClient uid1 quid2 F.RemoteConnect Nothing Pending
+  receiveConnectionAction brig fedBrigClient uid1 quid2 RemoteConnect Nothing Pending
   putConnectionQualified brig uid1 quid2 Blocked !!! statusCode === const 200
   assertConnectionQualified brig uid1 quid2 Blocked
 
   -- if the remote side rescinds, we stay in 'Blocked'
-  receiveConnectionAction brig fedBrigClient uid1 quid2 F.RemoteRescind Nothing Blocked
+  receiveConnectionAction brig fedBrigClient uid1 quid2 RemoteRescind Nothing Blocked
 
   -- if we accept, and the remote does not want to connect anymore, we transition to 'Sent'
   sendConnectionAction brig opts uid1 quid2 Nothing Sent
@@ -876,7 +889,7 @@ testCancel opts brig = do
   sendConnectionAction brig opts uid1 quid2 Nothing Sent
   sendConnectionUpdateAction brig opts uid1 quid2 Nothing Cancelled
 
-testConnectionLimits :: Opt.Opts -> Brig -> FedBrigClient -> Http ()
+testConnectionLimits :: Opt.Opts -> Brig -> FedClient 'Brig -> Http ()
 testConnectionLimits opts brig fedBrigClient = do
   let connectionLimit = Opt.setUserMaxConnections (Opt.optSettings opts)
   (uid1, quid2) <- localAndRemoteUser brig
@@ -886,38 +899,38 @@ testConnectionLimits opts brig fedBrigClient = do
   (quid6Sent : _) <- replicateM (fromIntegral connectionLimit - 1) (newConn uid1)
 
   -- accepting another one should be allowed
-  receiveConnectionAction brig fedBrigClient uid1 quid2 F.RemoteConnect Nothing Pending
-  sendConnectionAction brig opts uid1 quid2 (Just F.RemoteConnect) Accepted
+  receiveConnectionAction brig fedBrigClient uid1 quid2 RemoteConnect Nothing Pending
+  sendConnectionAction brig opts uid1 quid2 (Just RemoteConnect) Accepted
 
   -- get an incoming connection requests beyond the limit, This connection
   -- cannot be accepted. This is also the behaviour without federation, if the
   -- user wants to accept this one, they have to either sacrifice another
   -- connection or ask the backend operator to increase the limit.
-  receiveConnectionAction brig fedBrigClient uid1 quid3 F.RemoteConnect Nothing Pending
+  receiveConnectionAction brig fedBrigClient uid1 quid3 RemoteConnect Nothing Pending
 
   -- accepting the second one hits the limit (and relation stays Pending):
-  sendConnectionActionExpectLimit uid1 quid3 (Just F.RemoteConnect)
+  sendConnectionActionExpectLimit uid1 quid3 (Just RemoteConnect)
   assertConnectionQualified brig uid1 quid3 Pending
 
   -- When a remote accepts, it is allowed, this does not break the limit as a
   -- Sent becomes an Accepted.
   assertConnectionQualified brig uid1 quid6Sent Sent
-  receiveConnectionAction brig fedBrigClient uid1 quid6Sent F.RemoteConnect (Just F.RemoteConnect) Accepted
+  receiveConnectionAction brig fedBrigClient uid1 quid6Sent RemoteConnect (Just RemoteConnect) Accepted
 
   -- attempting to send an own new connection request also hits the limit
-  sendConnectionActionExpectLimit uid1 quid4 (Just F.RemoteConnect)
+  sendConnectionActionExpectLimit uid1 quid4 (Just RemoteConnect)
   getConnectionQualified brig uid1 quid4 !!! const 404 === statusCode
 
   -- (re-)sending an already accepted connection does not affect the limit
-  sendConnectionAction brig opts uid1 quid2 (Just F.RemoteConnect) Accepted
+  sendConnectionAction brig opts uid1 quid2 (Just RemoteConnect) Accepted
 
   -- blocked connections do not count towards the limit
   putConnectionQualified brig uid1 quid2 Blocked !!! statusCode === const 200
   assertConnectionQualified brig uid1 quid2 Blocked
 
   -- after blocking quid2, we can now accept another connection request
-  receiveConnectionAction brig fedBrigClient uid1 quid5 F.RemoteConnect Nothing Pending
-  sendConnectionAction brig opts uid1 quid5 (Just F.RemoteConnect) Accepted
+  receiveConnectionAction brig fedBrigClient uid1 quid5 RemoteConnect Nothing Pending
+  sendConnectionAction brig opts uid1 quid5 (Just RemoteConnect) Accepted
   where
     newConn :: UserId -> Http (Qualified UserId)
     newConn from = do
@@ -925,13 +938,13 @@ testConnectionLimits opts brig fedBrigClient = do
       sendConnectionAction brig opts from to Nothing Sent
       pure to
 
-    sendConnectionActionExpectLimit :: HasCallStack => UserId -> Qualified UserId -> Maybe F.RemoteConnectionAction -> Http ()
+    sendConnectionActionExpectLimit :: HasCallStack => UserId -> Qualified UserId -> Maybe RemoteConnectionAction -> Http ()
     sendConnectionActionExpectLimit uid1 quid2 _reaction = do
       postConnectionQualified brig uid1 quid2 !!! do
         const 403 === statusCode
         const (Just "connection-limit") === fmap Error.label . responseJsonMaybe
 
-testInternalGetConnStatusesAll :: Brig -> Opt.Opts -> FedBrigClient -> Http ()
+testInternalGetConnStatusesAll :: Brig -> Opt.Opts -> FedClient 'Brig -> Http ()
 testInternalGetConnStatusesAll brig opts fedBrigClient = do
   quids <- replicateM 2 $ userQualifiedId <$> randomUser brig
   let uids = qUnqualified <$> quids
@@ -951,11 +964,11 @@ testInternalGetConnStatusesAll brig opts fedBrigClient = do
 
     -- Create 5 remote connections with remote1, accept 1
     for_ remoteDomain1Users $ \qOther -> sendConnectionAction brig opts uid qOther Nothing Sent
-    receiveConnectionAction brig fedBrigClient uid remoteDomain1User1 F.RemoteConnect (Just F.RemoteConnect) Accepted
+    receiveConnectionAction brig fedBrigClient uid remoteDomain1User1 RemoteConnect (Just RemoteConnect) Accepted
 
     -- Create 5 remote connections with remote2, accept 1
     for_ remoteDomain2Users $ \qOther -> sendConnectionAction brig opts uid qOther Nothing Sent
-    receiveConnectionAction brig fedBrigClient uid remoteDomain2User1 F.RemoteConnect (Just F.RemoteConnect) Accepted
+    receiveConnectionAction brig fedBrigClient uid remoteDomain2User1 RemoteConnect (Just RemoteConnect) Accepted
 
   allStatuses :: [ConnectionStatusV2] <-
     responseJsonError =<< getConnStatusInternal brig (ConnectionsStatusRequestV2 uids Nothing Nothing)
diff --git a/services/brig/test/integration/API/User/Util.hs b/services/brig/test/integration/API/User/Util.hs
index 784db1f7dd3..e626214cd22 100644
--- a/services/brig/test/integration/API/User/Util.hs
+++ b/services/brig/test/integration/API/User/Util.hs
@@ -336,7 +336,7 @@ assertConnectionQualified brig u1 qu2 rel =
 receiveConnectionAction ::
   HasCallStack =>
   Brig ->
-  FedBrigClient ->
+  FedClient 'Brig ->
   UserId ->
   Qualified UserId ->
   F.RemoteConnectionAction ->
@@ -345,7 +345,7 @@ receiveConnectionAction ::
   Http ()
 receiveConnectionAction brig fedBrigClient uid1 quid2 action expectedReaction expectedRel = do
   res <-
-    F.sendConnectionAction (fedBrigClient (qDomain quid2)) $
+    runFedClient @"send-connection-action" fedBrigClient (qDomain quid2) $
       F.NewConnectionRequest (qUnqualified quid2) uid1 action
   liftIO $ do
     res @?= F.NewConnectionResponseOk expectedReaction
diff --git a/services/brig/test/integration/Main.hs b/services/brig/test/integration/Main.hs
index 21c7824deb2..29881f8efec 100644
--- a/services/brig/test/integration/Main.hs
+++ b/services/brig/test/integration/Main.hs
@@ -38,38 +38,26 @@ import qualified Brig.Options as Opts
 import Cassandra.Util (defInitCassandra)
 import Control.Lens
 import Data.Aeson
-import Data.ByteString.Conversion
-import Data.Domain
 import Data.Metrics.Test (pathsConsistencyCheck)
 import Data.Metrics.WaiRoute (treeToPaths)
-import qualified Data.Text as Text
 import Data.Text.Encoding (encodeUtf8)
 import Data.Yaml (decodeFileEither)
 import qualified Federation.End2end
 import Imports hiding (local)
 import qualified Index.Create
-import qualified Network.HTTP.Client as HTTP
 import Network.HTTP.Client.TLS (tlsManagerSettings)
 import Network.Wai.Utilities.Server (compile)
 import OpenSSL (withOpenSSL)
 import Options.Applicative hiding (action)
-import Servant.API.Generic (GenericServant, ToServant, ToServantApi)
-import qualified Servant.Client as Servant
-import Servant.Client.Core
-import qualified Servant.Client.Core.Request as Client
-import Servant.Client.Generic (AsClientT)
-import qualified Servant.Client.Generic as Servant
 import System.Environment (withArgs)
 import qualified System.Environment.Blank as Blank
 import qualified System.Logger as Logger
 import Test.Tasty
 import Test.Tasty.HUnit
-import Util (FedBrigClient, FedGalleyClient)
+import Util
 import Util.Options
 import Util.Test
-import qualified Wire.API.Federation.API.Brig as F
-import qualified Wire.API.Federation.API.Galley as F
-import Wire.API.Federation.Domain
+import Wire.API.Federation.API
 
 data BackendConf = BackendConf
   { remoteBrig :: Endpoint,
@@ -132,8 +120,8 @@ runTests iConf brigOpts otherArgs = do
   lg <- Logger.new Logger.defSettings -- TODO: use mkLogger'?
   db <- defInitCassandra casKey casHost casPort lg
   mg <- newManager tlsManagerSettings
-  let fedBrigClient = mkFedBrigClient mg (brig iConf)
-  let fedGalleyClient = mkFedGalleyClient mg (galley iConf)
+  let fedBrigClient = FedClient @'Brig mg (brig iConf)
+  let fedGalleyClient = FedClient @'Galley mg (galley iConf)
   emailAWSOpts <- parseEmailAWSOpts
   awsEnv <- AWS.mkEnv lg awsOpts emailAWSOpts mg
   userApi <- User.tests brigOpts fedBrigClient fedGalleyClient mg b c ch g n awsEnv db
@@ -226,40 +214,3 @@ parseConfigPaths = do
                   <> showDefault
                   <> value defaultBrigPath
             )
-
-mkFedBrigClient :: Manager -> Endpoint -> FedBrigClient
-mkFedBrigClient = mkFedBrigClientGen @F.BrigApi
-
-mkFedGalleyClient :: Manager -> Endpoint -> FedGalleyClient
-mkFedGalleyClient = mkFedBrigClientGen @F.GalleyApi
-
-mkFedBrigClientGen ::
-  forall routes.
-  ( HasClient Servant.ClientM (ToServantApi routes),
-    GenericServant routes (AsClientT (HttpT IO)),
-    Servant.Client (HttpT IO) (ToServantApi routes) ~ ToServant routes (AsClientT (HttpT IO))
-  ) =>
-  Manager ->
-  Endpoint ->
-  Domain ->
-  routes (AsClientT (HttpT IO))
-mkFedBrigClientGen mgr endpoint originDomain = Servant.genericClientHoist servantClientMToHttp
-  where
-    servantClientMToHttp :: Servant.ClientM a -> Http a
-    servantClientMToHttp action = liftIO $ do
-      let brigHost = Text.unpack $ endpoint ^. epHost
-          brigPort = fromInteger . toInteger $ endpoint ^. epPort
-          baseUrl = Servant.BaseUrl Servant.Http brigHost brigPort "/federation"
-          clientEnv = Servant.ClientEnv mgr baseUrl Nothing makeClientRequest
-      eitherRes <- Servant.runClientM action clientEnv
-      case eitherRes of
-        Right res -> pure res
-        Left err -> assertFailure $ "Servant client failed with: " <> show err
-
-    makeClientRequest :: BaseUrl -> Client.Request -> HTTP.Request
-    makeClientRequest burl req =
-      let req' = Servant.defaultMakeClientRequest burl req
-       in req'
-            { HTTP.requestHeaders =
-                HTTP.requestHeaders req' <> [(originDomainHeaderName, toByteString' originDomain)]
-            }
diff --git a/services/brig/test/integration/Util.hs b/services/brig/test/integration/Util.hs
index 93867dae538..86be8f98269 100644
--- a/services/brig/test/integration/Util.hs
+++ b/services/brig/test/integration/Util.hs
@@ -31,7 +31,7 @@ import qualified Brig.Options as Opt
 import qualified Brig.Options as Opts
 import qualified Brig.Run as Run
 import Brig.Types.Activation
-import Brig.Types.Client
+import Brig.Types.Client hiding (Client)
 import Brig.Types.Connection
 import Brig.Types.Intra
 import Brig.Types.User
@@ -67,10 +67,12 @@ import Data.Text.Encoding (encodeUtf8)
 import qualified Data.UUID as UUID
 import qualified Data.UUID.V4 as UUID
 import qualified Federator.MockServer as Mock
+import GHC.TypeLits
 import Galley.Types.Conversations.One2One (one2OneConvId)
 import qualified Galley.Types.Teams as Team
 import Gundeck.Types.Notification
 import Imports
+import qualified Network.HTTP.Client as HTTP
 import Network.HTTP.Media.MediaType
 import Network.HTTP.Types (Method)
 import Network.Wai (Application)
@@ -79,7 +81,8 @@ import qualified Network.Wai.Handler.Warp as Warp
 import Network.Wai.Test (Session)
 import qualified Network.Wai.Test as WaiTest
 import OpenSSL.BN (randIntegerZeroToNMinusOne)
-import Servant.Client.Generic (AsClientT)
+import qualified Servant.Client as Servant
+import qualified Servant.Client.Core as Servant
 import System.Random (randomIO, randomRIO)
 import qualified System.Timeout as System
 import Test.Tasty (TestName, TestTree)
@@ -89,11 +92,11 @@ import Test.Tasty.HUnit
 import Text.Printf (printf)
 import qualified UnliftIO.Async as Async
 import Util.AWS
-import Util.Options (Endpoint (Endpoint))
+import Util.Options
 import Wire.API.Conversation
 import Wire.API.Conversation.Role (roleNameWireAdmin)
-import qualified Wire.API.Federation.API.Brig as F
-import qualified Wire.API.Federation.API.Galley as F
+import Wire.API.Federation.API
+import Wire.API.Federation.Domain
 import Wire.API.Routes.MultiTablePaging
 
 type Brig = Request -> Request
@@ -110,9 +113,38 @@ type Nginz = Request -> Request
 
 type Spar = Request -> Request
 
-type FedBrigClient = Domain -> F.BrigApi (AsClientT (HttpT IO))
+data FedClient (comp :: Component) = FedClient HTTP.Manager Endpoint
 
-type FedGalleyClient = Domain -> F.GalleyApi (AsClientT (HttpT IO))
+runFedClient ::
+  forall (name :: Symbol) comp api.
+  ( HasFedEndpoint comp api name,
+    Servant.HasClient Servant.ClientM api
+  ) =>
+  FedClient comp ->
+  Domain ->
+  Servant.Client Http api
+runFedClient (FedClient mgr endpoint) domain =
+  Servant.hoistClient (Proxy @api) (servantClientMToHttp domain) $
+    Servant.clientIn (Proxy @api) (Proxy @Servant.ClientM)
+  where
+    servantClientMToHttp :: Domain -> Servant.ClientM a -> Http a
+    servantClientMToHttp originDomain action = liftIO $ do
+      let brigHost = Text.unpack $ endpoint ^. epHost
+          brigPort = fromInteger . toInteger $ endpoint ^. epPort
+          baseUrl = Servant.BaseUrl Servant.Http brigHost brigPort "/federation"
+          clientEnv = Servant.ClientEnv mgr baseUrl Nothing (makeClientRequest originDomain)
+      eitherRes <- Servant.runClientM action clientEnv
+      case eitherRes of
+        Right res -> pure res
+        Left err -> assertFailure $ "Servant client failed with: " <> show err
+
+    makeClientRequest :: Domain -> Servant.BaseUrl -> Servant.Request -> HTTP.Request
+    makeClientRequest originDomain burl req =
+      let req' = Servant.defaultMakeClientRequest burl req
+       in req'
+            { HTTP.requestHeaders =
+                HTTP.requestHeaders req' <> [(originDomainHeaderName, toByteString' originDomain)]
+            }
 
 instance ToJSON SESBounceType where
   toJSON BounceUndetermined = String "Undetermined"
diff --git a/services/cargohold/src/CargoHold/API/Federation.hs b/services/cargohold/src/CargoHold/API/Federation.hs
index 7bdf9a90438..8a0efb0bb65 100644
--- a/services/cargohold/src/CargoHold/API/Federation.hs
+++ b/services/cargohold/src/CargoHold/API/Federation.hs
@@ -28,35 +28,32 @@ import CargoHold.API.V3
 import CargoHold.App
 import qualified CargoHold.S3 as S3
 import Control.Error
+import Data.Domain
 import Imports
 import Servant.API
-import Servant.API.Generic
 import Servant.Server hiding (Handler)
-import Servant.Server.Generic
 import Wire.API.Federation.API
 import qualified Wire.API.Federation.API.Cargohold as F
 import Wire.API.Routes.AssetBody
+import Wire.API.Routes.Named
 
-type FederationAPI = "federation" :> ToServantApi (FedApi 'Cargohold)
+type FederationAPI = "federation" :> FedApi 'Cargohold
 
 federationSitemap :: ServerT FederationAPI Handler
 federationSitemap =
-  genericServerT $
-    F.CargoholdApi
-      { F.getAsset = getAsset,
-        F.streamAsset = streamAsset
-      }
+  Named @"get-asset" getAsset
+    :<|> Named @"stream-asset" streamAsset
 
 checkAsset :: F.GetAsset -> Handler Bool
 checkAsset ga =
   fmap isJust . runMaybeT $
     checkMetadata Nothing (F.gaKey ga) (F.gaToken ga)
 
-streamAsset :: F.GetAsset -> Handler AssetSource
-streamAsset ga = do
+streamAsset :: Domain -> F.GetAsset -> Handler AssetSource
+streamAsset _ ga = do
   available <- checkAsset ga
   unless available (throwE assetNotFound)
   AssetSource <$> S3.downloadV3 (F.gaKey ga)
 
-getAsset :: F.GetAsset -> Handler F.GetAssetResponse
-getAsset = fmap F.GetAssetResponse . checkAsset
+getAsset :: Domain -> F.GetAsset -> Handler F.GetAssetResponse
+getAsset _ = fmap F.GetAssetResponse . checkAsset
diff --git a/services/cargohold/src/CargoHold/Federation.hs b/services/cargohold/src/CargoHold/Federation.hs
index 4a82ea2481b..abe73afe8e7 100644
--- a/services/cargohold/src/CargoHold/Federation.hs
+++ b/services/cargohold/src/CargoHold/Federation.hs
@@ -61,9 +61,15 @@ downloadRemoteAsset usr rkey tok = do
           }
   exists <-
     fmap gaAvailable . executeFederated rkey $
-      getAsset clientRoutes ga
+      fedClient @'Cargohold @"get-asset" ga
   if exists
-    then Just <$> executeFederatedStreaming rkey (toSourceIO <$> streamAsset clientRoutes ga)
+    then
+      Just
+        <$> executeFederatedStreaming
+          rkey
+          ( toSourceIO
+              <$> fedClient @'Cargohold @"stream-asset" ga
+          )
     else pure Nothing
 
 mkFederatorClientEnv :: Remote x -> Handler FederatorClientEnv
diff --git a/services/cargohold/test/integration/API/Federation.hs b/services/cargohold/test/integration/API/Federation.hs
index 6b94788a23d..bb22a7d5822 100644
--- a/services/cargohold/test/integration/API/Federation.hs
+++ b/services/cargohold/test/integration/API/Federation.hs
@@ -13,11 +13,11 @@ import Data.UUID.V4
 import Imports
 import qualified Network.HTTP.Types as HTTP
 import qualified Network.Wai.Utilities.Error as Wai
-import Servant.Client.Generic
 import Test.Tasty
 import Test.Tasty.HUnit
 import TestSetup
 import Wire.API.Asset
+import Wire.API.Federation.API
 import Wire.API.Federation.API.Cargohold
 import Wire.API.Routes.AssetBody
 
@@ -66,7 +66,7 @@ testGetAssetAvailable isPublicAsset = do
           }
   ok <-
     withFederationClient $
-      gaAvailable <$> runFederationClient (getAsset genericClient ga)
+      gaAvailable <$> runFederationClient (fedClientIn @'Cargohold @"get-asset" ga)
 
   -- check that asset is available
   liftIO $ ok @?= True
@@ -86,7 +86,7 @@ testGetAssetNotAvailable = do
           }
   ok <-
     withFederationClient $
-      gaAvailable <$> runFederationClient (getAsset genericClient ga)
+      gaAvailable <$> runFederationClient (fedClientIn @'Cargohold @"get-asset" ga)
 
   -- check that asset is not available
   liftIO $ ok @?= False
@@ -113,7 +113,7 @@ testGetAssetWrongToken = do
           }
   ok <-
     withFederationClient $
-      gaAvailable <$> runFederationClient (getAsset genericClient ga)
+      gaAvailable <$> runFederationClient (fedClientIn @'Cargohold @"get-asset" ga)
 
   -- check that asset is not available
   liftIO $ ok @?= False
@@ -144,7 +144,7 @@ testLargeAsset = do
             gaKey = qUnqualified key
           }
   chunks <- withFederationClient $ do
-    source <- getAssetSource <$> runFederationClient (streamAsset genericClient ga)
+    source <- getAssetSource <$> runFederationClient (fedClientIn @'Cargohold @"stream-asset" ga)
     liftIO . runResourceT $ connect source sinkList
   liftIO $ do
     let minNumChunks = 8
@@ -176,7 +176,7 @@ testStreamAsset = do
             gaKey = qUnqualified key
           }
   respBody <- withFederationClient $ do
-    source <- getAssetSource <$> runFederationClient (streamAsset genericClient ga)
+    source <- getAssetSource <$> runFederationClient (fedClientIn @'Cargohold @"stream-asset" ga)
     liftIO . runResourceT $ connect source sinkLazy
   liftIO $ respBody @?= "Hello World"
 
@@ -194,7 +194,7 @@ testStreamAssetNotAvailable = do
             gaKey = key
           }
   err <- withFederationError $ do
-    runFederationClient (streamAsset genericClient ga)
+    runFederationClient (fedClientIn @'Cargohold @"stream-asset" ga)
   liftIO $ do
     Wai.code err @?= HTTP.notFound404
     Wai.label err @?= "not-found"
@@ -220,7 +220,7 @@ testStreamAssetWrongToken = do
             gaKey = qUnqualified key
           }
   err <- withFederationError $ do
-    runFederationClient (streamAsset genericClient ga)
+    runFederationClient (fedClientIn @'Cargohold @"stream-asset" ga)
   liftIO $ do
     Wai.code err @?= HTTP.notFound404
     Wai.label err @?= "not-found"
diff --git a/services/cargohold/test/integration/TestSetup.hs b/services/cargohold/test/integration/TestSetup.hs
index c83933dce90..2f43e562a7e 100644
--- a/services/cargohold/test/integration/TestSetup.hs
+++ b/services/cargohold/test/integration/TestSetup.hs
@@ -40,6 +40,7 @@ import Control.Monad.Codensity
 import Control.Monad.Except
 import Control.Monad.Morph
 import qualified Data.Aeson as Aeson
+import Data.ByteString.Conversion
 import qualified Data.Text as T
 import Data.Text.Encoding
 import Data.Yaml
@@ -53,6 +54,7 @@ import Test.Tasty.HUnit
 import Util.Options
 import Util.Options.Common
 import Util.Test
+import Wire.API.Federation.Domain
 
 type Cargohold = Request -> Request
 
@@ -114,8 +116,19 @@ runFederationClient :: ClientM a -> ReaderT TestSetup (ExceptT ClientError (Code
 runFederationClient action = do
   man <- view tsManager
   Endpoint cHost cPort <- view tsEndpoint
+  domain <- view (tsOpts . optSettings . setFederationDomain)
   let base = BaseUrl Http (T.unpack cHost) (fromIntegral cPort) "/federation"
-  let env = mkClientEnv man base
+  let env =
+        (mkClientEnv man base)
+          { makeClientRequest = \burl req ->
+              let req' = defaultMakeClientRequest burl req
+               in req'
+                    { requestHeaders =
+                        (originDomainHeaderName, toByteString' domain) :
+                        requestHeaders req'
+                    }
+          }
+
   r <- lift . lift $
     Codensity $ \k ->
       -- Servant's streaming client throws exceptions in IO for some reason
diff --git a/services/federator/test/unit/Test/Federator/Client.hs b/services/federator/test/unit/Test/Federator/Client.hs
index 7a193de903d..3d70887271e 100644
--- a/services/federator/test/unit/Test/Federator/Client.hs
+++ b/services/federator/test/unit/Test/Federator/Client.hs
@@ -44,7 +44,6 @@ import Test.Tasty
 import Test.Tasty.HUnit
 import Util.Options
 import Wire.API.Federation.API
-import Wire.API.Federation.API.Brig
 import Wire.API.Federation.Client
 import Wire.API.Federation.Component
 import Wire.API.Federation.Error
@@ -110,7 +109,7 @@ testClientSuccess = do
     withMockFederatorClient
       defaultHeaders
       (const (pure ("application/json", Aeson.encode (Just expectedResponse))))
-      $ getUserByHandle clientRoutes handle
+      $ fedClient @'Brig @"get-user-by-handle" handle
 
   sentRequests
     @?= [ FederatedRequest
@@ -150,7 +149,7 @@ testClientFailure = do
       defaultHeaders
       (const (throw (MockErrorResponse HTTP.status422 "wrong domain")))
       $ do
-        getUserByHandle clientRoutes handle
+        fedClient @'Brig @"get-user-by-handle" handle
 
   case actualResponse of
     Right _ -> assertFailure "unexpected success"
@@ -167,7 +166,7 @@ testFederatorFailure = do
       defaultHeaders
       (const (throw (MockErrorResponse HTTP.status403 "invalid path")))
       $ do
-        getUserByHandle clientRoutes handle
+        fedClient @'Brig @"get-user-by-handle" handle
 
   case actualResponse of
     Right _ -> assertFailure "unexpected success"
@@ -181,7 +180,7 @@ testClientExceptions = do
 
   (response, _) <-
     withMockFederatorClient defaultHeaders (const (evaluate (error "unhandled exception"))) $
-      getUserByHandle clientRoutes handle
+      fedClient @'Brig @"get-user-by-handle" handle
 
   case response of
     Right _ -> assertFailure "unexpected success"
@@ -196,7 +195,7 @@ testClientConnectionError = do
             ceTargetDomain = targetDomain,
             ceFederator = Endpoint "127.0.0.1" 1
           }
-  result <- runFederatorClient env (getUserByHandle clientRoutes handle)
+  result <- runFederatorClient env (fedClient @'Brig @"get-user-by-handle" handle)
   case result of
     Left (FederatorClientHTTP2Error (FederatorClientConnectionError _)) -> pure ()
     Left x -> assertFailure $ "Expected connection error, got: " <> show x
diff --git a/services/galley/galley.cabal b/services/galley/galley.cabal
index 7a494100182..fdb053a4772 100644
--- a/services/galley/galley.cabal
+++ b/services/galley/galley.cabal
@@ -4,7 +4,7 @@ cabal-version: 1.12
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 5ca30f9e591f66b924afc6773c95ecd6284e794ced766eca4ebe37af49b4984a
+-- hash: d0f941574eb095a4662d0a6333d341636673f8bbb0d097daed4d4e277ad7f37d
 
 name:           galley
 version:        0.83.0
@@ -254,6 +254,7 @@ executable galley-integration
       API
       API.CustomBackend
       API.Federation
+      API.Federation.Util
       API.MessageTimer
       API.Roles
       API.SQS
@@ -305,8 +306,8 @@ executable galley-integration
     , http-client
     , http-client-openssl
     , http-client-tls
-    , http-types
     , http-media
+    , http-types
     , imports
     , lens
     , lens-aeson
diff --git a/services/galley/src/Galley/API/Action.hs b/services/galley/src/Galley/API/Action.hs
index 7a13e8396e1..4275f105d86 100644
--- a/services/galley/src/Galley/API/Action.hs
+++ b/services/galley/src/Galley/API/Action.hs
@@ -75,7 +75,7 @@ import Wire.API.Conversation.Role
 import Wire.API.ErrorDescription
 import Wire.API.Event.Conversation hiding (Conversation)
 import Wire.API.Federation.API
-import qualified Wire.API.Federation.API.Galley as F
+import Wire.API.Federation.API.Galley
 import Wire.API.Federation.Error
 import Wire.API.Team.LegalHold
 import Wire.API.Team.Member
@@ -526,8 +526,8 @@ notifyConversationAction quid con lcnv targets action = do
 
   -- notify remote participants
   E.runFederatedConcurrently_ (toList (bmRemotes targets)) $ \ruids ->
-    F.onConversationUpdated clientRoutes $
-      F.ConversationUpdate now quid (tUnqualified lcnv) (tUnqualified ruids) action
+    fedClient @'Galley @"on-conversation-updated" $
+      ConversationUpdate now quid (tUnqualified lcnv) (tUnqualified ruids) action
 
   -- notify local participants and bots
   pushConversationEvent con e (qualifyAs lcnv (bmLocals targets)) (bmBots targets) $> e
diff --git a/services/galley/src/Galley/API/Federation.hs b/services/galley/src/Galley/API/Federation.hs
index 1dbc5805967..87a36835cea 100644
--- a/services/galley/src/Galley/API/Federation.hs
+++ b/services/galley/src/Galley/API/Federation.hs
@@ -53,8 +53,6 @@ import Polysemy.Input
 import qualified Polysemy.TinyLog as P
 import Servant (ServerT)
 import Servant.API
-import Servant.API.Generic (ToServantApi)
-import Servant.Server.Generic (genericServerT)
 import qualified System.Logger.Class as Log
 import qualified Wire.API.Conversation as Public
 import Wire.API.Conversation.Action
@@ -65,23 +63,21 @@ import Wire.API.Federation.API
 import Wire.API.Federation.API.Common (EmptyResponse (..))
 import qualified Wire.API.Federation.API.Galley as F
 import Wire.API.Routes.Internal.Brig.Connection
+import Wire.API.Routes.Named
 import Wire.API.ServantProto
 import Wire.API.User.Client (userClientMap)
 
-type FederationAPI = "federation" :> ToServantApi (FedApi 'Galley)
+type FederationAPI = "federation" :> FedApi 'Galley
 
 federationSitemap :: ServerT FederationAPI (Sem GalleyEffects)
 federationSitemap =
-  genericServerT $
-    F.GalleyApi
-      { F.onConversationCreated = onConversationCreated,
-        F.getConversations = getConversations,
-        F.onConversationUpdated = onConversationUpdated,
-        F.leaveConversation = leaveConversation,
-        F.onMessageSent = onMessageSent,
-        F.sendMessage = sendMessage,
-        F.onUserDeleted = onUserDeleted
-      }
+  Named @"on-conversation-created" onConversationCreated
+    :<|> Named @"get-conversations" getConversations
+    :<|> Named @"on-conversation-updated" onConversationUpdated
+    :<|> Named @"leave-conversation" leaveConversation
+    :<|> Named @"on-message-sent" onMessageSent
+    :<|> Named @"send-message" sendMessage
+    :<|> Named @"on-user-deleted-conversations" onUserDeleted
 
 onConversationCreated ::
   Members '[BrigAccess, GundeckAccess, ExternalAccess, Input (Local ()), MemberStore, P.TinyLog] r =>
diff --git a/services/galley/src/Galley/API/Internal.hs b/services/galley/src/Galley/API/Internal.hs
index 85234b2efd8..34fca3d53c3 100644
--- a/services/galley/src/Galley/API/Internal.hs
+++ b/services/galley/src/Galley/API/Internal.hs
@@ -97,7 +97,7 @@ import Wire.API.Conversation (ConvIdsPage, pattern GetPaginatedConversationIds)
 import Wire.API.Conversation.Action (ConversationAction (ConversationActionRemoveMembers))
 import Wire.API.ErrorDescription
 import Wire.API.Federation.API
-import Wire.API.Federation.API.Galley hiding (getConversations)
+import Wire.API.Federation.API.Galley
 import Wire.API.Federation.Error
 import Wire.API.Routes.MultiTablePaging (mtpHasMore, mtpPagingState, mtpResults)
 import Wire.API.Routes.MultiVerb (MultiVerb, RespondEmpty)
@@ -627,7 +627,7 @@ rmUser lusr conn = do
                 cuAlreadyPresentUsers = tUnqualified remotes,
                 cuAction = ConversationActionRemoveMembers (pure qUser)
               }
-      let rpc = onConversationUpdated clientRoutes convUpdate
+      let rpc = fedClient @'Galley @"on-conversation-updated" convUpdate
       runFederatedEither remotes rpc
         >>= logAndIgnoreError "Error in onConversationUpdated call" (qUnqualified qUser)
 
@@ -635,7 +635,7 @@ rmUser lusr conn = do
     leaveRemoteConversations cids = do
       for_ (bucketRemote (fromRange cids)) $ \remoteConvs -> do
         let userDelete = UserDeletedConversationsNotification (tUnqualified lusr) (unsafeRange (tUnqualified remoteConvs))
-        let rpc = onUserDeleted clientRoutes userDelete
+        let rpc = fedClient @'Galley @"on-user-deleted-conversations" userDelete
         runFederatedEither remoteConvs rpc
           >>= logAndIgnoreError "Error in onUserDeleted call" (tUnqualified lusr)
 
diff --git a/services/galley/src/Galley/API/Message.hs b/services/galley/src/Galley/API/Message.hs
index d67099657ef..d17247040d7 100644
--- a/services/galley/src/Galley/API/Message.hs
+++ b/services/galley/src/Galley/API/Message.hs
@@ -192,7 +192,7 @@ getRemoteClients remoteMembers =
   where
     getRemoteClientsFromDomain (qUntagged -> Qualified uids domain) =
       Map.mapKeys (domain,) . fmap (Set.map pubClientId) . userMap
-        <$> getUserClients clientRoutes (GetUserClients uids)
+        <$> fedClient @'Brig @"get-user-clients" (GetUserClients uids)
 
 -- FUTUREWORK: sender should be Local UserId
 postRemoteOtrMessage ::
@@ -208,7 +208,7 @@ postRemoteOtrMessage sender conv rawMsg = do
             msrSender = qUnqualified sender,
             msrRawMessage = Base64ByteString rawMsg
           }
-      rpc = sendMessage clientRoutes msr
+      rpc = fedClient @'Galley @"send-message" msr
   msResponse <$> runFederated conv rpc
 
 postQualifiedOtrMessage ::
@@ -409,7 +409,7 @@ sendRemoteMessages domain now sender senderClient lcnv metadata messages = (hand
             rmTransient = mmTransient metadata,
             rmRecipients = UserClientMap rcpts
           }
-  let rpc = onMessageSent clientRoutes rm
+  let rpc = fedClient @'Galley @"on-message-sent" rm
   runFederatedEither domain rpc
   where
     handle :: Either FederationError a -> Sem r (Set (UserId, ClientId))
diff --git a/services/galley/src/Galley/API/Query.hs b/services/galley/src/Galley/API/Query.hs
index 736e401397e..451726ef0ad 100644
--- a/services/galley/src/Galley/API/Query.hs
+++ b/services/galley/src/Galley/API/Query.hs
@@ -77,8 +77,7 @@ import qualified Wire.API.Conversation as Public
 import qualified Wire.API.Conversation.Role as Public
 import Wire.API.ErrorDescription
 import Wire.API.Federation.API
-import Wire.API.Federation.API.Galley hiding (getConversations)
-import qualified Wire.API.Federation.API.Galley as F
+import Wire.API.Federation.API.Galley
 import Wire.API.Federation.Error
 import qualified Wire.API.Provider.Bot as Public
 import qualified Wire.API.Routes.MultiTablePaging as Public
@@ -226,7 +225,7 @@ getRemoteConversationsWithFailures lusr convs = do
         | otherwise = [failedGetConversationLocally (map qUntagged locallyNotFound)]
 
   -- request conversations from remote backends
-  let rpc = F.getConversations clientRoutes
+  let rpc = fedClient @'Galley @"get-conversations"
   resp <-
     E.runFederatedConcurrentlyEither locallyFound $ \someConvs ->
       rpc $ GetConversationsRequest (tUnqualified lusr) (tUnqualified someConvs)
diff --git a/services/galley/src/Galley/API/Update.hs b/services/galley/src/Galley/API/Update.hs
index aec91abde61..2969c49d438 100644
--- a/services/galley/src/Galley/API/Update.hs
+++ b/services/galley/src/Galley/API/Update.hs
@@ -1101,7 +1101,7 @@ removeMemberFromRemoteConv ::
 removeMemberFromRemoteConv cnv lusr victim
   | qUntagged lusr == victim = do
     let lc = LeaveConversationRequest (tUnqualified cnv) (qUnqualified victim)
-    let rpc = leaveConversation clientRoutes lc
+    let rpc = fedClient @'Galley @"leave-conversation" lc
     (either handleError handleSuccess =<<) . fmap leaveResponse $
       E.runFederated cnv rpc
   | otherwise = throw (ActionDenied RemoveConversationMember)
diff --git a/services/galley/src/Galley/API/Util.hs b/services/galley/src/Galley/API/Util.hs
index 607236545eb..cdc1bdbed69 100644
--- a/services/galley/src/Galley/API/Util.hs
+++ b/services/galley/src/Galley/API/Util.hs
@@ -735,7 +735,7 @@ registerRemoteConversationMemberships now localDomain c = do
   let allRemoteMembers = nubOrd (map rmId (Data.convRemoteMembers c))
       rc = toNewRemoteConversation now localDomain c
   runFederatedConcurrently_ allRemoteMembers $ \_ ->
-    onConversationCreated clientRoutes rc
+    fedClient @'Galley @"on-conversation-created" rc
 
 --------------------------------------------------------------------------------
 -- Legalhold
diff --git a/services/galley/test/integration/API.hs b/services/galley/test/integration/API.hs
index 5a29641a606..f1e16b0fbd3 100644
--- a/services/galley/test/integration/API.hs
+++ b/services/galley/test/integration/API.hs
@@ -25,6 +25,7 @@ where
 
 import qualified API.CustomBackend as CustomBackend
 import qualified API.Federation as Federation
+import API.Federation.Util
 import qualified API.MessageTimer as MessageTimer
 import qualified API.Roles as Roles
 import API.SQS
@@ -41,7 +42,6 @@ import Brig.Types
 import qualified Control.Concurrent.Async as Async
 import Control.Exception (throw)
 import Control.Lens (at, ix, preview, view, (.~), (?~))
-import Control.Monad.Except (MonadError (throwError))
 import Control.Monad.Trans.Maybe
 import Data.Aeson hiding (json)
 import qualified Data.ByteString as BS
@@ -55,11 +55,9 @@ import Data.List.NonEmpty (NonEmpty (..))
 import Data.List1
 import qualified Data.List1 as List1
 import qualified Data.Map.Strict as Map
-import Data.Proxy (Proxy (..))
 import Data.Qualified
 import Data.Range
 import qualified Data.Set as Set
-import Data.String.Conversions (cs)
 import qualified Data.Text as T
 import qualified Data.Text.Ascii as Ascii
 import Data.Time.Clock (getCurrentTime)
@@ -76,9 +74,7 @@ import Gundeck.Types.Notification
 import Imports
 import qualified Network.HTTP.Types as HTTP
 import Network.Wai.Utilities.Error
-import Servant (ServerError (errBody), err501, err503)
-import Servant.Server (Handler)
-import Servant.Server.Generic (AsServerT)
+import Servant hiding (respond)
 import Test.QuickCheck (arbitrary, generate)
 import Test.Tasty
 import Test.Tasty.Cannon (TimeoutUnit (..), (#))
@@ -95,6 +91,7 @@ import Wire.API.Federation.API.Galley
 import qualified Wire.API.Federation.API.Galley as F
 import qualified Wire.API.Message as Message
 import Wire.API.Routes.MultiTablePaging
+import Wire.API.Routes.Named
 import qualified Wire.API.Team.Feature as Public
 import Wire.API.User.Client
 import Wire.API.UserMap (UserMap (..))
@@ -232,36 +229,6 @@ tests s =
           test s "post message - client that is not in group doesn't receive message" postMessageClientNotInGroupDoesNotReceiveMsg
         ]
 
-emptyFederatedBrig :: F.BrigApi (AsServerT Handler)
-emptyFederatedBrig =
-  let e :: Text -> Handler a
-      e s = throwError err501 {errBody = cs ("mock not implemented: " <> s)}
-   in F.BrigApi
-        { F.getUserByHandle = \_ -> e "getUserByHandle",
-          F.getUsersByIds = \_ -> e "getUsersByIds",
-          F.claimPrekey = \_ -> e "claimPrekey",
-          F.claimPrekeyBundle = \_ -> e "claimPrekeyBundle",
-          F.claimMultiPrekeyBundle = \_ -> e "claimMultiPrekeyBundle",
-          F.searchUsers = \_ -> e "searchUsers",
-          F.getUserClients = \_ -> e "getUserClients",
-          F.sendConnectionAction = \_ _ -> e "sendConnectionAction",
-          F.onUserDeleted = \_ _ -> e "onUserDeleted"
-        }
-
-emptyFederatedGalley :: F.GalleyApi (AsServerT Handler)
-emptyFederatedGalley =
-  let e :: Text -> Handler a
-      e s = throwError err501 {errBody = cs ("mock not implemented: " <> s)}
-   in F.GalleyApi
-        { F.onConversationCreated = \_ _ -> e "onConversationCreated",
-          F.getConversations = \_ _ -> e "getConversations",
-          F.onConversationUpdated = \_ _ -> e "onConversationUpdated",
-          F.leaveConversation = \_ _ -> e "leaveConversation",
-          F.onMessageSent = \_ _ -> e "onMessageSent",
-          F.sendMessage = \_ _ -> e "sendMessage",
-          F.onUserDeleted = \_ _ -> e "onUserDeleted"
-        }
-
 -------------------------------------------------------------------------------
 -- API Tests
 
@@ -705,22 +672,20 @@ postMessageQualifiedLocalOwningBackendSuccess = do
 
     let mkPubClient c = PubClient c Nothing
         brigApi d =
-          emptyFederatedBrig
-            { F.getUserClients = \_ ->
-                pure $
-                  if
-                      | d == bDomain ->
-                        UserMap . Map.fromList $
-                          [ (qUnqualified bob, Set.singleton (mkPubClient bobClient)),
-                            (qUnqualified bart, Set.fromList (map mkPubClient [bartClient1, bartClient2]))
-                          ]
-                      | d == cDomain -> UserMap (Map.singleton (qUnqualified carl) (Set.singleton (PubClient carlClient Nothing)))
-                      | otherwise -> mempty
-            }
+          mkHandler @(FedApi 'Brig) $
+            Named @"get-user-clients" $ \_ _ ->
+              pure $
+                if
+                    | d == bDomain ->
+                      UserMap . Map.fromList $
+                        [ (qUnqualified bob, Set.singleton (mkPubClient bobClient)),
+                          (qUnqualified bart, Set.fromList (map mkPubClient [bartClient1, bartClient2]))
+                        ]
+                    | d == cDomain -> UserMap (Map.singleton (qUnqualified carl) (Set.singleton (PubClient carlClient Nothing)))
+                    | otherwise -> mempty
+
         galleyApi _ =
-          emptyFederatedGalley
-            { F.onMessageSent = \_ _ -> pure ()
-            }
+          mkHandler @(FedApi 'Galley) $ Named @"on-message-sent" $ \_ _ -> pure ()
 
     (resp2, requests) <- postProteusMessageQualifiedWithMockFederator aliceU aliceClient convId message "data" Message.MismatchReportAll brigApi galleyApi
     pure resp2 !!! do
@@ -825,11 +790,10 @@ postMessageQualifiedLocalOwningBackendMissingClients = do
   -- FUTUREWORK: Mock federator and ensure that message is not propagated to remotes
   WS.bracketR2 cannon bobUnqualified chadUnqualified $ \(wsBob, wsChad) -> do
     let brigApi _ =
-          emptyFederatedBrig
-            { F.getUserClients = \_ ->
-                pure $ UserMap (Map.singleton (qUnqualified deeRemote) (Set.singleton (PubClient deeClient Nothing)))
-            }
-        galleyApi _ = emptyFederatedGalley
+          mkHandler @(FedApi 'Brig) $
+            Named @"get-user-clients" $ \_ _ ->
+              pure $ UserMap (Map.singleton (qUnqualified deeRemote) (Set.singleton (PubClient deeClient Nothing)))
+        galleyApi _ = mkHandler @(FedApi 'Galley) EmptyAPI
 
     (resp2, _requests) <- postProteusMessageQualifiedWithMockFederator aliceUnqualified aliceClient convId message "data" Message.MismatchReportAll brigApi galleyApi
 
@@ -904,18 +868,16 @@ postMessageQualifiedLocalOwningBackendRedundantAndDeletedClients = do
 
     -- FUTUREWORK: Mock federator and ensure that a message to Dee is sent
     let brigApi _ =
-          emptyFederatedBrig
-            { F.getUserClients = \getUserClients ->
-                let lookupClients uid
-                      | uid == deeRemoteUnqualified = Just (uid, Set.fromList [PubClient deeClient Nothing])
-                      | uid == nonMemberRemoteUnqualified = Just (uid, Set.fromList [PubClient nonMemberRemoteClient Nothing])
-                      | otherwise = Nothing
-                 in pure $ UserMap . Map.fromList . mapMaybe lookupClients $ F.gucUsers getUserClients
-            }
+          mkHandler @(FedApi 'Brig) $
+            Named @"get-user-clients" $ \_ getUserClients ->
+              let lookupClients uid
+                    | uid == deeRemoteUnqualified = Just (uid, Set.fromList [PubClient deeClient Nothing])
+                    | uid == nonMemberRemoteUnqualified = Just (uid, Set.fromList [PubClient nonMemberRemoteClient Nothing])
+                    | otherwise = Nothing
+               in pure $ UserMap . Map.fromList . mapMaybe lookupClients $ F.gucUsers getUserClients
         galleyApi _ =
-          emptyFederatedGalley
-            { F.onMessageSent = \_ _ -> pure ()
-            }
+          mkHandler @(FedApi 'Galley) $
+            Named @"on-message-sent" $ \_ _ -> pure ()
 
     (resp2, _requests) <- postProteusMessageQualifiedWithMockFederator aliceUnqualified aliceClient convId message "data" Message.MismatchReportAll brigApi galleyApi
     pure resp2 !!! do
@@ -985,10 +947,10 @@ postMessageQualifiedLocalOwningBackendIgnoreMissingClients = do
   let convId = (`Qualified` owningDomain) . decodeConvId $ resp
 
   let brigApi _ =
-        emptyFederatedBrig
-          { F.getUserClients = \_ -> pure $ UserMap (Map.singleton (qUnqualified deeRemote) (Set.singleton (PubClient deeClient Nothing)))
-          }
-      galleyApi _ = emptyFederatedGalley
+        mkHandler @(FedApi 'Brig) $
+          Named @"get-user-clients" $ \_ _ ->
+            pure $ UserMap (Map.singleton (qUnqualified deeRemote) (Set.singleton (PubClient deeClient Nothing)))
+      galleyApi _ = mkHandler @(FedApi 'Galley) EmptyAPI
 
   -- Missing Bob, chadClient2 and Dee
   let message = [(chadOwningDomain, chadClient, "text-for-chad")]
@@ -1120,14 +1082,13 @@ postMessageQualifiedLocalOwningBackendFailedToSendClients = do
           ]
 
     let brigApi _ =
-          emptyFederatedBrig
-            { F.getUserClients = \_ ->
-                pure $ UserMap (Map.singleton (qUnqualified deeRemote) (Set.singleton (PubClient deeClient Nothing)))
-            }
+          mkHandler @(FedApi 'Brig) $
+            Named @"get-user-clients" $ \_ _ ->
+              pure $ UserMap (Map.singleton (qUnqualified deeRemote) (Set.singleton (PubClient deeClient Nothing)))
         galleyApi _ =
-          emptyFederatedGalley
-            { F.onMessageSent = \_ _ -> throwError err503 {errBody = "Down for maintenance."}
-            }
+          mkHandler @(FedApi 'Galley) $
+            Named @"on-message-sent" $ \_ _ ->
+              throwError err503 {errBody = "Down for maintenance."}
 
     (resp2, _requests) <- postProteusMessageQualifiedWithMockFederator aliceUnqualified aliceClient convId message "data" Message.MismatchReportAll brigApi galleyApi
 
@@ -1158,13 +1119,14 @@ postMessageQualifiedRemoteOwningBackendFailure = do
   let remoteDomain = Domain "far-away.example.com"
       convId = Qualified convIdUnqualified remoteDomain
 
+  let brigApi _ = mkHandler @(FedApi 'Brig) EmptyAPI
   let galleyApi _ =
-        emptyFederatedGalley
-          { F.sendMessage = \_ _ -> throwError err503 {errBody = "Down for maintenance."}
-          }
+        mkHandler @(FedApi 'Galley) $
+          Named @"send-message" $ \_ _ ->
+            throwError err503 {errBody = "Down for maintenance."}
 
   (resp2, _requests) <-
-    postProteusMessageQualifiedWithMockFederator aliceUnqualified aliceClient convId [] "data" Message.MismatchReportAll (const emptyFederatedBrig) galleyApi
+    postProteusMessageQualifiedWithMockFederator aliceUnqualified aliceClient convId [] "data" Message.MismatchReportAll brigApi galleyApi
 
   pure resp2 !!! do
     const 503 === statusCode
@@ -1198,13 +1160,13 @@ postMessageQualifiedRemoteOwningBackendSuccess = do
             Message.mssFailedToSend = mempty
           }
       message = [(bobOwningDomain, bobClient, "text-for-bob"), (deeRemote, deeClient, "text-for-dee")]
-      galleyApi _ =
-        emptyFederatedGalley
-          { F.sendMessage = \_ _ -> pure (F.MessageSendResponse (Right mss))
-          }
+      brigApi _ = mkHandler @(FedApi 'Brig) EmptyAPI
+      galleyApi _ = mkHandler @(FedApi 'Galley) $
+        Named @"send-message" $ \_ _ ->
+          pure (F.MessageSendResponse (Right mss))
 
   (resp2, _requests) <-
-    postProteusMessageQualifiedWithMockFederator aliceUnqualified aliceClient convId message "data" Message.MismatchReportAll (const emptyFederatedBrig) galleyApi
+    postProteusMessageQualifiedWithMockFederator aliceUnqualified aliceClient convId message "data" Message.MismatchReportAll brigApi galleyApi
 
   pure resp2 !!! do
     const 201 === statusCode
@@ -1665,7 +1627,7 @@ paginateConvListIds = do
               F.cuAlreadyPresentUsers = [],
               F.cuAction = ConversationActionAddMembers (pure qAlice) roleNameWireMember
             }
-    F.onConversationUpdated (fedGalleyClient chadDomain) cu
+    runFedClient @"on-conversation-updated" fedGalleyClient chadDomain cu
 
   remoteDee <- randomId
   let deeDomain = Domain "dee.example.com"
@@ -1681,7 +1643,7 @@ paginateConvListIds = do
               F.cuAlreadyPresentUsers = [],
               F.cuAction = ConversationActionAddMembers (pure qAlice) roleNameWireMember
             }
-    F.onConversationUpdated (fedGalleyClient deeDomain) cu
+    runFedClient @"on-conversation-updated" fedGalleyClient deeDomain cu
 
   -- 1 self conv + 2 convs with bob and eve + 197 local convs + 25 convs on
   -- chad.example.com + 31 on dee.example = 256 convs. Getting them 16 at a time
@@ -1726,7 +1688,7 @@ paginateConvListIdsPageEndingAtLocalsAndDomain = do
               F.cuAlreadyPresentUsers = [],
               F.cuAction = ConversationActionAddMembers (pure qAlice) roleNameWireMember
             }
-    F.onConversationUpdated (fedGalleyClient chadDomain) cu
+    runFedClient @"on-conversation-updated" fedGalleyClient chadDomain cu
 
   remoteDee <- randomId
   let deeDomain = Domain "dee.example.com"
@@ -1744,7 +1706,7 @@ paginateConvListIdsPageEndingAtLocalsAndDomain = do
               F.cuAlreadyPresentUsers = [],
               F.cuAction = ConversationActionAddMembers (pure qAlice) roleNameWireMember
             }
-    F.onConversationUpdated (fedGalleyClient deeDomain) cu
+    runFedClient @"on-conversation-updated" fedGalleyClient deeDomain cu
 
   foldM_ (getChunkedConvs 16 0 alice) Nothing [4, 3, 2, 1, 0 :: Int]
 
@@ -2224,11 +2186,8 @@ testDeleteTeamConversationWithRemoteMembers = do
 
   connectWithRemoteUser alice remoteBob
 
-  let brigApi _ = emptyFederatedBrig
-      galleyApi _ =
-        emptyFederatedGalley
-          { onConversationUpdated = \_domain _update -> pure ()
-          }
+  let brigApi _ = mkHandler @(FedApi 'Brig) EmptyAPI
+      galleyApi _ = mkHandler @(FedApi 'Galley) $ Named @"on-conversation-updated" $ \_ _ -> pure ()
 
   (_, received) <- withTempServantMockFederator brigApi galleyApi localDomain $ do
     postQualifiedMembers alice (remoteBob :| []) convId
@@ -3196,7 +3155,7 @@ putRemoteConvMemberOk update = do
             cuAction =
               ConversationActionAddMembers (pure qalice) roleNameWireMember
           }
-  F.onConversationUpdated (fedGalleyClient remoteDomain) cu
+  runFedClient @"on-conversation-updated" fedGalleyClient remoteDomain cu
 
   -- Expected member state
   let memberAlice =
@@ -3459,10 +3418,10 @@ removeUser = do
             F.rcMessageTimer = Nothing,
             F.rcReceiptMode = Nothing
           }
-  F.onConversationCreated (fedGalleyClient bDomain) $ nc convB1 bart [alice, alexDel]
-  F.onConversationCreated (fedGalleyClient bDomain) $ nc convB2 bart [alexDel]
-  F.onConversationCreated (fedGalleyClient cDomain) $ nc convC1 carl [alexDel]
-  F.onConversationCreated (fedGalleyClient dDomain) $ nc convD1 dory [alexDel]
+  runFedClient @"on-conversation-created" fedGalleyClient bDomain $ nc convB1 bart [alice, alexDel]
+  runFedClient @"on-conversation-created" fedGalleyClient bDomain $ nc convB2 bart [alexDel]
+  runFedClient @"on-conversation-created" fedGalleyClient cDomain $ nc convC1 carl [alexDel]
+  runFedClient @"on-conversation-created" fedGalleyClient dDomain $ nc convD1 dory [alexDel]
 
   WS.bracketR3 c alice' alexDel' amy' $ \(wsAlice, wsAlexDel, wsAmy) -> do
     let handler :: FederatedRequest -> IO LByteString
@@ -3592,8 +3551,7 @@ testOne2OneConversationRequest shouldBeLocal actor desired = do
         RemoteActor -> do
           fedGalleyClient <- view tsFedGalleyClient
           GetConversationsResponse convs <-
-            F.getConversations
-              (fedGalleyClient (tDomain bob))
+            runFedClient @"get-conversations" fedGalleyClient (tDomain bob) $
               F.GetConversationsRequest
                 { F.gcrUserId = tUnqualified bob,
                   F.gcrConvIds = [qUnqualified convId]
diff --git a/services/galley/test/integration/API/Federation.hs b/services/galley/test/integration/API/Federation.hs
index 6dd267d9b8d..adbfafd507f 100644
--- a/services/galley/test/integration/API/Federation.hs
+++ b/services/galley/test/integration/API/Federation.hs
@@ -133,12 +133,10 @@ getConversationsAllFound = do
   fedGalleyClient <- view tsFedGalleyClient
 
   GetConversationsResponse convs <-
-    FedGalley.getConversations
-      (fedGalleyClient (qDomain aliceQ))
-      ( GetConversationsRequest
-          (qUnqualified aliceQ)
-          (map qUnqualified [cnv1Id, cnvQualifiedId cnv2])
-      )
+    runFedClient @"get-conversations" fedGalleyClient (qDomain aliceQ) $
+      GetConversationsRequest
+        (qUnqualified aliceQ)
+        (map qUnqualified [cnv1Id, cnvQualifiedId cnv2])
 
   let c2 = find ((== qUnqualified (cnvQualifiedId cnv2)) . rcnvId) convs
 
@@ -171,9 +169,8 @@ getConversationsNotPartOf = do
   localDomain <- viewFederationDomain
   rando <- Id <$> liftIO nextRandom
   GetConversationsResponse convs <-
-    FedGalley.getConversations
-      (fedGalleyClient localDomain)
-      (GetConversationsRequest rando [qUnqualified . cnvQualifiedId $ cnv1])
+    runFedClient @"get-conversations" fedGalleyClient localDomain $
+      GetConversationsRequest rando [qUnqualified . cnvQualifiedId $ cnv1]
   liftIO $ assertEqual "conversation list not empty" [] convs
 
 onConvCreated :: TestM ()
@@ -235,7 +232,7 @@ addLocalUser = do
               ConversationActionAddMembers (qalice :| [qdee]) roleNameWireMember
           }
   WS.bracketRN c [alice, charlie, dee] $ \[wsA, wsC, wsD] -> do
-    FedGalley.onConversationUpdated (fedGalleyClient remoteDomain) cu
+    runFedClient @"on-conversation-updated" fedGalleyClient remoteDomain cu
     liftIO $ do
       WS.assertMatch_ (5 # Second) wsA $
         wsAssertMemberJoinWithRole qconv qbob [qalice] roleNameWireMember
@@ -289,7 +286,7 @@ addUnconnectedUsersOnly = do
                 ConversationActionAddMembers (qCharlie :| []) roleNameWireMember
             }
     -- Alice receives no notifications from this
-    FedGalley.onConversationUpdated (fedGalleyClient remoteDomain) cu
+    runFedClient @"on-conversation-updated" fedGalleyClient remoteDomain cu
     WS.assertNoEvent (5 # Second) [wsA]
 
 -- | This test invokes the federation endpoint:
@@ -334,9 +331,9 @@ removeLocalUser = do
 
   connectWithRemoteUser alice qBob
   WS.bracketR c alice $ \ws -> do
-    FedGalley.onConversationUpdated (fedGalleyClient remoteDomain) cuAdd
+    runFedClient @"on-conversation-updated" fedGalleyClient remoteDomain cuAdd
     afterAddition <- listRemoteConvs remoteDomain alice
-    FedGalley.onConversationUpdated (fedGalleyClient remoteDomain) cuRemove
+    runFedClient @"on-conversation-updated" fedGalleyClient remoteDomain cuRemove
     liftIO $ do
       void . WS.assertMatch (3 # Second) ws $
         wsAssertMemberJoinWithRole qconv qBob [qAlice] roleNameWireMember
@@ -397,21 +394,21 @@ removeRemoteUser = do
           }
 
   WS.bracketRN c [alice, charlie, dee, flo] $ \[wsA, wsC, wsD, wsF] -> do
-    FedGalley.onConversationUpdated (fedGalleyClient remoteDomain) (cuRemove qEve)
+    runFedClient @"on-conversation-updated" fedGalleyClient remoteDomain (cuRemove qEve)
     liftIO $ do
       WS.assertMatchN_ (3 # Second) [wsA, wsD] $
         wsAssertMembersLeave qconv qBob [qEve]
       WS.assertNoEvent (1 # Second) [wsC, wsF]
 
   WS.bracketRN c [alice, charlie, dee, flo] $ \[wsA, wsC, wsD, wsF] -> do
-    FedGalley.onConversationUpdated (fedGalleyClient remoteDomain) (cuRemove qDee)
+    runFedClient @"on-conversation-updated" fedGalleyClient remoteDomain (cuRemove qDee)
     liftIO $ do
       WS.assertMatchN_ (3 # Second) [wsA, wsD] $
         wsAssertMembersLeave qconv qBob [qDee]
       WS.assertNoEvent (1 # Second) [wsC, wsF]
 
   WS.bracketRN c [alice, charlie, dee, flo] $ \[wsA, wsC, wsD, wsF] -> do
-    FedGalley.onConversationUpdated (fedGalleyClient remoteDomain) (cuRemove qFlo)
+    runFedClient @"on-conversation-updated" fedGalleyClient remoteDomain (cuRemove qFlo)
     liftIO $ do
       WS.assertMatchN_ (3 # Second) [wsA] $
         wsAssertMembersLeave qconv qBob [qFlo]
@@ -448,7 +445,7 @@ notifyUpdate extras action etype edata = do
             FedGalley.cuAction = action
           }
   WS.bracketR2 c alice charlie $ \(wsA, wsC) -> do
-    FedGalley.onConversationUpdated (fedGalleyClient bdom) cu
+    runFedClient @"on-conversation-updated" fedGalleyClient bdom cu
     liftIO $ do
       WS.assertMatch_ (5 # Second) wsA $ \n -> do
         let e = List1.head (WS.unpackPayload n)
@@ -548,7 +545,7 @@ notifyDeletedConversation = do
               FedGalley.cuAlreadyPresentUsers = [alice],
               FedGalley.cuAction = ConversationActionDelete
             }
-    FedGalley.onConversationUpdated (fedGalleyClient bobDomain) cu
+    runFedClient @"on-conversation-updated" fedGalleyClient bobDomain cu
 
     liftIO $ do
       WS.assertMatch_ (5 # Second) wsAlice $ \n -> do
@@ -606,7 +603,7 @@ addRemoteUser = do
               ConversationActionAddMembers (qdee :| [qeve, qflo]) roleNameWireMember
           }
   WS.bracketRN c (map qUnqualified [qalice, qcharlie, qdee, qflo]) $ \[wsA, wsC, wsD, wsF] -> do
-    FedGalley.onConversationUpdated (fedGalleyClient bdom) cu
+    runFedClient @"on-conversation-updated" fedGalleyClient bdom cu
     void . liftIO $ do
       WS.assertMatchN_ (5 # Second) [wsA, wsD] $
         wsAssertMemberJoinWithRole qconv qbob [qeve, qdee] roleNameWireMember
@@ -754,7 +751,7 @@ onMessageSent = do
             FedGalley.cuAction =
               ConversationActionAddMembers (pure qalice) roleNameWireMember
           }
-  FedGalley.onConversationUpdated (fedGalleyClient bdom) cu
+  runFedClient @"on-conversation-updated" fedGalleyClient bdom cu
 
   let txt = "Hello from another backend"
       msg client = Map.fromList [(client, txt)]
@@ -776,7 +773,7 @@ onMessageSent = do
 
   -- send message to alice and check reception
   WS.bracketAsClientRN c [(alice, aliceC1), (alice, aliceC2), (eve, eveC)] $ \[wsA1, wsA2, wsE] -> do
-    FedGalley.onMessageSent (fedGalleyClient bdom) rm
+    runFedClient @"on-message-sent" fedGalleyClient bdom rm
     liftIO $ do
       -- alice should receive the message on her first client
       WS.assertMatch_ (5 # Second) wsA1 $ \n -> do
diff --git a/services/galley/test/integration/API/Federation/Util.hs b/services/galley/test/integration/API/Federation/Util.hs
new file mode 100644
index 00000000000..9f5d70c77de
--- /dev/null
+++ b/services/galley/test/integration/API/Federation/Util.hs
@@ -0,0 +1,91 @@
+-- This file is part of the Wire Server implementation.
+--
+-- Copyright (C) 2022 Wire Swiss GmbH <opensource@wire.com>
+--
+-- This program is free software: you can redistribute it and/or modify it under
+-- the terms of the GNU Affero General Public License as published by the Free
+-- Software Foundation, either version 3 of the License, or (at your option) any
+-- later version.
+--
+-- This program is distributed in the hope that it will be useful, but WITHOUT
+-- ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+-- FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+-- details.
+--
+-- You should have received a copy of the GNU Affero General Public License along
+-- with this program. If not, see <https://www.gnu.org/licenses/>.
+
+module API.Federation.Util (mkHandler) where
+
+import Data.SOP
+import Data.String.Conversions (cs)
+import GHC.TypeLits
+import Imports
+import Servant
+import Wire.API.Federation.Domain
+import Wire.API.Routes.Named
+
+class HasTrivialHandler api where
+  trivialHandler :: String -> Server api
+
+instance HasTrivialHandler (Verb m c cs a) where
+  trivialHandler name = throwError err501 {errBody = cs ("mock not implemented: " <> name)}
+
+instance HasTrivialHandler api => HasTrivialHandler ((path :: Symbol) :> api) where
+  trivialHandler = trivialHandler @api
+
+instance HasTrivialHandler api => HasTrivialHandler (OriginDomainHeader :> api) where
+  trivialHandler name _ = trivialHandler @api name
+
+instance HasTrivialHandler api => HasTrivialHandler (ReqBody cs a :> api) where
+  trivialHandler name _ = trivialHandler @api name
+
+trivialNamedHandler ::
+  forall (name :: Symbol) api.
+  (KnownSymbol name, HasTrivialHandler api) =>
+  Server (Named name api)
+trivialNamedHandler = Named (trivialHandler @api (symbolVal (Proxy @name)))
+
+-- | Generate a servant handler from an incomplete list of handlers of named
+-- endpoints.
+class PartialAPI (api :: *) (hs :: *) where
+  mkHandler :: hs -> Server api
+
+instance
+  (KnownSymbol name, HasTrivialHandler endpoint) =>
+  PartialAPI (Named (name :: Symbol) endpoint) EmptyAPI
+  where
+  mkHandler _ = trivialNamedHandler @name @endpoint
+
+instance
+  {-# OVERLAPPING #-}
+  (KnownSymbol name, HasTrivialHandler endpoint, PartialAPI api EmptyAPI) =>
+  PartialAPI (Named (name :: Symbol) endpoint :<|> api) EmptyAPI
+  where
+  mkHandler h = trivialNamedHandler @name @endpoint :<|> mkHandler @api h
+
+instance
+  {-# OVERLAPPING #-}
+  (h ~ Server endpoint, PartialAPI api hs) =>
+  PartialAPI (Named (name :: Symbol) endpoint :<|> api) (Named name h :<|> hs)
+  where
+  mkHandler (h :<|> hs) = h :<|> mkHandler @api hs
+
+instance
+  (KnownSymbol name, HasTrivialHandler endpoint, PartialAPI api hs) =>
+  PartialAPI (Named (name :: Symbol) endpoint :<|> api) hs
+  where
+  mkHandler hs = trivialNamedHandler @name @endpoint :<|> mkHandler @api hs
+
+instance
+  (h ~ Server endpoint) =>
+  PartialAPI (Named (name :: Symbol) endpoint) (Named name h)
+  where
+  mkHandler = id
+
+instance
+  {-# OVERLAPPING #-}
+  (h ~ Server endpoint, PartialAPI api EmptyAPI) =>
+  PartialAPI (Named (name :: Symbol) endpoint :<|> api) (Named name h)
+  where
+  mkHandler h = h :<|> mkHandler @api EmptyAPI
diff --git a/services/galley/test/integration/API/Util.hs b/services/galley/test/integration/API/Util.hs
index fe1f0ddbfaa..5ceee3a5303 100644
--- a/services/galley/test/integration/API/Util.hs
+++ b/services/galley/test/integration/API/Util.hs
@@ -98,8 +98,6 @@ import Network.Wai (Application, defaultRequest)
 import qualified Network.Wai as Wai
 import qualified Network.Wai.Test as Wai
 import Servant (Handler, HasServer, Server, ServerT, serve, (:<|>) (..))
-import Servant.API.Generic (ToServantApi)
-import Servant.Server.Generic (AsServerT, genericServerT)
 import System.Random
 import qualified Test.QuickCheck as Q
 import Test.Tasty.Cannon (TimeoutUnit (..), (#))
@@ -115,9 +113,8 @@ import qualified Wire.API.Conversation as Public
 import Wire.API.Conversation.Action
 import Wire.API.Event.Conversation (_EdConversation, _EdMembersJoin, _EdMembersLeave)
 import qualified Wire.API.Event.Team as TE
-import qualified Wire.API.Federation.API.Brig as FederatedBrig
-import qualified Wire.API.Federation.API.Galley as FederatedGalley
-import Wire.API.Federation.Component
+import Wire.API.Federation.API
+import Wire.API.Federation.API.Galley
 import Wire.API.Federation.Domain (originDomainHeaderName)
 import Wire.API.Message
 import qualified Wire.API.Message.Proto as Proto
@@ -689,8 +686,8 @@ postProteusMessageQualifiedWithMockFederator ::
   [(Qualified UserId, ClientId, ByteString)] ->
   ByteString ->
   ClientMismatchStrategy ->
-  (Domain -> FederatedBrig.BrigApi (AsServerT Handler)) ->
-  (Domain -> FederatedGalley.GalleyApi (AsServerT Handler)) ->
+  (Domain -> ServerT (FedApi 'Brig) Handler) ->
+  (Domain -> ServerT (FedApi 'Galley) Handler) ->
   TestM (ResponseLBS, [FederatedRequest])
 postProteusMessageQualifiedWithMockFederator senderUser senderClient convId recipients dat strat brigApi galleyApi = do
   localDomain <- viewFederationDomain
@@ -1251,21 +1248,19 @@ registerRemoteConv :: Qualified ConvId -> UserId -> Maybe Text -> Set OtherMembe
 registerRemoteConv convId originUser name othMembers = do
   fedGalleyClient <- view tsFedGalleyClient
   now <- liftIO getCurrentTime
-  FederatedGalley.onConversationCreated
-    (fedGalleyClient (qDomain convId))
-    ( FederatedGalley.NewRemoteConversation
-        { FederatedGalley.rcTime = now,
-          FederatedGalley.rcOrigUserId = originUser,
-          FederatedGalley.rcCnvId = qUnqualified convId,
-          FederatedGalley.rcCnvType = RegularConv,
-          FederatedGalley.rcCnvAccess = [],
-          FederatedGalley.rcCnvAccessRole = ActivatedAccessRole,
-          FederatedGalley.rcCnvName = name,
-          FederatedGalley.rcNonCreatorMembers = othMembers,
-          FederatedGalley.rcMessageTimer = Nothing,
-          FederatedGalley.rcReceiptMode = Nothing
-        }
-    )
+  runFedClient @"on-conversation-created" fedGalleyClient (qDomain convId) $
+    NewRemoteConversation
+      { rcTime = now,
+        rcOrigUserId = originUser,
+        rcCnvId = qUnqualified convId,
+        rcCnvType = RegularConv,
+        rcCnvAccess = [],
+        rcCnvAccessRole = ActivatedAccessRole,
+        rcCnvName = name,
+        rcNonCreatorMembers = othMembers,
+        rcMessageTimer = Nothing,
+        rcReceiptMode = Nothing
+      }
 
 -------------------------------------------------------------------------------
 -- Common Assertions
@@ -1508,10 +1503,10 @@ assertRemoveUpdate req qconvId remover alreadyPresentUsers victim = liftIO $ do
   frRPC req @?= "on-conversation-updated"
   frOriginDomain req @?= qDomain qconvId
   let Just cu = decode (frBody req)
-  FederatedGalley.cuOrigUserId cu @?= remover
-  FederatedGalley.cuConvId cu @?= qUnqualified qconvId
-  sort (FederatedGalley.cuAlreadyPresentUsers cu) @?= sort alreadyPresentUsers
-  FederatedGalley.cuAction cu @?= ConversationActionRemoveMembers (pure victim)
+  cuOrigUserId cu @?= remover
+  cuConvId cu @?= qUnqualified qconvId
+  sort (cuAlreadyPresentUsers cu) @?= sort alreadyPresentUsers
+  cuAction cu @?= ConversationActionRemoveMembers (pure victim)
 
 -------------------------------------------------------------------------------
 -- Helpers
@@ -2044,9 +2039,9 @@ mkConv ::
   UserId ->
   RoleName ->
   [OtherMember] ->
-  FederatedGalley.RemoteConversation
+  RemoteConversation
 mkConv cnvId creator selfRole otherMembers =
-  FederatedGalley.RemoteConversation
+  RemoteConversation
     cnvId
     ( ConversationMetadata
         RegularConv
@@ -2058,7 +2053,7 @@ mkConv cnvId creator selfRole otherMembers =
         Nothing
         Nothing
     )
-    (FederatedGalley.RemoteConvMembers selfRole otherMembers)
+    (RemoteConvMembers selfRole otherMembers)
 
 -- | ES is only refreshed occasionally; we don't want to wait for that in tests.
 refreshIndex :: TestM ()
@@ -2254,8 +2249,8 @@ withTempMockFederator' resp action = do
 -- Start a mock federator. Use proveded Servant handler for the mocking mocking function.
 withTempServantMockFederator ::
   (MonadMask m, MonadIO m, HasGalley m) =>
-  (Domain -> FederatedBrig.BrigApi (AsServerT Handler)) ->
-  (Domain -> FederatedGalley.GalleyApi (AsServerT Handler)) ->
+  (Domain -> ServerT (FedApi 'Brig) Handler) ->
+  (Domain -> ServerT (FedApi 'Galley) Handler) ->
   Domain ->
   SessionT m b ->
   m (b, [FederatedRequest])
@@ -2263,13 +2258,13 @@ withTempServantMockFederator brigApi galleyApi originDomain =
   withTempMockFederator' mock
   where
     server :: Domain -> ServerT CombinedBrigAndGalleyAPI Handler
-    server d = genericServerT (brigApi d) :<|> genericServerT (galleyApi d)
+    server d = brigApi d :<|> galleyApi d
 
     mock :: FederatedRequest -> IO LByteString
     mock req =
       makeFedRequestToServant @CombinedBrigAndGalleyAPI originDomain (server (frTargetDomain req)) req
 
-type CombinedBrigAndGalleyAPI = ToServantApi FederatedBrig.BrigApi :<|> ToServantApi FederatedGalley.GalleyApi
+type CombinedBrigAndGalleyAPI = FedApi 'Brig :<|> FedApi 'Galley
 
 -- Starts a servant Application in Network.Wai.Test session and runs the
 -- FederatedRequest against it.
diff --git a/services/galley/test/integration/Main.hs b/services/galley/test/integration/Main.hs
index d17ec0d18ef..50d690b39ff 100644
--- a/services/galley/test/integration/Main.hs
+++ b/services/galley/test/integration/Main.hs
@@ -118,7 +118,7 @@ main = withOpenSSL $ runTests go
       let ck = fromJust gConf ^. optCassandra . casKeyspace
       lg <- Logger.new Logger.defSettings
       db <- defInitCassandra ck ch cp lg
-      return $ TestSetup (fromJust gConf) (fromJust iConf) m g b c awsEnv convMaxSize db (mkFedGalleyClient galleyEndpoint)
+      return $ TestSetup (fromJust gConf) (fromJust iConf) m g b c awsEnv convMaxSize db (FedClient m galleyEndpoint)
     queueName = fmap (view awsQueueName) . view optJournal
     endpoint = fmap (view awsEndpoint) . view optJournal
     maxSize = view (optSettings . setMaxConvSize)
diff --git a/services/galley/test/integration/TestSetup.hs b/services/galley/test/integration/TestSetup.hs
index 30550c46cbc..767c0ed2935 100644
--- a/services/galley/test/integration/TestSetup.hs
+++ b/services/galley/test/integration/TestSetup.hs
@@ -31,10 +31,10 @@ module TestSetup
     tsMaxConvSize,
     tsCass,
     tsFedGalleyClient,
-    mkFedGalleyClient,
     TestM (..),
     TestSetup (..),
-    FedGalleyClient,
+    FedClient (..),
+    runFedClient,
     GalleyR,
     BrigR,
     CannonR,
@@ -48,16 +48,15 @@ import Control.Monad.Catch (MonadCatch, MonadMask, MonadThrow)
 import Data.Aeson
 import Data.ByteString.Conversion
 import Data.Domain
+import Data.Proxy
 import qualified Data.Text as Text
+import GHC.TypeLits
 import qualified Galley.Aws as Aws
 import Galley.Options (Opts)
 import Imports
 import qualified Network.HTTP.Client as HTTP
 import qualified Servant.Client as Servant
-import Servant.Client.Core.BaseUrl
-import qualified Servant.Client.Core.Request as Client
-import Servant.Client.Generic (AsClientT)
-import qualified Servant.Client.Generic as Servant
+import qualified Servant.Client.Core as Servant
 import Test.Tasty.HUnit
 import Util.Options
 import Wire.API.Federation.API
@@ -106,7 +105,7 @@ newtype TestM a = TestM {runTestM :: ReaderT TestSetup IO a}
       MonadFail
     )
 
-type FedGalleyClient = FedApi 'Galley (AsClientT TestM)
+data FedClient (comp :: Component) = FedClient HTTP.Manager Endpoint
 
 data TestSetup = TestSetup
   { _tsGConf :: Opts,
@@ -118,7 +117,7 @@ data TestSetup = TestSetup
     _tsAwsEnv :: Maybe Aws.Env,
     _tsMaxConvSize :: Word16,
     _tsCass :: Cql.ClientState,
-    _tsFedGalleyClient :: Domain -> FedGalleyClient
+    _tsFedGalleyClient :: FedClient 'Galley
   }
 
 makeLenses ''TestSetup
@@ -128,22 +127,32 @@ instance MonadHttp TestM where
     manager <- view tsManager
     liftIO $ withResponse req manager handler
 
-mkFedGalleyClient :: Endpoint -> Domain -> FedGalleyClient
-mkFedGalleyClient galleyEndpoint originDomain = Servant.genericClientHoist servantClienMToHttp
+runFedClient ::
+  forall (name :: Symbol) comp m api.
+  ( HasFedEndpoint comp api name,
+    Servant.HasClient Servant.ClientM api,
+    MonadIO m
+  ) =>
+  FedClient comp ->
+  Domain ->
+  Servant.Client m api
+runFedClient (FedClient mgr endpoint) domain =
+  Servant.hoistClient (Proxy @api) (servantClientMToHttp domain) $
+    Servant.clientIn (Proxy @api) (Proxy @Servant.ClientM)
   where
-    servantClienMToHttp :: Servant.ClientM a -> TestM a
-    servantClienMToHttp act = do
-      let galleyHost = Text.unpack $ galleyEndpoint ^. epHost
-          brigPort = fromInteger . toInteger $ galleyEndpoint ^. epPort
-          baseUrl = Servant.BaseUrl Servant.Http galleyHost brigPort "/federation"
-      mgr' <- view tsManager
-      let clientEnv = Servant.ClientEnv mgr' baseUrl Nothing makeClientRequest
-      eitherRes <- liftIO $ Servant.runClientM act clientEnv
+    servantClientMToHttp :: Domain -> Servant.ClientM a -> m a
+    servantClientMToHttp originDomain action = liftIO $ do
+      let host = Text.unpack $ endpoint ^. epHost
+          port = fromInteger . toInteger $ endpoint ^. epPort
+          baseUrl = Servant.BaseUrl Servant.Http host port "/federation"
+          clientEnv = Servant.ClientEnv mgr baseUrl Nothing (makeClientRequest originDomain)
+      eitherRes <- Servant.runClientM action clientEnv
       case eitherRes of
         Right res -> pure res
-        Left err -> liftIO $ assertFailure $ "Servant client failed with: " <> show err
-    makeClientRequest :: BaseUrl -> Client.Request -> HTTP.Request
-    makeClientRequest burl req =
+        Left err -> assertFailure $ "Servant client failed with: " <> show err
+
+    makeClientRequest :: Domain -> Servant.BaseUrl -> Servant.Request -> HTTP.Request
+    makeClientRequest originDomain burl req =
       let req' = Servant.defaultMakeClientRequest burl req
        in req'
             { HTTP.requestHeaders =

From 1cb0a65b149f1184a905c458f1614017e4f8978e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marko=20Dimja=C5=A1evi=C4=87?= <marko.dimjasevic@wire.com>
Date: Fri, 14 Jan 2022 14:41:07 +0100
Subject: [PATCH 67/74] Tag a negative test case for X509v3 Extended Key Usage

- The test makes sure that the server certificate has to have an
extension marking its purpose for server authentication
---
 services/federator/test/unit/Test/Federator/Remote.hs | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/services/federator/test/unit/Test/Federator/Remote.hs b/services/federator/test/unit/Test/Federator/Remote.hs
index ce13842fb9c..c47ac3ad8c1 100644
--- a/services/federator/test/unit/Test/Federator/Remote.hs
+++ b/services/federator/test/unit/Test/Federator/Remote.hs
@@ -132,6 +132,10 @@ testValidatesCertificateWrongHostname =
             Left (RemoteError _ (FederatorClientTLSException _)) -> pure ()
             Left x -> assertFailure $ "Expected TLS failure, got: " <> show x
             Right _ -> assertFailure "Expected connection with the server to fail",
+      -- @SF.Federation @TSFI.RESTfulAPI @S2
+      --
+      -- Refuse to connect with a server when it has no X509v3 Extended Key
+      -- Usage extension in the certificate.
       testCase "when the server's certificate does not have the server key usage flag" $
         withMockServer certWithoutServerKeyUsage $ \port -> do
           tlsSettings <- mkTLSSettingsOrThrow settings

From 5590c8c71c3e9946bc922945970260ad4e4e116d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marko=20Dimja=C5=A1evi=C4=87?= <marko.dimjasevic@wire.com>
Date: Fri, 14 Jan 2022 14:45:00 +0100
Subject: [PATCH 68/74] Revert "Tag a negative test case for X509v3 Extended
 Key Usage"

This reverts commit 1cb0a65b149f1184a905c458f1614017e4f8978e.
---
 services/federator/test/unit/Test/Federator/Remote.hs | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/services/federator/test/unit/Test/Federator/Remote.hs b/services/federator/test/unit/Test/Federator/Remote.hs
index c47ac3ad8c1..ce13842fb9c 100644
--- a/services/federator/test/unit/Test/Federator/Remote.hs
+++ b/services/federator/test/unit/Test/Federator/Remote.hs
@@ -132,10 +132,6 @@ testValidatesCertificateWrongHostname =
             Left (RemoteError _ (FederatorClientTLSException _)) -> pure ()
             Left x -> assertFailure $ "Expected TLS failure, got: " <> show x
             Right _ -> assertFailure "Expected connection with the server to fail",
-      -- @SF.Federation @TSFI.RESTfulAPI @S2
-      --
-      -- Refuse to connect with a server when it has no X509v3 Extended Key
-      -- Usage extension in the certificate.
       testCase "when the server's certificate does not have the server key usage flag" $
         withMockServer certWithoutServerKeyUsage $ \port -> do
           tlsSettings <- mkTLSSettingsOrThrow settings

From 6fea75734de30b9d240f79a312e95ad1775ee68b Mon Sep 17 00:00:00 2001
From: Stefan Matting <smatting@users.noreply.github.com>
Date: Fri, 14 Jan 2022 15:44:10 +0100
Subject: [PATCH 69/74] cabal-run-integration.sh - remove Makefile indirection
 (#2044)

* cabal-run-integration.sh - remove indirection

* add changelog entry

* remove pattern argument

* change wording of comment
---
 Makefile                                      |  3 +-
 .../cabal-integration-test-improvement        |  1 +
 hack/bin/cabal-run-integration.sh             | 65 +++++++++++++++----
 3 files changed, 56 insertions(+), 13 deletions(-)
 create mode 100644 changelog.d/5-internal/cabal-integration-test-improvement

diff --git a/Makefile b/Makefile
index 2ab3f77b378..2f037d476ee 100644
--- a/Makefile
+++ b/Makefile
@@ -70,9 +70,10 @@ endif
 
 # ci here doesn't refer to continuous integration, but to cabal-integration
 # Usage: make ci package=brig test=1
+# If you want to pass arguments to the test-suite call the script directly.
 .PHONY: ci
 ci: c
-	./hack/bin/cabal-run-integration.sh $(package) $(pattern)
+	./hack/bin/cabal-run-integration.sh $(package)
 
 # reset db using cabal
 .PHONY: db-reset-package
diff --git a/changelog.d/5-internal/cabal-integration-test-improvement b/changelog.d/5-internal/cabal-integration-test-improvement
new file mode 100644
index 00000000000..e46afe7e4a2
--- /dev/null
+++ b/changelog.d/5-internal/cabal-integration-test-improvement
@@ -0,0 +1 @@
+cabal-run-integration.sh - remove Makefile indirection
diff --git a/hack/bin/cabal-run-integration.sh b/hack/bin/cabal-run-integration.sh
index c68bd2a97b5..c15f86d71cd 100755
--- a/hack/bin/cabal-run-integration.sh
+++ b/hack/bin/cabal-run-integration.sh
@@ -1,26 +1,67 @@
 #!/usr/bin/env bash
 set -euo pipefail
+#
+# this script runs the integration test suite for the given service, after it
+# has started all services integration test configuration.
+#
+# Usage:
+#
+# ./cabal-run-integration.sh brig
+# ./cabal-run-integration.sh brig -p '$2 == "provider" && $3 == "account"'
+#
+# Any additional arguments are passed as-is to the integration test executable.
+# brig uses tasty, so you specify patterns with -p. The above example runs all
+# tests in the test tree
+#
+# Brig API Integration
+#   provider
+#     account
+#
+# Federator uses hspec, where you specify patterns like so:
+#
+# ./cabal-run-integration.sh federator -m rejectRequestsWithoutClientCertIngress
+#
+# To run all integration tests without arguments run:
+#
+# ./cabal-run-integration.sh all
+#
+# If you're not sure what test suite is being used call for help
+# ./cabal-run-integration.sh spar --help
 
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 TOP_LEVEL="$(cd "$DIR/../.." && pwd)"
 
 package=${1:-all}
-pattern=${2:-}
 
-opts=""
+run_integration_tests() {
+  package=${1}
 
-if [[ "$package" != "all" ]]; then
-  opts="$opts -C services/$package"
-fi
+  service_dir="$TOP_LEVEL/services/$package"
+
+  cd "$service_dir"
+  "$TOP_LEVEL/services/integration.sh" \
+    "$TOP_LEVEL/dist/$package-integration" \
+    -s "$service_dir/$package.integration.yaml" \
+    -i "$TOP_LEVEL/services/integration.yaml" \
+    "${@:2}"
+}
 
-if [[ -n "$pattern" ]]; then
-  if [[ "$package" == "all" ]]; then
-    echo -e "\e[31mGlobal pattern not supported\e[0m" >&2
+run_all_integration_tests() {
+  for d in "$TOP_LEVEL/services/"*/; do
+    package=$(basename "$d")
+    service_dir="$TOP_LEVEL/services/$package"
+    if [ -d "$service_dir/test/integration" ] || [ -d "$service_dir/test-integration" ]; then
+      run_integration_tests "$package"
+    fi
+  done
+}
+
+if [ "$package" == "all" ]; then
+  if [ -n "${2:-}" ]; then
+    echo -e "\e[31mCannot pass additional args to all integrations tests.\e[0m" >&2
     exit 1
   fi
-  opts="$opts i-$pattern"
+  run_all_integration_tests
 else
-  opts="$opts i"
+  run_integration_tests "$package" "${@:2}"
 fi
-
-exec make $opts

From 194f9da13273a6be15338d8c0ef1e3c432f62ac5 Mon Sep 17 00:00:00 2001
From: fisx <mf@zerobuzz.net>
Date: Mon, 17 Jan 2022 11:13:16 +0100
Subject: [PATCH 70/74] Upgrade to GHC 8.10 and use Ubuntu 20.04 as base image
 for haskell docker images (#1852)

Also upgrade nixpkgs pin and stack

Co-authored-by: Akshay Mankar <akshay@wire.com>
---
 Makefile                                      |   26 +-
 README.md                                     |    8 +-
 build/alpine/Dockerfile.deps                  |   31 -
 build/alpine/Dockerfile.fast-intermediate     |   26 -
 build/alpine/Dockerfile.prebuilder            |   54 -
 build/alpine/Makefile                         |   23 -
 build/alpine/ghc/build.mk                     |   10 -
 build/alpine/ghc/config.yaml                  |   10 -
 build/{alpine => ubuntu}/Dockerfile.builder   |    9 +-
 build/ubuntu/Dockerfile.deps                  |   33 +
 .../{alpine => ubuntu}/Dockerfile.executable  |    7 +-
 build/ubuntu/Dockerfile.fast-intermediate     |   18 +
 .../Dockerfile.intermediate                   |    7 +-
 build/ubuntu/Dockerfile.prebuilder            |   71 +
 build/ubuntu/Makefile                         |   23 +
 build/{alpine => ubuntu}/README.md            |   10 +-
 cabal.project                                 |    4 +-
 cabal.project.freeze                          | 2255 +++++++++--------
 changelog.d/0-release-notes/ubuntu-images     |    3 +
 changelog.d/5-internal/ghc-8107               |    1 +
 changelog.d/5-internal/nixpkgs                |    1 +
 dev-packages.nix                              |   43 +-
 docs/developer/dependencies.md                |    7 +-
 hack/bin/buildah-compile.sh                   |    6 +-
 hack/bin/buildah-make-images.sh               |    2 +-
 libs/api-bot/api-bot.cabal                    |   45 +-
 libs/api-client/api-client.cabal              |   45 +-
 libs/bilge/bilge.cabal                        |   45 +-
 libs/brig-types/brig-types.cabal              |   86 +-
 libs/cargohold-types/cargohold-types.cabal    |   45 +-
 libs/cassandra-util/cassandra-util.cabal      |   45 +-
 .../deriving-swagger2/deriving-swagger2.cabal |   47 +-
 libs/dns-util/dns-util.cabal                  |   86 +-
 libs/extended/extended.cabal                  |   86 +-
 libs/extended/src/System/Logger/Extended.hs   |    2 +-
 libs/galley-types/galley-types.cabal          |   88 +-
 libs/gundeck-types/gundeck-types.cabal        |   47 +-
 libs/hscim/hscim.cabal                        |   58 +-
 libs/imports/imports.cabal                    |   45 +-
 libs/metrics-core/metrics-core.cabal          |   45 +-
 libs/metrics-wai/metrics-wai.cabal            |   86 +-
 .../polysemy-wire-zoo/polysemy-wire-zoo.cabal |   45 +-
 libs/ropes/ropes.cabal                        |   45 +-
 .../schema-profunctor/schema-profunctor.cabal |   90 +-
 .../sodium-crypto-sign.cabal                  |   45 +-
 libs/ssl-util/ssl-util.cabal                  |   45 +-
 libs/tasty-cannon/tasty-cannon.cabal          |   45 +-
 libs/types-common-aws/types-common-aws.cabal  |   45 +-
 libs/types-common/src/Data/Text/Ascii.hs      |    4 +-
 libs/types-common/types-common.cabal          |   86 +-
 libs/wai-utilities/wai-utilities.cabal        |   45 +-
 .../wire-api-federation.cabal                 |   86 +-
 libs/wire-api/src/Wire/API/Arbitrary.hs       |   12 +-
 libs/wire-api/src/Wire/API/Routes/Public.hs   |    2 +-
 libs/wire-api/src/Wire/API/Team/Role.hs       |    2 +-
 .../golden/Test/Wire/API/Golden/Generator.hs  |    2 +-
 libs/wire-api/wire-api.cabal                  |  129 +-
 libs/zauth/zauth.cabal                        |  127 +-
 nix/overlays/wire-server.nix                  |    2 +-
 nix/sources.json                              |   12 +-
 nix/sources.nix                               |  132 +-
 services/brig/Makefile                        |    2 +-
 services/brig/brig.cabal                      |  250 +-
 services/brig/src/Brig/AWS.hs                 |    8 +-
 services/brig/src/Brig/Data/Client.hs         |    2 +-
 services/brig/src/Brig/Run.hs                 |    2 +-
 services/brig/src/Brig/SMTP.hs                |    2 +-
 services/cannon/Makefile                      |    2 +-
 services/cannon/cannon.cabal                  |  168 +-
 services/cargohold/Makefile                   |    2 +-
 services/cargohold/cargohold.cabal            |  129 +-
 services/cargohold/src/CargoHold/AWS.hs       |    8 +-
 services/federator/federator.cabal            |  168 +-
 services/galley/Makefile                      |    2 +-
 services/galley/galley.cabal                  |  250 +-
 services/galley/src/Galley/API/Teams.hs       |    2 +-
 services/galley/src/Galley/Aws.hs             |    8 +-
 services/gundeck/Makefile                     |    2 +-
 services/gundeck/gundeck.cabal                |  252 +-
 services/gundeck/src/Gundeck/Aws.hs           |    8 +-
 services/gundeck/src/Gundeck/Monad.hs         |    9 +-
 services/gundeck/test/unit/ThreadBudget.hs    |    5 +-
 services/proxy/Makefile                       |    2 +-
 services/proxy/proxy.cabal                    |   86 +-
 services/spar/Makefile                        |    2 +-
 services/spar/spar.cabal                      |  250 +-
 .../Test/Spar/Scim/UserSpec.hs                |    2 +-
 stack-deps.nix                                |    2 +-
 stack.yaml                                    |   77 +-
 stack.yaml.lock                               |  214 +-
 tools/api-simulations/api-simulations.cabal   |  127 +-
 tools/bonanza/bonanza.cabal                   |  209 +-
 tools/convert-to-cabal/shell.nix              |    2 +-
 tools/db/auto-whitelist/auto-whitelist.cabal  |   45 +-
 .../billing-team-member-backfill.cabal        |   45 +-
 tools/db/find-undead/find-undead.cabal        |   45 +-
 .../migrate-sso-feature-flag.cabal            |   45 +-
 tools/db/move-team/move-team.cabal            |  127 +-
 tools/db/move-team/src/Schema.hs              |  156 +-
 tools/db/repair-handles/repair-handles.cabal  |   45 +-
 .../service-backfill/service-backfill.cabal   |   45 +-
 tools/makedeb/makedeb.cabal                   |   86 +-
 tools/rex/Makefile                            |    8 -
 tools/stern/Makefile                          |    2 +-
 tools/stern/stern.cabal                       |   86 +-
 105 files changed, 5832 insertions(+), 1747 deletions(-)
 delete mode 100644 build/alpine/Dockerfile.deps
 delete mode 100644 build/alpine/Dockerfile.fast-intermediate
 delete mode 100644 build/alpine/Dockerfile.prebuilder
 delete mode 100644 build/alpine/Makefile
 delete mode 100644 build/alpine/ghc/build.mk
 delete mode 100644 build/alpine/ghc/config.yaml
 rename build/{alpine => ubuntu}/Dockerfile.builder (66%)
 create mode 100644 build/ubuntu/Dockerfile.deps
 rename build/{alpine => ubuntu}/Dockerfile.executable (88%)
 create mode 100644 build/ubuntu/Dockerfile.fast-intermediate
 rename build/{alpine => ubuntu}/Dockerfile.intermediate (73%)
 create mode 100644 build/ubuntu/Dockerfile.prebuilder
 create mode 100644 build/ubuntu/Makefile
 rename build/{alpine => ubuntu}/README.md (76%)
 create mode 100644 changelog.d/0-release-notes/ubuntu-images
 create mode 100644 changelog.d/5-internal/ghc-8107
 create mode 100644 changelog.d/5-internal/nixpkgs

diff --git a/Makefile b/Makefile
index 2f037d476ee..7cdd010749a 100644
--- a/Makefile
+++ b/Makefile
@@ -190,30 +190,30 @@ i-%:
 .PHONY: docker-prebuilder
 docker-prebuilder:
 	# `docker-prebuilder` needs to be built or pulled only once (unless native dependencies change)
-	$(MAKE) -C build/alpine prebuilder
+	$(MAKE) -C build/ubuntu prebuilder
 
 .PHONY: docker-deps
 docker-deps:
 	# `docker-deps` needs to be built or pulled only once (unless native dependencies change)
-	$(MAKE) -C build/alpine deps
+	$(MAKE) -C build/ubuntu deps
 
 .PHONY: docker-builder
 docker-builder:
 	# `docker-builder` needs to be built or pulled only once (unless native dependencies change)
-	$(MAKE) -C build/alpine builder
+	$(MAKE) -C build/ubuntu builder
 
 .PHONY: docker-intermediate
 docker-intermediate:
 	# `docker-intermediate` needs to be built whenever code changes - this essentially runs `stack clean && stack install` on the whole repo
-	docker build -t $(DOCKER_USER)/alpine-intermediate:$(DOCKER_TAG) -f build/alpine/Dockerfile.intermediate --build-arg builder=$(DOCKER_USER)/alpine-builder:develop --build-arg deps=$(DOCKER_USER)/alpine-deps:develop .;
-	docker tag $(DOCKER_USER)/alpine-intermediate:$(DOCKER_TAG) $(DOCKER_USER)/alpine-intermediate:latest;
-	if test -n "$$DOCKER_PUSH"; then docker login -u $(DOCKER_USERNAME) -p $(DOCKER_PASSWORD); docker push $(DOCKER_USER)/alpine-intermediate:$(DOCKER_TAG); docker push $(DOCKER_USER)/alpine-intermediate:latest; fi;
+	docker build -t $(DOCKER_USER)/ubuntu20-intermediate:$(DOCKER_TAG) -f build/ubuntu/Dockerfile.intermediate --build-arg builder=$(DOCKER_USER)/ubuntu20-builder:develop --build-arg deps=$(DOCKER_USER)/ubuntu20-deps:develop .;
+	docker tag $(DOCKER_USER)/ubuntu20-intermediate:$(DOCKER_TAG) $(DOCKER_USER)/ubuntu20-intermediate:latest;
+	if test -n "$$DOCKER_PUSH"; then docker login -u $(DOCKER_USERNAME) -p $(DOCKER_PASSWORD); docker push $(DOCKER_USER)/ubuntu20-intermediate:$(DOCKER_TAG); docker push $(DOCKER_USER)/ubuntu20-intermediate:latest; fi;
 
 .PHONY: docker-exe-%
 docker-exe-%:
-	docker image ls | grep $(DOCKER_USER)/alpine-deps > /dev/null || (echo "'make docker-deps' required.", exit 1)
-	docker image ls | grep $(DOCKER_USER)/alpine-intermediate > /dev/null || (echo "'make docker-intermediate' required."; exit 1)
-	docker build -t $(DOCKER_USER)/"$*":$(DOCKER_TAG) -f build/alpine/Dockerfile.executable --build-arg executable="$*" --build-arg intermediate=$(DOCKER_USER)/alpine-intermediate --build-arg deps=$(DOCKER_USER)/alpine-deps .
+	docker image ls | grep $(DOCKER_USER)/ubuntu20-deps > /dev/null || (echo "'make docker-deps' required.", exit 1)
+	docker image ls | grep $(DOCKER_USER)/ubuntu20-intermediate > /dev/null || (echo "'make docker-intermediate' required."; exit 1)
+	docker build -t $(DOCKER_USER)/"$*":$(DOCKER_TAG) -f build/ubuntu/Dockerfile.executable --build-arg executable="$*" --build-arg intermediate=$(DOCKER_USER)/ubuntu20-intermediate --build-arg deps=$(DOCKER_USER)/ubuntu20-deps .
 	docker tag $(DOCKER_USER)/"$*":$(DOCKER_TAG) $(DOCKER_USER)/"$*":latest
 	if test -n "$$DOCKER_PUSH"; then docker login -u $(DOCKER_USERNAME) -p $(DOCKER_PASSWORD); docker push $(DOCKER_USER)/"$*":$(DOCKER_TAG); docker push $(DOCKER_USER)/"$*":latest; fi;
 
@@ -221,8 +221,8 @@ docker-exe-%:
 docker-services:
 	# make docker-services doesn't compile, only makes small images out of the `docker-intermediate` image
 	# to recompile, run `docker-intermediate` first.
-	docker image ls | grep $(DOCKER_USER)/alpine-deps > /dev/null || (echo "'make docker-deps' required.", exit 1)
-	docker image ls | grep $(DOCKER_USER)/alpine-intermediate > /dev/null || (echo "'make docker-intermediate' required."; exit 1)
+	docker image ls | grep $(DOCKER_USER)/ubuntu20-deps > /dev/null || (echo "'make docker-deps' required.", exit 1)
+	docker image ls | grep $(DOCKER_USER)/ubuntu20-intermediate > /dev/null || (echo "'make docker-intermediate' required."; exit 1)
 	# `make -C services/brig docker` == `make docker-exe-brig docker-exe-brig-integration docker-exe-brig-schema docker-exe-brig-index`
 	$(MAKE) -C services/brig docker
 	$(MAKE) -C services/gundeck docker
@@ -236,10 +236,10 @@ docker-services:
 
 DOCKER_DEV_NETWORK := --net=host
 DOCKER_DEV_VOLUMES := -v `pwd`:/wire-server
-DOCKER_DEV_IMAGE   := quay.io/wire/alpine-builder:$(DOCKER_TAG)
+DOCKER_DEV_IMAGE   := quay.io/wire/ubuntu20-builder:$(DOCKER_TAG)
 .PHONY: run-docker-builder
 run-docker-builder:
-	@echo "if this does not work, consider 'docker pull', 'docker tag', or 'make -C build-alpine builder'."
+	@echo "if this does not work, consider 'docker pull', 'docker tag', or 'make -C build/ubuntu builder'."
 	docker run --workdir /wire-server -it $(DOCKER_DEV_NETWORK) $(DOCKER_DEV_VOLUMES) --rm $(DOCKER_DEV_IMAGE) /bin/bash
 
 .PHONY: git-add-cassandra-schema
diff --git a/README.md b/README.md
index f5d86ab3e72..240f9850ea6 100644
--- a/README.md
+++ b/README.md
@@ -108,22 +108,22 @@ For building nginz, see [services/nginz/README.md](services/nginz/README.md)
 
 #### 2. Use docker
 
-*If you don't wish to build all docker images from scratch (e.g. the `alpine-builder` takes a very long time), ready-built images can be downloaded from [here](https://quay.io/organization/wire).*
+*If you don't wish to build all docker images from scratch (e.g. the `ubuntu20-builder` takes a very long time), ready-built images can be downloaded from [here](https://quay.io/organization/wire).*
 
 If you wish to build your own docker images, you need [docker version >= 17.05](https://www.docker.com/) and [`make`](https://www.gnu.org/software/make/). Then,
 
 ```bash
 # optionally:
-# make docker-builder # if you don't run this, it pulls the alpine-builder image from quay.io
+# make docker-builder # if you don't run this, it pulls the ubuntu20-builder image from quay.io
 make docker-deps docker-intermediate docker-services
 
 # subsequent times, after changing code, if you wish to re-create docker images, it's sufficient to
 make docker-intermediate docker-services
 ```
 
-will, eventually, have built a range of docker images. Make sure to [give Docker enough RAM](https://github.com/wireapp/wire-server/issues/562); if you see `make: *** [builder] Error 137`, it might be a sign that the build ran out of memory. You can also mix and match – e.g. pull the [`alpine-builder`](https://quay.io/repository/wire/alpine-builder?tab=tags) image and build the rest locally.
+will, eventually, have built a range of docker images. Make sure to [give Docker enough RAM](https://github.com/wireapp/wire-server/issues/562); if you see `make: *** [builder] Error 137`, it might be a sign that the build ran out of memory. You can also mix and match – e.g. pull the [`ubuntu20-builder`](https://quay.io/repository/wire/ubuntu20-builder?tab=tags) image and build the rest locally.
 
-See the `Makefile`s and `Dockerfile`s, as well as [build/alpine/README.md](build/alpine/README.md) for details.
+See the `Makefile`s and `Dockerfile`s, as well as [build/ubuntu/README.md](build/ubuntu/README.md) for details.
 
 ### How to run integration tests
 
diff --git a/build/alpine/Dockerfile.deps b/build/alpine/Dockerfile.deps
deleted file mode 100644
index 9ef4958bb15..00000000000
--- a/build/alpine/Dockerfile.deps
+++ /dev/null
@@ -1,31 +0,0 @@
-# Requires docker >= 17.05 (requires support for multi-stage builds)
-
-FROM alpine:3.12 as cryptobox-builder
-
-# compile cryptobox-c
-RUN apk add --no-cache cargo file libsodium-dev git && \
-    cd /tmp && \
-    git clone https://github.com/wireapp/cryptobox-c.git && \
-    cd cryptobox-c && \
-    export SODIUM_USE_PKG_CONFIG=1 && \
-    cargo build --release
-
-# Minimal dependencies for alpine-compiled, dynamically linked wire-server Haskell services
-FROM alpine:3.12
-
-COPY --from=cryptobox-builder /tmp/cryptobox-c/target/release/libcryptobox.so /usr/lib
-
-RUN apk add --no-cache \
-            libsodium \
-            openssl \
-            gmp \
-            libgcc \
-            libffi \
-            libstdc++ \
-            icu \
-            geoip \
-            llvm-libunwind \
-            ca-certificates \
-            dumb-init \
-            libxml2 \
-            ncurses
diff --git a/build/alpine/Dockerfile.fast-intermediate b/build/alpine/Dockerfile.fast-intermediate
deleted file mode 100644
index 91fcf399d68..00000000000
--- a/build/alpine/Dockerfile.fast-intermediate
+++ /dev/null
@@ -1,26 +0,0 @@
-# Produces intermediate docker image with all executables under /dist using fast option
-
-# Requires docker version >= 17.05 (requires support for multi-stage builds)
-# Requires to have created the wire-server-builder and wire-server-deps docker images (run `make` in this directory)
-# Usage example:
-#   (from wire-server root directory)
-#   docker build -f build/alpine/Dockerfile.fastintermediate .
-
-ARG builder=quay.io/wire/alpine-builder
-ARG deps=quay.io/wire/alpine-deps
-
-#--- Builder stage ---
-FROM ${builder} as builder
-
-WORKDIR /wire-server/
-
-COPY . /wire-server/
-
-RUN make clean fast
-
-#--- Minified stage ---
-FROM ${deps}
-
-COPY --from=builder /wire-server/dist/ /dist/
-# brig also needs some templates.
-COPY --from=builder /wire-server/services/brig/deb/opt/brig/templates/ /dist/templates/
diff --git a/build/alpine/Dockerfile.prebuilder b/build/alpine/Dockerfile.prebuilder
deleted file mode 100644
index 3f84e00a7a4..00000000000
--- a/build/alpine/Dockerfile.prebuilder
+++ /dev/null
@@ -1,54 +0,0 @@
-# Requires docker >= 17.05 (requires support for multi-stage builds)
-
-FROM alpine:3.12 as cryptobox-builder
-
-# compile cryptobox-c
-RUN apk add --no-cache cargo file libsodium-dev git && \
-    cd /tmp && \
-    git clone https://github.com/wireapp/cryptobox-c.git && \
-    cd cryptobox-c && \
-    export SODIUM_USE_PKG_CONFIG=1 && \
-    cargo build --release
-
-FROM alpine:3.12
-
-# install cryptobox-c in the new container
-COPY --from=cryptobox-builder /tmp/cryptobox-c/target/release/libcryptobox.so /usr/lib/libcryptobox.so
-COPY --from=cryptobox-builder /tmp/cryptobox-c/src/cbox.h /usr/include/cbox.h
-
-# development packages required for wire-server Haskell services
-RUN apk add --no-cache \
-        alpine-sdk \
-        ca-certificates \
-        linux-headers \
-        zlib-dev \
-        perl \
-        gmp-dev \
-        libffi-dev \
-        make \
-        libsodium-dev \
-        openssl-dev \
-        protobuf \
-        icu-dev \
-        geoip-dev \
-        snappy-dev \
-        llvm-libunwind-dev \
-        bash \
-        xz \
-        libxml2-dev \
-        git \
-        ncurses \
-        ncurses-dev \
-        sed
-
-# get static version of Haskell Stack and use system ghc by default
-ARG STACK_ALPINE_VERSION=2.3.1
-RUN curl -sSfL https://github.com/commercialhaskell/stack/releases/download/v${STACK_ALPINE_VERSION}/stack-${STACK_ALPINE_VERSION}-linux-x86_64-static.tar.gz \
-    | tar --wildcards -C /usr/local/bin --strip-components=1 -xzvf - '*/stack' && chmod 755 /usr/local/bin/stack && \
-    stack config set system-ghc --global true
-
-ARG GHC_VERSION=8.8.4
-RUN curl --proto '=https' --tlsv1.2 -sSf https://get-ghcup.haskell.org \
-  | BOOTSTRAP_HASKELL_NONINTERACTIVE=1 BOOTSTRAP_HASKELL_GHC_VERSION=${GHC_VERSION} sh
-
-ENV PATH=/root/.ghcup/bin:${PATH}
diff --git a/build/alpine/Makefile b/build/alpine/Makefile
deleted file mode 100644
index 90b1aa5e646..00000000000
--- a/build/alpine/Makefile
+++ /dev/null
@@ -1,23 +0,0 @@
-LANG := en_US.UTF-8
-DOCKER_USER   ?= quay.io/wire
-DOCKER_TAG    ?= local
-
-default: deps prebuilder builder
-
-.PHONY: deps
-deps:
-	docker build -t $(DOCKER_USER)/alpine-deps:$(DOCKER_TAG) -f Dockerfile.deps .
-	docker tag $(DOCKER_USER)/alpine-deps:$(DOCKER_TAG) $(DOCKER_USER)/alpine-deps:latest
-	if test -n "$$DOCKER_PUSH"; then docker push $(DOCKER_USER)/alpine-deps:$(DOCKER_TAG); docker push $(DOCKER_USER)/alpine-deps:latest; fi;
-
-.PHONY: prebuilder
-prebuilder:
-	docker build -t $(DOCKER_USER)/alpine-prebuilder:$(DOCKER_TAG) -f Dockerfile.prebuilder .
-	docker tag $(DOCKER_USER)/alpine-prebuilder:$(DOCKER_TAG) $(DOCKER_USER)/alpine-prebuilder:latest
-	if test -n "$$DOCKER_PUSH"; then docker push $(DOCKER_USER)/alpine-prebuilder:$(DOCKER_TAG); docker push $(DOCKER_USER)/alpine-prebuilder:latest; fi;
-
-.PHONY: builder
-builder:
-	docker build --build-arg prebuilder=$(DOCKER_USER)/alpine-prebuilder -t $(DOCKER_USER)/alpine-builder:$(DOCKER_TAG) -f Dockerfile.builder .
-	docker tag $(DOCKER_USER)/alpine-builder:$(DOCKER_TAG) $(DOCKER_USER)/alpine-builder:latest
-	if test -n "$$DOCKER_PUSH"; then docker push $(DOCKER_USER)/alpine-builder:$(DOCKER_TAG); docker push $(DOCKER_USER)/alpine-builder:latest; fi;
diff --git a/build/alpine/ghc/build.mk b/build/alpine/ghc/build.mk
deleted file mode 100644
index c9c5dfebf88..00000000000
--- a/build/alpine/ghc/build.mk
+++ /dev/null
@@ -1,10 +0,0 @@
-SRC_HC_OPTS        = -O -H256m
-GhcStage1HcOpts    = -O
-GhcStage2HcOpts    = -O2
-GhcLibHcOpts       = -O2
-BUILD_PROF_LIBS    = YES
-SplitSections      = YES
-BUILD_SPHINX_HTML  = YES
-BUILD_SPHINX_PDF   = NO
-HADDOCK_DOCS       = YES
-EXTRA_HADDOCK_OPTS += --hyperlinked-source
diff --git a/build/alpine/ghc/config.yaml b/build/alpine/ghc/config.yaml
deleted file mode 100644
index 063311f04f5..00000000000
--- a/build/alpine/ghc/config.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-build:
-  prefetch: true
-ghc-build: standard
-system-ghc: true
-ghc-options:
-  "$everything": -split-sections
-package-indices:
-  - name: HackageOrig
-    download-prefix: https://hackage.haskell.org/package/
-    http: https://hackage.haskell.org/01-index.tar.gz
diff --git a/build/alpine/Dockerfile.builder b/build/ubuntu/Dockerfile.builder
similarity index 66%
rename from build/alpine/Dockerfile.builder
rename to build/ubuntu/Dockerfile.builder
index 52203d7a58b..f34e4fc91d5 100644
--- a/build/alpine/Dockerfile.builder
+++ b/build/ubuntu/Dockerfile.builder
@@ -1,5 +1,4 @@
-# Requires docker >= 17.05 (requires support for multi-stage builds)
-ARG prebuilder=quay.io/wire/alpine-prebuilder
+ARG prebuilder=quay.io/wire/ubuntu20-prebuilder
 
 FROM ${prebuilder}
 WORKDIR /
@@ -18,9 +17,9 @@ RUN set -x && \
     cd /wire-server && \
     stack update && \
     echo "allow-different-user: true" >> /root/.stack/config.yaml && \
-    stack build --haddock --dependencies-only haskell-src-exts && \
-    stack build --haddock --no-haddock-hyperlink-source haskell-src-exts && \
-    stack build --pedantic --haddock --test --no-run-tests --bench --no-run-benchmarks --dependencies-only -j${THREADS} && \
+    stack build --dependencies-only haskell-src-exts && \
+    stack build haskell-src-exts && \
+    stack build --pedantic --test --no-run-tests --bench --no-run-benchmarks --dependencies-only -j${THREADS} && \
     stack install ormolu && \
     cd / && \
     # we run the build only to cache the built source in /root/.stack, we can remove the source code itself
diff --git a/build/ubuntu/Dockerfile.deps b/build/ubuntu/Dockerfile.deps
new file mode 100644
index 00000000000..85531bd85fe
--- /dev/null
+++ b/build/ubuntu/Dockerfile.deps
@@ -0,0 +1,33 @@
+FROM ubuntu:20.04 as cryptobox-builder
+
+# compile cryptobox-c
+RUN export DEBIAN_FRONTEND=noninteractive && \
+    apt-get update && \
+    apt-get install -y cargo file libsodium-dev git pkg-config && \
+    cd /tmp && \
+    git clone https://github.com/wireapp/cryptobox-c.git && \
+    cd cryptobox-c && \
+    export SODIUM_USE_PKG_CONFIG=1 && \
+    cargo build --release
+
+# Minimal dependencies for ubuntu-compiled, dynamically linked wire-server Haskell services
+FROM ubuntu:20.04
+
+COPY --from=cryptobox-builder /tmp/cryptobox-c/target/release/libcryptobox.so /usr/lib
+
+RUN export DEBIAN_FRONTEND=noninteractive && \
+    apt-get update && \
+    apt-get install -y \
+            libsodium23 \
+            libssl1.1 \
+            libgmp10 \
+            libffi7 \
+            libicu66 \
+            geoip-database \
+            ca-certificates \
+            dumb-init \
+            libxml2 \
+            libncurses6 \
+            zlib1g \
+            netbase && \
+    rm -rf /var/lib/apt/lists/*
diff --git a/build/alpine/Dockerfile.executable b/build/ubuntu/Dockerfile.executable
similarity index 88%
rename from build/alpine/Dockerfile.executable
rename to build/ubuntu/Dockerfile.executable
index d00e2dc3140..1afa4103b4d 100644
--- a/build/alpine/Dockerfile.executable
+++ b/build/ubuntu/Dockerfile.executable
@@ -4,10 +4,9 @@
 # Requires to have created the wire-server-builder and wire-server-deps docker images (run `make` in this directory)
 # Usage example:
 #   (from wire-server root directory)
-#   export EXECUTABLE=galley-schema; docker build -t $EXECUTABLE -f build/alpine/Dockerfile.executable --build-arg executable=$EXECUTABLE .
-
-ARG intermediate=quay.io/wire/alpine-intermediate
-ARG deps=quay.io/wire/alpine-deps
+#   export EXECUTABLE=galley-schema; docker build -t $EXECUTABLE -f build/ubuntu/Dockerfile.executable --build-arg executable=$EXECUTABLE .
+ARG intermediate=quay.io/wire/ubuntu20-intermediate
+ARG deps=quay.io/wire/ubuntu20-deps
 
 #--- Intermediate stage ---
 FROM ${intermediate} as intermediate
diff --git a/build/ubuntu/Dockerfile.fast-intermediate b/build/ubuntu/Dockerfile.fast-intermediate
new file mode 100644
index 00000000000..a4563d0ffca
--- /dev/null
+++ b/build/ubuntu/Dockerfile.fast-intermediate
@@ -0,0 +1,18 @@
+ARG builder=quay.io/wire/ubuntu20-builder
+ARG deps=quay.io/wire/ubuntu-deps
+
+#--- Builder stage ---
+FROM ${builder} as builder
+
+WORKDIR /wire-server/
+
+COPY . /wire-server/
+
+RUN make clean fast
+
+#--- Minified stage ---
+FROM ${deps}
+
+COPY --from=builder /wire-server/dist/ /dist/
+# brig also needs some templates.
+COPY --from=builder /wire-server/services/brig/deb/opt/brig/templates/ /dist/templates/
diff --git a/build/alpine/Dockerfile.intermediate b/build/ubuntu/Dockerfile.intermediate
similarity index 73%
rename from build/alpine/Dockerfile.intermediate
rename to build/ubuntu/Dockerfile.intermediate
index de58eb16181..61562ab4f07 100644
--- a/build/alpine/Dockerfile.intermediate
+++ b/build/ubuntu/Dockerfile.intermediate
@@ -1,13 +1,12 @@
 # Produces intermediate docker image with all executables under /dist
 
-# Requires docker version >= 17.05 (requires support for multi-stage builds)
 # Requires to have created the wire-server-builder and wire-server-deps docker images (run `make` in this directory)
 # Usage example:
 #   (from wire-server root directory)
-#   docker build -f build/alpine/Dockerfile.intermediate .
+#   docker build -f build/alpine/Dockerfile.intermediate
 
-ARG builder=quay.io/wire/alpine-builder
-ARG deps=quay.io/wire/alpine-deps
+ARG builder=quay.io/wire/ubuntu20-builder
+ARG deps=quay.io/wire/ubuntu20-deps
 
 #--- Builder stage ---
 FROM ${builder} as builder
diff --git a/build/ubuntu/Dockerfile.prebuilder b/build/ubuntu/Dockerfile.prebuilder
new file mode 100644
index 00000000000..22f8dc04c67
--- /dev/null
+++ b/build/ubuntu/Dockerfile.prebuilder
@@ -0,0 +1,71 @@
+FROM ubuntu:20.04 as cryptobox-builder
+
+# compile cryptobox-c
+RUN export DEBIAN_FRONTEND=noninteractive && \
+    apt-get update && \
+    apt-get install -y cargo file libsodium-dev git pkg-config && \
+    cd /tmp && \
+    git clone https://github.com/wireapp/cryptobox-c.git && \
+    cd cryptobox-c && \
+    export SODIUM_USE_PKG_CONFIG=1 && \
+    cargo build --release
+
+FROM ubuntu:20.04
+
+# install cryptobox-c in the new container
+COPY --from=cryptobox-builder /tmp/cryptobox-c/target/release/libcryptobox.so /usr/lib/libcryptobox.so
+COPY --from=cryptobox-builder /tmp/cryptobox-c/src/cbox.h /usr/include/cbox.h
+
+# development packages required for wire-server Haskell services
+RUN export DEBIAN_FRONTEND=noninteractive && \
+    apt-get update \
+    && apt-get install -y \
+        ca-certificates \
+        build-essential \
+        clang \
+        debhelper \
+        dh-autoreconf \
+        libgeoip-dev \
+        libglib2.0-dev \
+        libicu-dev \
+        libleveldb1d \
+        libleveldb-dev \
+        libossp-uuid-dev \
+        libpcre3-dev \
+        libsnappy-dev \
+        libssl-dev \
+        libstatgrab-dev \
+        pkg-config \
+        tcl \
+        upx-ucl \
+        zlib1g-dev \
+        libbz2-dev \
+        liblzma-dev \
+        liblzma5 \
+        libsodium-dev \
+        libsodium23 \
+        libpq-dev \
+        libxml2-dev \
+        libxml2 \
+        curl \
+        wget \
+        git \
+        libffi-dev \
+        libffi7 \
+        libgmp-dev \
+        libgmp10 \
+        libncurses-dev \
+        libncurses5 \
+        libtinfo5 \
+        protobuf-compiler
+
+ARG GHC_VERSION=8.10.7
+RUN curl --proto '=https' --tlsv1.2 -sSf https://get-ghcup.haskell.org \
+    | BOOTSTRAP_HASKELL_NONINTERACTIVE=1 BOOTSTRAP_HASKELL_GHC_VERSION=${GHC_VERSION} sh
+
+ENV PATH=/root/.ghcup/bin:${PATH} \
+    LANG=C.UTF-8 \
+    LC_ALL=C.UTF-8
+
+ARG STACK_VERSION=2.7.3
+RUN ghcup install stack ${STACK_VERSION}
diff --git a/build/ubuntu/Makefile b/build/ubuntu/Makefile
new file mode 100644
index 00000000000..5db0b8c91f0
--- /dev/null
+++ b/build/ubuntu/Makefile
@@ -0,0 +1,23 @@
+LANG := en_US.UTF-8
+DOCKER_USER   ?= quay.io/wire
+DOCKER_TAG    ?= local
+
+default: deps prebuilder builder
+
+.PHONY: deps
+deps:
+	docker build -t $(DOCKER_USER)/ubuntu20-deps:$(DOCKER_TAG) -f Dockerfile.deps .
+	docker tag $(DOCKER_USER)/ubuntu20-deps:$(DOCKER_TAG) $(DOCKER_USER)/ubuntu20-deps:latest
+	if test -n "$$DOCKER_PUSH"; then docker push $(DOCKER_USER)/ubuntu20-deps:$(DOCKER_TAG); docker push $(DOCKER_USER)/ubuntu20-deps:latest; fi;
+
+.PHONY: prebuilder
+prebuilder:
+	docker build -t $(DOCKER_USER)/ubuntu20-prebuilder:$(DOCKER_TAG) -f Dockerfile.prebuilder .
+	docker tag $(DOCKER_USER)/ubuntu20-prebuilder:$(DOCKER_TAG) $(DOCKER_USER)/ubuntu20-prebuilder:latest
+	if test -n "$$DOCKER_PUSH"; then docker push $(DOCKER_USER)/ubuntu20-prebuilder:$(DOCKER_TAG); docker push $(DOCKER_USER)/ubuntu20-prebuilder:latest; fi;
+
+.PHONY: builder
+builder:
+	docker build --build-arg prebuilder=$(DOCKER_USER)/ubuntu20-prebuilder -t $(DOCKER_USER)/ubuntu20-builder:$(DOCKER_TAG) -f Dockerfile.builder .
+	docker tag $(DOCKER_USER)/ubuntu20-builder:$(DOCKER_TAG) $(DOCKER_USER)/ubuntu20-builder:latest
+	if test -n "$$DOCKER_PUSH"; then docker push $(DOCKER_USER)/ubuntu20-builder:$(DOCKER_TAG); docker push $(DOCKER_USER)/ubuntu20-builder:latest; fi;
diff --git a/build/alpine/README.md b/build/ubuntu/README.md
similarity index 76%
rename from build/alpine/README.md
rename to build/ubuntu/README.md
index f42a12ebf98..397afdb5a04 100644
--- a/build/alpine/README.md
+++ b/build/ubuntu/README.md
@@ -2,15 +2,14 @@
 
 To create docker images, you need to install [docker version >= 17.05](https://www.docker.com/) and [`make`](https://www.gnu.org/software/make/).
 
-* `Dockerfile.builder` contains all the compile-time dependencies necessary to compile any of the Haskell services (it also downloads, builds and caches some Haskell libraries). This image is fairly large, ~4GB uncompressed.
-* `Dockerfile.deps` contains all the run-time dependencies e.g. shared libraries, at a total size of ~18MB compressed.
+* `Dockerfile.builder` contains all the compile-time dependencies necessary to compile any of the Haskell services (it also downloads, builds and caches some Haskell libraries). This image is fairly large, ~1.7GB compressed.
+* `Dockerfile.deps` contains all the run-time dependencies e.g. shared libraries, at a total size of ~52MB compressed.
 
 Both of the above need to be built first (only once) to be able to actually build a service docker image.
 
 * `Dockerfile.intermediate` - based on `Dockerfile.deps`/`Dockerfile.builder`, this is an intermediate image compiling all dynamically linked binaries (obtained when running `make install` in the top-level directory).
 * `Dockerfile.executable` - based on `Dockerfile.deps`/`Dockerfile.intermediate`, this extracts a single executable from the intermediate image, yielding a small image (~30MB compressed) with a single dynamically linked binary.
 
-
 ### Build the `builder` and `deps` docker images locally
 
 (from within the `wire-server` directory)
@@ -28,7 +27,4 @@ make docker-exe-brig # this only extracts one binary from the intermediate image
 
 ## Other dockerfiles
 
-* `Dockerfile.migrations` - same as `Dockerfile.executable`, with a fixed set of database migration binaries.
-* `Dockerfile.prebuilder` - dependencies of `Dockerfile.builder` that are expected to change very rarely (GHC, system libraries). Currently we're able to use system GHC, but if we require a newer version of GHC than the one provided by Alpine, we could build GHC in `Dockerfile.prebuilder` (as it has been [done before][2018-11-28]).
-
-[2018-11-28]: https://github.com/wireapp/wire-server/releases/tag/v2018-11-28
+* `Dockerfile.prebuilder` - dependencies of `Dockerfile.builder` that are expected to change very rarely (GHC, system libraries).
diff --git a/cabal.project b/cabal.project
index 94b8595b0a0..be2bc1ee317 100644
--- a/cabal.project
+++ b/cabal.project
@@ -1,6 +1,6 @@
 -- Generated by stackage-to-hackage
 
-with-compiler: ghc-8.8.4
+with-compiler: ghc-8.10.7
 
 packages:
     libs/api-bot/
@@ -140,7 +140,7 @@ source-repository-package
 source-repository-package
     type: git
     location: https://github.com/wireapp/saml2-web-sso
-    tag: 60398f375987b74d6b855b5d225e45dc3a96ac06
+    tag: 4227e38be5c0810012dc472fc6931f6087fbce68
 
 source-repository-package
     type: git
diff --git a/cabal.project.freeze b/cabal.project.freeze
index faadf3c628b..eac24bfbdc7 100644
--- a/cabal.project.freeze
+++ b/cabal.project.freeze
@@ -1,101 +1,107 @@
 constraints: any.AC-Angle ==1.0,
              any.ALUT ==2.4.0.3,
              any.ANum ==0.2.0.2,
-             any.Allure ==0.9.5.0,
+             any.Agda ==2.6.2,
+             any.Allure ==0.10.3.0,
+             any.BNFC ==2.9.3,
+             any.BNFC-meta ==0.6.1,
              any.Boolean ==0.2.4,
              any.BoundedChan ==1.0.3.0,
              any.ChannelT ==0.0.0.7,
              any.Chart ==1.9.3,
-             any.Chart-diagrams ==1.9.3,
-             any.ChasingBottoms ==1.3.1.9,
+             any.ChasingBottoms ==1.3.1.11,
              any.Clipboard ==2.3.2.0,
              any.ClustalParser ==1.3.0,
-             any.Color ==0.1.4,
-             any.ConfigFile ==1.1.4,
+             any.Color ==0.3.3,
              any.DAV ==1.3.4,
-             any.DBFunctor ==0.1.1.1,
-             any.Decimal ==0.5.1,
+             any.DBFunctor ==0.1.2.1,
+             any.Decimal ==0.5.2,
              any.Diff ==0.4.0,
              any.ENIG ==0.0.1.0,
              any.Earley ==0.13.0.1,
              any.Ebnf2ps ==1.0.15,
              any.FenwickTree ==0.1.2.1,
              any.FindBin ==0.0.5,
-             any.FloatingHex ==0.4,
+             any.FloatingHex ==0.5,
              any.FontyFruity ==0.5.3.5,
              any.ForestStructures ==0.0.1.0,
              any.GLFW-b ==3.3.0.0,
-             any.GLURaw ==2.0.0.4,
-             any.GLUT ==2.7.0.15,
+             any.GLURaw ==2.0.0.5,
+             any.GLUT ==2.7.0.16,
              any.GenericPretty ==1.2.2,
-             any.Glob ==0.10.1,
+             any.Glob ==0.10.2,
+             any.H ==0.9.0.1,
              any.HCodecs ==0.5.2,
              any.HDBC ==2.4.0.3,
              any.HDBC-session ==0.1.2.0,
              any.HSlippyMap ==3.0.1,
-             any.HStringTemplate ==0.8.7,
-             any.HSvm ==0.1.1.3.22,
-             any.HTF ==0.14.0.3,
-             any.HTTP ==4000.3.15,
-             any.HUnit ==1.6.0.0,
+             any.HStringTemplate ==0.8.8,
+             any.HSvm ==0.1.1.3.25,
+             any.HTF ==0.14.0.6,
+             any.HTTP ==4000.3.16,
+             any.HUnit ==1.6.2.0,
              any.HUnit-approx ==1.1.1.1,
-             any.HaTeX ==3.22.2.0,
-             any.HaXml ==1.25.5,
+             any.HaTeX ==3.22.3.0,
+             any.HaXml ==1.25.7,
              any.HandsomeSoup ==0.4.2,
              any.HasBigDecimal ==0.1.1,
-             any.HaskellNet ==0.5.2,
+             any.HaskellNet ==0.6,
              HsOpenSSL -fast-bignum,
-             any.HsOpenSSL ==0.11.4.19,
-             any.HsOpenSSL-x509-system ==0.1.0.3,
+             any.HsOpenSSL ==0.11.7.2,
+             any.HsOpenSSL-x509-system ==0.1.0.4,
              any.HsYAML ==0.2.1.0,
-             any.HsYAML-aeson ==0.2.0.0,
-             any.IPv6Addr ==1.1.5,
+             any.HsYAML-aeson ==0.2.0.1,
+             any.IPv6Addr ==2.0.3,
              any.Imlib ==0.1.2,
              any.IntervalMap ==0.6.1.2,
-             any.JuicyPixels ==3.3.5,
+             any.JuicyPixels ==3.3.6,
              any.JuicyPixels-blurhash ==0.1.0.3,
-             any.JuicyPixels-extra ==0.4.1,
+             any.JuicyPixels-extra ==0.5.2,
              any.JuicyPixels-scale-dct ==0.1.2,
-             any.LambdaHack ==0.9.5.0,
+             any.LambdaHack ==0.10.3.0,
              any.LibZip ==1.0.1,
              any.List ==0.6.2,
-             any.ListLike ==4.7.2,
+             any.ListLike ==4.7.6,
              any.ListTree ==0.2.3,
+             any.MapWith ==0.2.0.0,
              any.MemoTrie ==0.6.10,
-             any.MissingH ==1.4.3.0,
              any.MonadPrompt ==1.0.0.5,
-             any.MonadRandom ==0.5.2,
+             any.MonadRandom ==0.5.3,
              any.MusicBrainz ==0.4.1,
              NineP -bytestring-in-base,
              any.NineP ==0.0.2.1,
              any.NumInstances ==1.4,
-             any.ObjectName ==1.1.0.1,
+             any.ObjectName ==1.1.0.2,
              any.OneTuple ==0.2.2.1,
              any.Only ==0.1,
              any.OpenAL ==1.7.0.5,
              any.OpenGL ==3.0.3.0,
-             any.OpenGLRaw ==3.3.4.0,
+             any.OpenGLRaw ==3.3.4.1,
              any.ParsecTools ==0.0.2.0,
-             any.PyF ==0.9.0.2,
+             any.PyF ==0.9.0.3,
              any.QuasiText ==0.1.2.6,
-             any.QuickCheck ==2.14,
+             QuickCheck -old-random,
+             any.QuickCheck ==2.14.2,
              any.RSA ==2.4.1,
              any.Ranged-sets ==0.4.0,
-             any.Rasterific ==0.7.5.2,
+             any.Rasterific ==0.7.5.4,
+             any.Rattus ==0.5.0.1,
              any.RefSerialize ==0.4.0,
              any.SHA ==1.6.4.4,
-             any.SVGFonts ==1.7.0.1,
+             any.STMonadTrans ==0.4.6,
              any.SafeSemaphore ==0.10.1,
-             any.ShellCheck ==0.7.1,
-             any.Spintax ==0.3.5,
-             any.StateVar ==1.2,
+             any.ShellCheck ==0.7.2,
+             any.Sit ==0.2021.1.18,
+             any.Spintax ==0.3.6,
+             any.StateVar ==1.2.2,
+             any.Stream ==0.4.7.2,
              any.TCache ==0.12.1,
-             any.Taxonomy ==2.1.0,
+             any.Taxonomy ==2.2.0,
              any.TypeCompose ==0.9.14,
              any.ViennaRNAParser ==1.3.3,
-             any.Win32 ==2.6.1.0,
+             any.Win32 ==2.6.2.1,
              any.Win32-notify ==0.3.0.3,
-             any.X11 ==1.9.2,
+             any.X11 ==1.10.2,
              any.X11-xft ==0.3.1,
              any.Xauth ==0.1,
              any.abstract-deque ==0.3,
@@ -103,40 +109,44 @@ constraints: any.AC-Angle ==1.0,
              any.accuerr ==0.2.0.2,
              any.ace ==0.6,
              any.action-permutations ==0.0.0.1,
-             any.active ==0.2.0.14,
-             any.ad ==4.4,
+             any.ad ==4.4.1,
              any.adjunctions ==4.4,
              any.adler32 ==0.1.2.0,
-             any.advent-of-code-api ==0.2.7.0,
+             any.aern2-mp ==0.2.8.0,
+             any.aern2-real ==0.2.8.0,
              any.aeson ==1.4.7.1,
              any.aeson-attoparsec ==0.0.0,
              any.aeson-better-errors ==0.9.1.0,
              any.aeson-casing ==0.2.0.0,
-             any.aeson-combinators ==0.0.2.1,
-             any.aeson-compat ==0.3.9,
+             any.aeson-combinators ==0.0.5.0,
+             any.aeson-commit ==1.3,
+             any.aeson-compat ==0.3.10,
              any.aeson-default ==0.9.1.0,
              any.aeson-diff ==1.1.0.9,
              any.aeson-generic-compat ==0.0.1.3,
              any.aeson-lens ==0.5.0.0,
-             any.aeson-optics ==1.1.0.1,
+             any.aeson-optics ==1.1.1,
              any.aeson-picker ==0.1.0.5,
-             any.aeson-pretty ==0.8.8,
-             any.aeson-qq ==0.8.3,
-             any.aeson-schemas ==1.2.0,
-             any.aeson-utils ==0.3.0.2,
+             any.aeson-pretty ==0.8.9,
+             any.aeson-qq ==0.8.4,
+             any.aeson-schemas ==1.3.5,
+             any.aeson-typescript ==0.3.0.1,
+             any.aeson-with ==0.1.2.0,
              any.aeson-yak ==0.1.1.3,
-             any.aeson-yaml ==1.0.6.0,
+             any.aeson-yaml ==1.1.0.1,
+             any.agda2lagda ==0.2021.6.1,
              any.al ==0.1.4.2,
              any.alarmclock ==0.7.0.5,
              any.alerts ==0.1.2.0,
-             any.alex ==3.2.5,
+             any.alex ==3.2.6,
+             any.alex-meta ==0.3.0.13,
              any.alg ==0.2.13.1,
              any.algebraic-graphs ==0.5,
              any.almost-fix ==0.0.2,
              any.alsa-core ==0.5.0.1,
              any.alsa-mixer ==0.3.0,
              any.alsa-pcm ==0.6.1.1,
-             any.alsa-seq ==0.6.0.7,
+             any.alsa-seq ==0.6.0.8,
              any.alternative-vector ==0.0.0,
              any.amazonka-apigateway ==1.6.1,
              any.amazonka-application-autoscaling ==1.6.1,
@@ -220,154 +230,158 @@ constraints: any.AC-Angle ==1.0,
              any.amazonka-waf ==1.6.1,
              any.amazonka-workspaces ==1.6.1,
              any.amazonka-xray ==1.6.1,
-             any.amqp ==0.20.0,
-             any.amqp-utils ==0.4.4.1,
+             any.amqp ==0.22.0,
+             any.amqp-utils ==0.6.3.2,
              any.annotated-wl-pprint ==0.7.0,
-             any.ansi-terminal ==0.10.3,
+             any.ansi-terminal ==0.11,
              any.ansi-wl-pprint ==0.6.9,
-             any.antiope-core ==7.5.1,
-             any.antiope-dynamodb ==7.5.1,
-             any.antiope-messages ==7.5.1,
-             any.antiope-s3 ==7.5.1,
-             any.antiope-sns ==7.5.1,
-             any.antiope-sqs ==7.5.1,
-             any.apecs ==0.9.2,
+             any.ap-normalize ==0.1.0.1,
+             any.apecs ==0.9.3,
              any.apecs-gloss ==0.2.4,
-             any.apecs-physics ==0.4.4,
+             any.apecs-physics ==0.4.5,
              any.api-field-json-th ==0.1.0.2,
+             any.api-maker ==0.1.0.0,
              any.app-settings ==0.2.0.12,
              any.appar ==0.1.8,
              any.appendmap ==0.1.5,
+             any.apply-refact ==0.9.3.0,
              any.apportionment ==0.0.0.3,
-             any.approximate ==0.3.2,
+             any.approximate ==0.3.5,
+             any.approximate-equality ==1.1.0.2,
              any.arbor-lru-cache ==0.1.1.1,
-             any.arithmoi ==0.10.0.0,
+             any.arithmoi ==0.12.0.1,
              any.array-memoize ==0.6.0,
              any.arrow-extras ==0.1.0.1,
-             any.ascii ==1.0.0.2,
-             any.ascii-case ==1.0.0.2,
-             any.ascii-char ==1.0.0.2,
-             any.ascii-group ==1.0.0.2,
-             any.ascii-predicates ==1.0.0.2,
+             any.arrows ==0.4.4.2,
+             any.ascii ==1.0.1.6,
+             any.ascii-case ==1.0.0.8,
+             any.ascii-char ==1.0.0.12,
+             any.ascii-group ==1.0.0.8,
+             any.ascii-predicates ==1.0.0.6,
              any.ascii-progress ==0.3.3.0,
-             any.ascii-superset ==1.0.0.2,
-             any.ascii-th ==1.0.0.2,
+             any.ascii-superset ==1.0.1.8,
+             any.ascii-th ==1.0.0.6,
              any.asciidiagram ==1.3.3.3,
              any.asn1-encoding ==0.9.6,
              any.asn1-parse ==0.9.5,
              any.asn1-types ==0.3.4,
              any.assert-failure ==0.1.2.5,
              any.assoc ==1.0.2,
-             any.astro ==0.4.2.1,
-             any.async ==2.2.2,
+             any.astro ==0.4.3.0,
+             any.async ==2.2.4,
              any.async-extra ==0.2.0.0,
+             any.async-pool ==0.9.1,
              any.async-refresh ==0.3.0.0,
              any.async-refresh-tokens ==0.4.0.0,
-             any.async-timer ==0.2.0.0,
              any.atom-basic ==0.2.5,
-             any.atomic-primops ==0.8.3,
+             any.atomic-primops ==0.8.4,
              any.atomic-write ==0.2.0.7,
-             any.attoparsec ==0.13.2.4,
+             any.attoparsec ==0.13.2.5,
              any.attoparsec-base64 ==0.0.0,
              any.attoparsec-binary ==0.2,
              any.attoparsec-expr ==0.1.1.2,
-             any.attoparsec-iso8601 ==1.0.1.0,
+             any.attoparsec-iso8601 ==1.0.2.0,
              any.attoparsec-path ==0.0.0.1,
              any.audacity ==0.0.2,
-             any.aur ==7.0.4,
-             any.aura ==3.1.9,
+             any.aur ==7.0.7,
+             any.aura ==3.2.5,
              any.authenticate ==1.3.5,
              any.authenticate-oauth ==1.6.0.1,
-             any.auto ==0.4.3.1,
              any.auto-update ==0.1.6,
-             any.autoexporter ==1.1.18,
-             any.avers ==0.0.17.1,
+             any.autoexporter ==1.1.20,
              any.avro ==0.5.2.0,
-             any.aws-cloudfront-signed-cookies ==0.2.0.6,
-             any.bank-holidays-england ==0.2.0.5,
-             any.base-compat ==0.11.1,
-             any.base-compat-batteries ==0.11.1,
-             any.base-noprelude ==4.13.0.0,
-             any.base-orphans ==0.8.2,
-             any.base-prelude ==1.3,
+             any.aws-cloudfront-signed-cookies ==0.2.0.10,
+             any.aws-xray-client ==0.1.0.1,
+             any.aws-xray-client-wai ==0.1.0.1,
+             any.backprop ==0.2.6.4,
+             any.backtracking ==0.1.0,
+             any.bank-holidays-england ==0.2.0.6,
+             any.barbies ==2.0.3.0,
+             any.base-compat ==0.11.2,
+             any.base-compat-batteries ==0.11.2,
+             any.base-orphans ==0.8.6,
+             any.base-prelude ==1.4,
              any.base-unicode-symbols ==0.2.4.2,
-             any.base16 ==0.2.1.0,
-             any.base16-bytestring ==0.1.1.7,
-             any.base16-lens ==0.1.2.0,
-             any.base32 ==0.1.1.2,
-             any.base32-lens ==0.1.0.0,
+             any.base16 ==0.3.0.2,
+             any.base16-bytestring ==1.0.2.0,
+             any.base16-lens ==0.1.3.2,
+             any.base32 ==0.2.1.0,
+             any.base32-lens ==0.1.1.1,
              any.base32string ==0.9.1,
              any.base58-bytestring ==0.1.0,
              any.base58string ==0.10.0,
-             any.base64 ==0.4.2.2,
-             any.base64-bytestring ==1.0.0.3,
+             any.base64 ==0.4.2.3,
+             any.base64-bytestring ==1.1.0.0,
              any.base64-bytestring-type ==1.0.1,
-             any.base64-lens ==0.3.0,
+             any.base64-lens ==0.3.1,
              any.base64-string ==0.2,
-             any.basement ==0.0.11,
+             any.basement ==0.0.12,
              any.basic-prelude ==0.7.0,
              any.bazel-runfiles ==0.12,
              any.bbdb ==0.8,
+             any.bcp47 ==0.2.0.4,
+             any.bcp47-orphans ==0.1.0.4,
              any.bcrypt ==0.0.11,
-             any.bech32 ==1.0.2,
+             any.bech32 ==1.1.2,
              any.bech32-th ==1.0.2,
              any.bench ==1.0.12,
-             any.benchpress ==0.2.2.14,
+             any.benchpress ==0.2.2.18,
              any.between ==0.11.0.0,
              any.bibtex ==0.1.0.6,
-             any.bifunctors ==5.5.7,
+             any.bifunctors ==5.5.11,
              any.bimap ==0.4.0,
              any.bimap-server ==0.1.0.1,
              any.bimaps ==0.1.0.2,
-             any.bin ==0.1,
+             any.bin ==0.1.1,
              any.binary-conduit ==1.3.1,
              any.binary-ext ==2.0.4,
              any.binary-ieee754 ==0.1.0.0,
+             any.binary-instances ==1.0.2,
              any.binary-list ==1.1.1.2,
              any.binary-orphans ==1.0.1,
-             any.binary-parser ==0.5.6,
+             any.binary-parser ==0.5.7,
              any.binary-parsers ==0.2.4.0,
-             any.binary-search ==1.0.0.3,
+             any.binary-search ==2.0.0,
              any.binary-shared ==0.8.3,
-             any.binary-tagged ==0.3,
+             any.binary-tagged ==0.3.1,
              any.bindings-DSL ==1.0.25,
              any.bindings-GLFW ==3.3.2.0,
              any.bindings-libzip ==1.0.1,
              any.bindings-uname ==0.1,
              any.bins ==0.1.2.0,
              any.bitarray ==0.0.1.1,
-             any.bits ==0.5.2,
+             any.bits ==0.5.3,
              any.bits-extra ==0.0.2.0,
              any.bitset-word8 ==0.1.1.2,
-             any.bitvec ==1.0.3.0,
+             any.bitvec ==1.1.1.0,
+             any.bitwise-enum ==1.0.1.0,
              any.blake2 ==0.3.0,
-             any.blanks ==0.3.0,
+             any.blanks ==0.5.0,
              any.blas-carray ==0.1.0.1,
-             any.blas-comfort-array ==0.0.0.2,
+             any.blas-comfort-array ==0.0.0.3,
              any.blas-ffi ==0.1,
              any.blaze-bootstrap ==0.1.0.1,
-             any.blaze-builder ==0.4.1.0,
+             any.blaze-builder ==0.4.2.2,
              any.blaze-html ==0.9.1.2,
-             any.blaze-markup ==0.8.2.7,
+             any.blaze-markup ==0.8.2.8,
              any.blaze-svg ==0.3.6.1,
-             any.blaze-textual ==0.2.1.0,
+             any.blaze-textual ==0.2.2.1,
              any.bmp ==1.2.6.3,
+             any.board-games ==0.3,
              any.boltzmann-samplers ==0.1.1.0,
              any.boolean-like ==0.1.1.0,
-             any.boolean-normal-forms ==0.0.1.1,
              any.boolsimplifier ==0.1.8,
              any.boots ==0.2.0.1,
              any.bordacount ==0.1.0.0,
-             any.boring ==0.1.3,
-             any.both ==0.1.1.1,
-             any.bound ==2.0.1,
+             any.boring ==0.2,
+             any.both ==0.1.1.2,
+             any.bound ==2.0.4,
              any.bounded-queue ==1.0.0,
              any.boundingboxes ==0.2.3,
              any.bower-json ==1.0.0.1,
              any.boxes ==0.1.5,
              brick +demos,
-             any.brick ==0.52.1,
-             any.brittany ==0.12.1.1,
+             any.brick ==0.62,
              any.broadcast-chan ==0.2.1.1,
              any.bsb-http-chunked ==0.0.0.4,
              bson -_old-network,
@@ -375,65 +389,82 @@ constraints: any.AC-Angle ==1.0,
              any.btrfs ==0.2.0.0,
              any.buffer-builder ==0.2.4.7,
              any.buffer-pipe ==0.0,
-             any.bugsnag-hs ==0.1.0.3,
+             any.bugsnag-haskell ==0.0.4.1,
+             any.bugsnag-hs ==0.2.0.7,
+             any.bugzilla-redhat ==0.3.3,
+             any.burrito ==1.2.0.3,
              any.butcher ==1.3.3.2,
+             any.buttplug-hs-core ==0.1.0.1,
              any.bv ==0.5,
              any.bv-little ==1.1.1,
-             any.byte-count-reader ==0.10.1.1,
+             any.byte-count-reader ==0.10.1.7,
              any.byte-order ==0.1.2.0,
              any.byteable ==0.1.1,
              any.bytedump ==1.0,
              any.byteorder ==1.0.4,
-             any.bytes ==0.17,
+             any.bytes ==0.17.1,
              any.byteset ==0.1.1.0,
              any.bytestring-builder ==0.10.8.2.0,
              any.bytestring-conversion ==0.3.1,
-             any.bytestring-lexing ==0.5.0.2,
+             any.bytestring-lexing ==0.5.0.8,
              any.bytestring-mmap ==0.2.2,
-             any.bytestring-strict-builder ==0.4.5.3,
+             any.bytestring-strict-builder ==0.4.5.4,
              any.bytestring-to-vector ==0.3.0.1,
-             any.bytestring-tree-builder ==0.2.7.3,
-             any.bz2 ==1.0.0.1,
+             any.bytestring-tree-builder ==0.2.7.9,
+             bz2 -with-bzlib,
+             any.bz2 ==1.0.1.0,
+             any.bzlib ==0.5.1.0,
              any.bzlib-conduit ==0.3.0.2,
-             any.c2hs ==0.28.6,
+             any.c-enum ==0.1.0.1,
+             any.c-struct ==0.1.0.1,
+             any.c14n ==0.1.0.1,
+             any.c2hs ==0.28.8,
              any.ca-province-codes ==1.0.0.0,
-             any.cabal-appimage ==0.3.0.0,
-             any.cabal-debian ==5.0.3,
-             any.cabal-doctest ==1.0.8,
+             any.cabal-appimage ==0.3.0.3,
+             any.cabal-clean ==0.1.20210924,
+             any.cabal-debian ==5.1,
+             any.cabal-doctest ==1.0.9,
+             any.cabal-file ==0.1.1,
+             any.cabal-flatpak ==0.1.0.2,
+             any.cabal-plan ==0.7.2.0,
              cabal-rpm -old-locale,
-             any.cabal-rpm ==2.0.6,
-             any.cabal2nix ==2.15.1,
-             any.cabal2spec ==2.5,
+             any.cabal-rpm ==2.0.10,
+             any.cabal2nix ==2.17.0,
+             any.cabal2spec ==2.6.2,
              any.cache ==0.1.3.0,
+             any.cached-json-file ==0.1.0,
              any.cacophony ==0.10.1,
              any.calendar-recycling ==0.0.0.1,
-             any.call-stack ==0.2.0,
+             any.call-stack ==0.3.0,
              any.can-i-haz ==0.3.1.0,
+             any.capability ==0.4.0.0,
              any.cardano-coin-selection ==1.0.1,
              any.carray ==0.1.6.8,
              any.casa-client ==0.0.1,
-             any.casa-types ==0.0.1,
+             any.casa-types ==0.0.2,
              any.case-insensitive ==1.2.1.0,
              any.cased ==0.1.0.0,
-             any.cases ==0.1.4,
+             any.cases ==0.1.4.1,
              any.casing ==0.1.4.1,
              cassava -bytestring--lt-0_10_4,
              any.cassava ==0.5.2.0,
-             any.cassava-conduit ==0.5.1,
-             any.cassava-megaparsec ==2.0.2,
+             any.cassava-conduit ==0.6.0,
+             any.cassava-megaparsec ==2.0.4,
              any.cast ==0.1.0.2,
              any.category ==0.2.5.0,
-             any.cayley-client ==0.4.13,
-             any.cborg ==0.2.4.0,
-             any.cborg-json ==0.2.2.0,
-             any.cereal ==0.5.8.1,
+             any.cayley-client ==0.4.16,
+             any.cborg ==0.2.6.0,
+             any.cborg-json ==0.2.3.0,
+             any.cdar-mBound ==0.1.0.4,
+             any.cereal ==0.5.8.2,
              any.cereal-conduit ==0.8.0,
              any.cereal-text ==0.1.0.2,
              any.cereal-vector ==0.2.0.1,
              any.cfenv ==0.1.0.0,
+             any.cgi ==3001.5.0.0,
              any.chan ==0.0.4.1,
-             any.character-cases ==0.1.0.4,
-             any.charset ==0.3.7.1,
+             any.character-cases ==0.1.0.6,
+             any.charset ==0.3.9,
              any.charsetdetect-ae ==1.1.0.4,
              any.chaselev-deque ==0.5.0.5,
              any.cheapskate ==0.1.1.2,
@@ -441,8 +472,8 @@ constraints: any.AC-Angle ==1.0,
              any.cheapskate-lucid ==0.1.0.0,
              any.checkers ==0.5.6,
              any.checksum ==0.0,
-             any.chimera ==0.3.1.0,
-             any.chiphunk ==0.1.2.1,
+             any.chimera ==0.3.2.0,
+             any.chiphunk ==0.1.4.0,
              any.choice ==0.2.2,
              any.chronologique ==0.3.1.3,
              any.chronos ==1.1.1,
@@ -453,100 +484,105 @@ constraints: any.AC-Angle ==1.0,
              any.cipher-des ==0.0.6,
              any.cipher-rc4 ==0.1.4,
              any.circle-packing ==0.1.0.6,
-             any.clash-ghc ==1.2.4,
-             any.clash-lib ==1.2.4,
-             any.clash-prelude ==1.2.4,
+             any.circular ==0.4.0.1,
+             any.citeproc ==0.4.0.1,
+             any.clash-ghc ==1.4.6,
+             any.clash-lib ==1.4.6,
+             any.clash-prelude ==1.4.6,
              any.classy-prelude ==1.5.0,
              any.classy-prelude-conduit ==1.5.0,
-             any.classy-prelude-yesod ==1.5.0,
              any.clay ==0.13.3,
              any.clientsession ==0.9.1.2,
              any.climb ==0.3.3,
-             any.clock ==0.8,
-             any.clock-extras ==0.1.0.2,
+             any.clock ==0.8.2,
+             any.closed ==0.2.0.1,
              any.clumpiness ==0.17.0.2,
              any.cmark ==0.6,
-             any.cmark-gfm ==0.2.1,
+             any.cmark-gfm ==0.2.2,
              any.cmark-lucid ==0.1.0.0,
-             any.cmdargs ==0.10.20,
-             any.co-log ==0.4.0.1,
-             any.co-log-concurrent ==0.5.0.0,
+             any.cmdargs ==0.10.21,
+             any.co-log-concurrent ==0.5.1.0,
              any.co-log-core ==0.2.1.1,
-             any.co-log-polysemy ==0.0.1.2,
-             any.code-page ==0.2,
+             any.code-page ==0.2.1,
              any.codec-beam ==0.2.0,
-             any.codec-rpm ==0.2.2,
-             any.coercible-utils ==0.1.0,
+             any.collect-errors ==0.1.5.0,
              any.colorful-monoids ==0.2.1.3,
              any.colorize-haskell ==1.0.1,
-             any.colour ==2.3.5,
-             any.colourista ==0.1.0.0,
+             any.colour ==2.3.6,
              any.combinatorial ==0.1.0.1,
-             any.comfort-array ==0.4,
+             any.comfort-array ==0.4.1,
              any.comfort-graph ==0.0.3.1,
+             any.commonmark ==0.2.1.1,
+             any.commonmark-extensions ==0.2.2.1,
+             any.commonmark-pandoc ==0.2.1.1,
              any.commutative ==0.0.2,
-             any.comonad ==5.0.6,
+             any.comonad ==5.0.8,
+             any.comonad-extras ==4.0.1,
              any.compactmap ==0.1.4.2.1,
-             any.compensated ==0.8.1,
+             any.compdata ==0.12.1,
+             any.compensated ==0.8.3,
              any.compiler-warnings ==0.1.0,
              any.composable-associations ==0.1.0.0,
-             any.composable-associations-aeson ==0.1.0.0,
-             any.composition ==1.0.2.1,
+             any.composable-associations-aeson ==0.1.0.1,
+             any.composition ==1.0.2.2,
              any.composition-extra ==2.0.0,
              any.concise ==0.1.0.1,
-             any.concurrency ==1.11.0.0,
+             any.concurrency ==1.11.0.2,
              any.concurrent-extra ==0.7.0.12,
              any.concurrent-output ==1.10.12,
              any.concurrent-split ==0.0.1.1,
              any.concurrent-supply ==0.1.8,
              any.cond ==0.4.1.1,
-             any.conduit ==1.3.2.1,
+             any.conduino ==0.2.2.0,
+             any.conduit ==1.3.4.2,
              any.conduit-algorithms ==0.0.11.0,
              any.conduit-combinators ==1.3.0,
              any.conduit-concurrent-map ==0.1.1,
              any.conduit-extra ==1.3.5,
              any.conduit-parse ==0.2.1.0,
              any.conduit-zstd ==0.0.2.0,
-             any.conferer ==0.4.1.1,
-             any.conferer-hspec ==0.4.0.1,
-             any.conferer-source-json ==0.4.0.1,
-             any.conferer-warp ==0.4.0.1,
+             any.conferer ==1.1.0.0,
+             any.conferer-aeson ==1.1.0.1,
+             any.conferer-hspec ==1.1.0.0,
+             any.conferer-warp ==1.1.0.0,
              any.config-ini ==0.2.4.0,
              any.configurator ==0.3.0.0,
              any.configurator-export ==0.1.0.1,
-             any.configurator-pg ==0.2.4,
+             any.configurator-pg ==0.2.5,
              any.connection ==0.3.1,
              any.connection-pool ==0.2.2,
              any.console-style ==0.0.2.1,
              any.constraint ==0.1.4.0,
              any.constraint-tuples ==0.1.2,
-             any.constraints ==0.12,
-             any.contravariant ==1.5.2,
-             any.contravariant-extras ==0.3.5.2,
+             any.constraints ==0.13.2,
+             any.constraints-extras ==0.3.2.0,
+             any.construct ==0.3.0.2,
+             any.contravariant ==1.5.5,
+             any.contravariant-extras ==0.3.5.3,
              any.control-bool ==0.2.1,
+             any.control-dsl ==0.2.1.3,
              any.control-monad-free ==0.6.2,
              any.control-monad-omega ==0.3.2,
              any.convertible ==1.1.1.0,
              any.cookie ==0.4.5,
-             any.core-data ==0.2.1.8,
-             any.core-program ==0.2.4.5,
-             any.core-text ==0.2.3.6,
+             any.core-data ==0.2.1.11,
+             any.core-program ==0.2.12.0,
+             any.core-text ==0.3.5.0,
              any.countable ==1.0,
-             any.cpio-conduit ==0.7.0,
+             any.country ==0.2.1,
              any.cpphs ==1.20.9.1,
              any.cprng-aes ==0.6.1,
              any.cpu ==0.1.2,
-             any.cpuinfo ==0.1.0.1,
-             any.cql ==4.0.2,
+             any.cpuinfo ==0.1.0.2,
+             any.cql ==4.0.3,
              any.cql-io ==1.1.1,
              any.cql-io-tinylog ==0.1.0,
-             any.crackNum ==2.3,
+             any.crackNum ==3.1,
              any.crc32c ==0.0.0,
              any.credential-store ==0.1.2,
-             any.criterion ==1.5.6.2,
-             any.criterion-measurement ==0.1.2.0,
+             any.criterion ==1.5.11.0,
+             any.criterion-measurement ==0.1.3.0,
              any.cron ==0.7.0,
-             any.crypt-sha512 ==0,
              any.crypto-api ==0.13.3,
              any.crypto-cipher-types ==0.0.9,
              any.crypto-enigma ==0.1.1.6,
@@ -555,21 +591,19 @@ constraints: any.AC-Angle ==1.0,
              any.crypto-pubkey-types ==0.4.3,
              any.crypto-random ==0.0.9,
              any.crypto-random-api ==0.2.0,
-             any.cryptocompare ==0.1.1,
              any.cryptohash ==0.11.9,
              any.cryptohash-cryptoapi ==0.1.4,
-             any.cryptohash-md5 ==0.11.100.1,
-             any.cryptohash-sha1 ==0.11.100.1,
-             any.cryptohash-sha256 ==0.11.101.0,
-             any.cryptohash-sha512 ==0.11.100.1,
-             any.cryptonite ==0.28,
+             any.cryptohash-md5 ==0.11.101.0,
+             any.cryptohash-sha1 ==0.11.101.0,
+             any.cryptohash-sha256 ==0.11.102.1,
+             any.cryptohash-sha512 ==0.11.101.0,
+             any.cryptonite ==0.29,
              any.cryptonite-conduit ==0.2.2,
              any.cryptonite-openssl ==0.7,
              any.csp ==1.4.0,
              any.css-syntax ==0.1.0.0,
              any.css-text ==0.1.3.0,
              any.csv ==0.1.2,
-             any.csv-conduit ==0.7.1.0,
              any.ctrie ==0.2,
              any.cubicbezier ==0.6.0.6,
              any.cubicspline ==0.1.2,
@@ -586,17 +620,18 @@ constraints: any.AC-Angle ==1.0,
              any.cursor-gen ==0.3.0.0,
              any.cutter ==0.0,
              any.cyclotomic ==1.1.1,
-             any.czipwith ==1.0.1.3,
+             any.czipwith ==1.0.1.4,
              any.d10 ==0.2.1.6,
              any.data-accessor ==0.2.3,
              any.data-accessor-mtl ==0.2.0.4,
+             any.data-accessor-template ==0.2.1.16,
              any.data-accessor-transformers ==0.2.1.7,
-             any.data-ascii ==1.0.0.2,
+             any.data-ascii ==1.0.0.6,
              any.data-binary-ieee754 ==0.4.4,
              any.data-bword ==0.1.0.1,
              any.data-checked ==0.3,
              any.data-clist ==0.1.2.3,
-             any.data-compat ==0.1.0.2,
+             any.data-compat ==0.1.0.3,
              any.data-default ==0.7.1.1,
              any.data-default-class ==0.1.2.0,
              any.data-default-instances-containers ==0.0.1,
@@ -605,112 +640,114 @@ constraints: any.AC-Angle ==1.0,
              any.data-diverse ==4.7.0.0,
              any.data-dword ==0.3.2,
              any.data-endian ==0.1.1,
-             any.data-fix ==0.2.1,
-             any.data-forest ==0.1.0.8,
-             any.data-has ==0.3.0.0,
-             any.data-interval ==2.0.1,
+             any.data-fix ==0.3.2,
+             any.data-forest ==0.1.0.9,
+             any.data-has ==0.4.0.0,
+             any.data-hash ==0.2.0.1,
+             any.data-interval ==2.1.1,
              any.data-inttrie ==0.1.4,
-             any.data-lens-light ==0.1.2.2,
+             any.data-lens-light ==0.1.2.3,
              any.data-memocombinators ==0.5.1,
              any.data-msgpack ==0.0.13,
              any.data-msgpack-types ==0.0.3,
-             any.data-or ==1.0.0.5,
+             any.data-or ==1.0.0.7,
              any.data-ordlist ==0.4.7.0,
              any.data-ref ==0.0.2,
-             any.data-reify ==0.6.1,
-             any.data-serializer ==0.3.4.1,
+             any.data-reify ==0.6.3,
+             any.data-serializer ==0.3.5,
              any.data-textual ==0.3.0.3,
              any.data-timeout ==0.3.1,
-             any.data-tree-print ==0.1.0.2,
              any.datadog ==0.2.5.0,
              any.dataurl ==0.1.0.0,
-             any.dbus ==1.2.16,
+             any.dbus ==1.2.17,
              any.dbus-hslogger ==0.1.0.1,
              any.debian ==4.0.2,
-             any.debian-build ==0.10.2.0,
+             any.debian-build ==0.10.2.1,
              any.debug-trace-var ==0.2.0,
-             any.dec ==0.0.3,
-             any.declarative ==0.5.3,
+             any.dec ==0.0.4,
+             any.declarative ==0.5.4,
              any.deepseq-generics ==0.2.0.0,
              any.deepseq-instances ==0.1.0.1,
-             any.deferred-folds ==0.9.10.1,
-             any.dejafu ==2.3.0.1,
+             any.deferred-folds ==0.9.17,
+             any.dejafu ==2.4.0.3,
              any.dense-linear-algebra ==0.1.0.0,
-             any.depq ==0.4.1.0,
-             any.deque ==0.4.3,
+             any.dependent-map ==0.4.0.0,
+             any.dependent-sum ==0.7.1.0,
+             any.dependent-sum-template ==0.1.0.3,
+             any.depq ==0.4.2,
+             any.deque ==0.4.4,
+             any.derive-topdown ==0.0.2.2,
              any.deriveJsonNoPrefix ==0.1.0.1,
              any.deriving-aeson ==0.2.5,
-             any.deriving-compat ==0.5.9,
-             any.derulo ==1.0.9,
-             any.detour-via-sci ==1.0.0,
-             any.dhall ==1.32.0,
-             any.dhall-bash ==1.0.30,
-             any.dhall-json ==1.6.4,
-             any.dhall-lsp-server ==1.0.8,
-             any.dhall-yaml ==1.1.0,
+             any.deriving-compat ==0.5.10,
+             any.derulo ==1.0.10,
+             any.dhall ==1.39.0,
+             any.dhall-bash ==1.0.37,
+             any.dhall-json ==1.7.7,
+             any.dhall-lsp-server ==1.0.16,
+             any.dhall-yaml ==1.2.7,
              any.di-core ==1.0.4,
              any.di-monad ==1.3.1,
-             any.diagrams ==1.4,
-             any.diagrams-contrib ==1.4.4,
-             any.diagrams-core ==1.4.2,
-             any.diagrams-lib ==1.4.3,
-             any.diagrams-postscript ==1.5,
-             any.diagrams-rasterific ==1.4.2,
-             any.diagrams-solve ==0.1.2,
-             any.diagrams-svg ==1.4.3,
-             any.dialogflow-fulfillment ==0.1.1.3,
+             any.diagrams-solve ==0.1.3,
+             any.dialogflow-fulfillment ==0.1.1.4,
              any.dictionary-sharing ==0.1.0.0,
-             any.digest ==0.0.1.2,
+             any.digest ==0.0.1.3,
              any.digits ==0.3.1,
-             any.dimensional ==1.3,
+             any.dimensional ==1.4,
+             any.direct-sqlite ==2.3.26,
              any.directory-tree ==0.12.1,
+             any.dirichlet ==0.1.0.5,
              any.discount ==0.1.1,
              any.disk-free-space ==0.1.0.1,
              any.distributed-closure ==0.4.2.0,
-             any.distribution-nixpkgs ==1.3.1,
+             any.distribution-nixpkgs ==1.5.0,
              any.distribution-opensuse ==1.1.1,
-             any.distributive ==0.6.2,
-             any.dl-fedora ==0.7.5,
-             any.dlist ==0.8.0.8,
+             any.distributive ==0.6.2.1,
+             any.dl-fedora ==0.9.2,
+             any.dlist ==1.0,
              any.dlist-instances ==0.1.1.1,
              any.dlist-nonempty ==0.1.1,
              any.dns ==4.0.1,
              any.do-list ==1.0.1,
              any.do-notation ==0.1.0.2,
              any.dockerfile ==0.2.0,
-             any.doclayout ==0.3,
-             any.doctemplates ==0.8.2,
-             any.doctest ==0.16.3,
+             any.doclayout ==0.3.1.1,
+             any.doctemplates ==0.9,
+             any.doctest ==0.17,
              any.doctest-discover ==0.2.0.0,
-             any.doctest-driver-gen ==0.3.0.2,
+             any.doctest-driver-gen ==0.3.0.5,
+             any.doctest-exitcode-stdio ==0.0,
+             any.doctest-extract ==0.1,
+             any.doctest-lib ==0.1,
              any.doldol ==0.4.1.2,
+             any.dot ==0.3,
              any.dotenv ==0.8.0.7,
              any.dotgen ==0.4.3,
              any.dotnet-timespan ==0.0.1.0,
              any.double-conversion ==2.0.2.0,
              any.download ==0.3.2.7,
+             any.download-curl ==0.1.4,
              any.drinkery ==0.4,
              any.dsp ==0.2.5.1,
              any.dual ==0.1.1.1,
-             any.dual-tree ==0.2.2.1,
              any.dublincore-xml-conduit ==0.1.0.2,
              any.dunai ==0.7.0,
-             any.duration ==0.1.0.0,
+             any.duration ==0.2.0.0,
              any.dvorak ==0.1.0.0,
              any.dynamic-state ==0.3.1,
-             any.dyre ==0.8.12,
+             any.dyre ==0.9.1,
              any.eap ==0.9.0.2,
              any.earcut ==0.1.0.4,
              any.easy-file ==0.2.2,
-             any.echo ==0.1.3,
+             any.echo ==0.1.4,
              any.ecstasy ==0.2.1.0,
              any.ed25519 ==0.0.5.0,
              any.edit-distance ==0.2.2.1,
              any.edit-distance-vector ==1.0.0.4,
              any.editor-open ==0.6.0.0,
-             any.egison ==4.0.3,
-             any.egison-pattern-src ==0.2.1.0,
-             any.egison-pattern-src-th-mode ==0.2.1.1,
+             any.egison ==4.1.2,
+             any.egison-pattern-src ==0.2.1.2,
+             any.egison-pattern-src-th-mode ==0.2.1.2,
              any.either ==5.0.1.1,
              any.either-both ==0.1.1.1,
              any.either-unwrap ==1.1,
@@ -720,121 +757,139 @@ constraints: any.AC-Angle ==1.0,
              any.ekg-statsd ==0.2.5.0,
              any.elerea ==2.9.0,
              any.elf ==0.30,
-             any.eliminators ==0.6,
+             any.eliminators ==0.7,
              any.elm-bridge ==0.6.1,
              any.elm-core-sources ==1.0.0,
              any.elm-export ==0.6.0.1,
-             any.elm2nix ==0.2,
-             any.emacs-module ==0.1.1,
-             any.email-validate ==2.3.2.13,
-             any.emojis ==0.1,
+             any.elm2nix ==0.2.1,
+             any.elynx ==0.5.1.1,
+             any.elynx-markov ==0.5.1.1,
+             any.elynx-nexus ==0.5.1.1,
+             any.elynx-seq ==0.5.1.1,
+             any.elynx-tools ==0.5.1.1,
+             any.elynx-tree ==0.5.1.1,
+             any.email-validate ==2.3.2.15,
+             any.emd ==0.2.0.0,
+             any.emojis ==0.1.2,
              any.enclosed-exceptions ==1.0.3,
-             any.entropy ==0.4.1.6,
+             any.entropy ==0.4.1.7,
              any.enum-subset-generate ==0.1.0.0,
              any.enummapset ==0.6.0.3,
              any.enumset ==0.0.5,
              any.envelope ==0.2.2.0,
+             any.envparse ==0.4.1,
              any.envy ==2.1.0.0,
              any.epub-metadata ==4.5,
-             any.eq ==4.2,
+             any.eq ==4.2.1,
              any.equal-files ==0.0.5.3,
-             any.equational-reasoning ==0.6.0.3,
+             any.equational-reasoning ==0.7.0.1,
+             any.equivalence ==0.3.5,
              any.erf ==2.0.0.0,
+             any.error-or ==0.1.2.0,
+             any.error-or-utils ==0.1.1,
              any.errors ==2.3.0,
              any.errors-ext ==0.4.2,
-             any.ersatz ==0.4.8,
-             any.esqueleto ==3.3.3.3,
-             any.essence-of-live-coding ==0.1.0.3,
-             any.essence-of-live-coding-gloss ==0.1.0.3,
-             any.essence-of-live-coding-pulse ==0.1.0.3,
-             any.essence-of-live-coding-quickcheck ==0.1.0.3,
+             any.ersatz ==0.4.10,
+             any.esqueleto ==3.5.3.0,
+             any.essence-of-live-coding ==0.2.5,
+             any.essence-of-live-coding-gloss ==0.2.5,
+             any.essence-of-live-coding-pulse ==0.2.5,
+             any.essence-of-live-coding-quickcheck ==0.2.5,
              any.etc ==0.4.1.0,
+             any.eve ==0.1.9.0,
              any.event-list ==0.1.2,
              any.eventful-core ==0.2.0,
              any.eventful-test-helpers ==0.2.0,
              any.eventstore ==1.4.1,
              any.every ==0.0.1,
-             any.exact-combinatorics ==0.2.0.9,
+             any.exact-combinatorics ==0.2.0.11,
              any.exact-pi ==0.5.0.1,
-             any.exception-hierarchy ==0.1.0.3,
+             any.exception-hierarchy ==0.1.0.4,
              any.exception-mtl ==0.4.0.1,
-             any.exception-transformers ==0.4.0.9,
+             any.exception-transformers ==0.4.0.10,
+             any.exception-via ==0.1.0.0,
              any.exceptions ==0.10.4,
              any.executable-path ==0.0.3.1,
              any.exit-codes ==1.0.0,
              any.exomizer ==1.0.0,
-             any.exp-pairs ==0.2.0.0,
+             any.exp-pairs ==0.2.1.0,
+             any.experimenter ==0.1.0.12,
              any.expiring-cache-map ==0.0.6.1,
              any.explicit-exception ==0.1.10,
-             any.express ==0.1.3,
+             any.express ==0.1.16,
              any.extended-reals ==0.2.4.0,
              any.extensible-effects ==5.0.0.1,
              any.extensible-exceptions ==0.1.1.4,
-             any.extra ==1.7.8,
+             any.extra ==1.7.9,
              any.extractable-singleton ==0.0.1,
-             any.extrapolate ==0.4.2,
+             any.extrapolate ==0.4.6,
              any.fail ==4.9.0.0,
              any.failable ==1.2.4.0,
-             any.fakedata ==0.6.1,
-             any.farmhash ==0.1.0.5,
-             any.fast-digits ==0.3.0.0,
-             any.fast-logger ==3.0.1,
+             any.fakedata ==0.8.0,
+             any.fakedata-parser ==0.1.0.0,
+             any.fakefs ==0.3.0.2,
+             any.fakepull ==0.3.0.2,
+             any.faktory ==1.0.3.1,
+             any.fast-digits ==0.3.1.0,
+             any.fast-logger ==3.0.5,
              any.fast-math ==1.0.2,
              any.fb ==2.1.1,
+             any.fclabels ==2.0.5.1,
              any.feature-flags ==0.1.0.1,
              any.fedora-dists ==1.1.2,
              any.fedora-haskell-tools ==0.9,
-             any.feed ==1.3.0.1,
-             any.fft ==0.1.8.6,
+             any.feed ==1.3.2.0,
+             any.fft ==0.1.8.7,
              any.fgl ==5.7.0.3,
-             any.file-embed ==0.0.11.2,
+             any.file-embed ==0.0.15.0,
              any.file-embed-lzma ==0,
-             any.file-modules ==0.1.2.4,
              any.file-path-th ==0.1.0.0,
-             any.filecache ==0.4.1,
              any.filelock ==0.1.1.5,
              any.filemanip ==0.3.6.3,
+             any.filepath-bytestring ==1.4.2.1.8,
              any.filepattern ==0.1.2,
              any.fileplow ==0.1.0.0,
              any.filtrable ==0.1.4.0,
-             any.fin ==0.1.1,
+             any.fin ==0.2,
              any.fingertree ==0.1.4.2,
              any.finite-typelits ==0.1.4.2,
-             any.first-class-families ==0.8.0.0,
+             any.first-class-families ==0.8.0.1,
              any.first-class-patterns ==0.3.2.5,
-             any.fitspec ==0.4.8,
+             any.fitspec ==0.4.10,
+             any.fix-whitespace ==0.0.7,
              any.fixed ==0.3,
-             any.fixed-length ==0.2.2,
+             any.fixed-length ==0.2.3,
              any.fixed-vector ==1.2.0.0,
-             any.fixed-vector-hetero ==0.6.0.0,
+             any.fixed-vector-hetero ==0.6.1.1,
              any.flac ==0.2.0,
              any.flac-picture ==0.1.2,
-             any.flags-applicative ==0.1.0.2,
+             any.flags-applicative ==0.1.0.3,
              any.flat ==0.4.4,
-             any.flat-mcmc ==1.5.1,
+             any.flat-mcmc ==1.5.2,
+             any.flexible-defaults ==0.0.3,
              any.floatshow ==0.2.4,
-             any.flow ==1.0.21,
+             any.flow ==1.0.22,
              any.flush-queue ==1.0.0,
              any.fmlist ==0.9.4,
-             any.fmt ==0.6.1.2,
+             any.fmt ==0.6.3.0,
              any.fn ==0.3.0.2,
-             any.focus ==1.0.1.3,
+             any.focus ==1.0.3,
              any.focuslist ==0.1.0.2,
              any.fold-debounce ==0.2.0.9,
-             any.fold-debounce-conduit ==0.2.0.5,
+             any.fold-debounce-conduit ==0.2.0.6,
              any.foldable1 ==0.1.0.0,
-             any.foldl ==1.4.6,
-             any.folds ==0.7.5,
+             any.foldl ==1.4.12,
+             any.folds ==0.7.7,
              any.follow-file ==0.0.3,
-             any.force-layout ==0.4.0.6,
              any.foreign-store ==0.2,
              any.forkable-monad ==0.2.0.3,
              any.forma ==1.1.3,
              any.format-numbers ==0.1.0.1,
-             any.formatting ==6.3.7,
-             any.foundation ==0.0.25,
-             any.free ==5.1.3,
-             any.free-categories ==0.2.0.0,
+             any.formatting ==7.1.3,
+             any.foundation ==0.0.26.1,
+             any.fourmolu ==0.3.0.0,
+             any.free ==5.1.7,
+             any.free-categories ==0.2.0.2,
              any.free-vl ==0.1.4,
              any.freenect ==1.2.1,
              any.freer-simple ==1.2.1.1,
@@ -849,34 +904,39 @@ constraints: any.AC-Angle ==1.0,
              any.funcmp ==1.9,
              any.function-builder ==0.3.0.1,
              functor-classes-compat +containers,
-             any.functor-classes-compat ==1,
-             any.fused-effects ==1.0.2.2,
-             any.fusion-plugin ==0.2.1,
+             any.functor-classes-compat ==1.0.1,
+             any.functor-combinators ==0.3.6.0,
+             any.fusion-plugin ==0.2.3,
              any.fusion-plugin-types ==0.1.0,
              any.fuzzcheck ==0.1.1,
-             any.fuzzy ==0.1.0.0,
+             any.fuzzy ==0.1.0.1,
              any.fuzzy-dates ==0.1.1.2,
              any.fuzzy-time ==0.1.0.0,
-             any.fuzzyset ==0.2.0,
+             any.fuzzyset ==0.2.2,
              any.gauge ==0.2.5,
              any.gd ==3000.7.3,
              any.gdp ==0.0.3.0,
              any.general-games ==1.1.1,
+             any.generic-aeson ==0.2.0.13,
              any.generic-arbitrary ==0.1.0,
              any.generic-constraints ==1.1.1.1,
-             any.generic-data ==0.8.3.0,
-             any.generic-deriving ==1.13.1,
-             any.generic-lens ==2.0.0.0,
-             any.generic-lens-core ==2.0.0.0,
+             any.generic-data ==0.9.2.1,
+             any.generic-data-surgery ==0.3.0.0,
+             any.generic-deriving ==1.14.1,
+             any.generic-functor ==0.2.0.0,
+             any.generic-lens ==2.1.0.0,
+             any.generic-lens-core ==2.1.0.0,
              any.generic-monoid ==0.1.0.1,
-             any.generic-optics ==2.0.0.0,
-             any.generic-random ==1.3.0.1,
-             any.generics-sop ==0.5.1.0,
+             any.generic-optics ==2.1.0.0,
+             any.generic-random ==1.4.0.0,
+             any.generics-eot ==0.4.0.1,
+             any.generics-sop ==0.5.1.1,
              any.generics-sop-lens ==0.2.0.1,
-             any.genvalidity ==0.11.0.0,
+             any.geniplate-mirror ==0.7.8,
+             any.genvalidity ==0.11.0.2,
              any.genvalidity-aeson ==0.3.0.0,
              any.genvalidity-bytestring ==0.6.0.0,
-             any.genvalidity-containers ==0.8.0.2,
+             any.genvalidity-containers ==0.9.0.0,
              any.genvalidity-criterion ==0.2.0.0,
              any.genvalidity-hspec ==0.7.0.4,
              any.genvalidity-hspec-aeson ==0.3.1.1,
@@ -888,261 +948,286 @@ constraints: any.AC-Angle ==1.0,
              any.genvalidity-mergeful ==0.2.0.0,
              any.genvalidity-mergeless ==0.2.0.0,
              any.genvalidity-path ==0.3.0.4,
+             any.genvalidity-persistent ==0.0.0.0,
              any.genvalidity-property ==0.5.0.1,
              any.genvalidity-scientific ==0.2.1.1,
+             any.genvalidity-sydtest ==0.0.0.0,
+             any.genvalidity-sydtest-aeson ==0.0.0.0,
+             any.genvalidity-sydtest-hashable ==0.0.0.0,
+             any.genvalidity-sydtest-lens ==0.0.0.0,
+             any.genvalidity-sydtest-persistent ==0.0.0.1,
              any.genvalidity-text ==0.7.0.2,
              any.genvalidity-time ==0.3.0.0,
              any.genvalidity-typed-uuid ==0.0.0.2,
              any.genvalidity-unordered-containers ==0.3.0.1,
              any.genvalidity-uuid ==0.1.0.4,
              any.genvalidity-vector ==0.3.0.1,
-             any.geoip2 ==0.4.0.1,
+             any.geoip2 ==0.4.1.0,
              any.geojson ==4.0.2,
              any.getopt-generics ==0.13.0.4,
              any.ghc-byteorder ==4.11.0.0.10,
-             any.ghc-check ==0.5.0.1,
-             any.ghc-compact ==0.1.0.0,
+             any.ghc-check ==0.5.0.6,
              any.ghc-core ==0.5.6,
-             any.ghc-events ==0.13.0,
-             any.ghc-exactprint ==0.6.2,
-             any.ghc-lib ==8.10.2.20200808,
+             any.ghc-events ==0.17.0,
+             any.ghc-exactprint ==0.6.4,
+             any.ghc-lib ==8.10.7.20210828,
              any.ghc-lib-parser ==8.10.1.20200412,
-             any.ghc-lib-parser-ex ==8.10.0.16,
-             any.ghc-parser ==0.2.2.0,
+             any.ghc-lib-parser-ex ==8.10.0.23,
+             any.ghc-parser ==0.2.3.0,
              any.ghc-paths ==0.1.0.12,
-             any.ghc-prof ==1.4.1.7,
-             any.ghc-source-gen ==0.4.0.0,
+             any.ghc-prof ==1.4.1.9,
+             any.ghc-source-gen ==0.4.2.0,
              any.ghc-syntax-highlighter ==0.0.6.0,
-             any.ghc-tcplugins-extra ==0.4,
-             any.ghc-typelits-extra ==0.4,
-             any.ghc-typelits-knownnat ==0.7.3,
-             any.ghc-typelits-natnormalise ==0.7.2,
-             any.ghc-typelits-presburger ==0.3.0.1,
+             any.ghc-tcplugins-extra ==0.4.2,
+             any.ghc-trace-events ==0.1.2.3,
+             any.ghc-typelits-extra ==0.4.3,
+             any.ghc-typelits-knownnat ==0.7.6,
+             any.ghc-typelits-natnormalise ==0.7.6,
+             any.ghc-typelits-presburger ==0.6.1.0,
              any.ghci-hexcalc ==0.1.1.0,
              any.ghcid ==0.8.7,
              any.ghcjs-codemirror ==0.0.0.2,
              any.ghost-buster ==0.1.1.0,
-             any.gi-atk ==2.0.21,
-             any.gi-cairo ==1.0.23,
-             any.gi-cairo-connector ==0.0.1,
-             any.gi-cairo-render ==0.0.1,
-             any.gi-dbusmenu ==0.4.7,
-             any.gi-dbusmenugtk3 ==0.4.8,
-             any.gi-gdk ==3.0.22,
-             any.gi-gdkpixbuf ==2.0.23,
-             any.gi-gdkx11 ==3.0.9,
-             any.gi-gio ==2.0.26,
-             any.gi-glib ==2.0.23,
-             any.gi-gobject ==2.0.22,
-             any.gi-graphene ==1.0.1,
-             any.gi-gtk ==3.0.33,
-             any.gi-gtk-hs ==0.3.8.1,
-             any.gi-pango ==1.0.22,
-             any.gi-xlib ==2.0.8,
+             any.gi-atk ==2.0.23,
+             any.gi-cairo ==1.0.25,
+             any.gi-dbusmenu ==0.4.9,
+             any.gi-dbusmenugtk3 ==0.4.10,
+             any.gi-gdk ==3.0.24,
+             any.gi-gdkpixbuf ==2.0.26,
+             any.gi-gdkx11 ==3.0.11,
+             any.gi-gio ==2.0.28,
+             any.gi-glib ==2.0.25,
+             any.gi-gmodule ==2.0.1,
+             any.gi-gobject ==2.0.26,
+             any.gi-graphene ==1.0.3,
+             any.gi-gtk ==3.0.37,
+             any.gi-gtk-hs ==0.3.11,
+             any.gi-harfbuzz ==0.0.4,
+             any.gi-pango ==1.0.24,
+             any.gi-xlib ==2.0.10,
              any.ginger ==0.10.1.0,
              any.gingersnap ==0.3.1.0,
-             any.giphy-api ==0.7.0.0,
-             any.githash ==0.1.4.0,
+             any.githash ==0.1.6.2,
+             any.github-release ==1.3.8,
              any.github-rest ==1.0.3,
              any.github-types ==0.2.1,
-             any.gitlab-haskell ==0.1.8,
+             any.github-webhooks ==0.15.0,
+             any.gitlab-haskell ==0.2.5,
              any.gitrev ==1.3.1,
              any.gl ==0.9,
-             any.glabrous ==2.0.2,
-             any.gloss ==1.13.1.2,
+             any.glabrous ==2.0.5,
+             any.gloss ==1.13.2.1,
              any.gloss-rendering ==1.13.1.1,
              any.gluturtle ==0.0.58.1,
              any.gnuplot ==0.5.6.1,
+             any.goldplate ==0.2.0,
              any.google-isbn ==1.0.3,
-             any.gothic ==0.1.5,
+             any.gopher-proxy ==0.1.1.2,
+             any.gothic ==0.1.7,
              any.gpolyline ==0.1.0.1,
              any.graph-core ==0.3.0.0,
              any.graph-wrapper ==0.2.6.0,
              any.graphite ==0.10.0.1,
+             any.graphql-client ==1.1.1,
              any.graphs ==0.7.1,
+             any.graphula ==2.0.1.0,
              any.graphviz ==2999.20.1.0,
              any.gravatar ==0.8.0,
              greskell -hint-test,
-             any.greskell ==1.1.0.3,
-             any.greskell-core ==0.1.3.5,
-             any.greskell-websocket ==0.1.2.4,
+             any.greskell ==1.2.0.2,
+             any.greskell-core ==0.1.3.7,
+             any.greskell-websocket ==0.1.2.6,
              any.groom ==0.1.2.1,
-             any.group-by-date ==0.1.0.3,
-             any.groups ==0.4.1.0,
-             any.gtk-sni-tray ==0.1.6.0,
+             any.group-by-date ==0.1.0.4,
+             any.groups ==0.5.3,
              any.gtk-strut ==0.1.3.0,
              any.guarded-allocation ==0.0.1,
-             any.hOpenPGP ==2.9.4,
-             any.hackage-db ==2.1.0,
+             any.hOpenPGP ==2.9.5,
+             any.hackage-db ==2.1.2,
              any.hackage-security ==0.6.0.1,
-             any.haddock-library ==1.8.0,
-             any.hadolint ==1.18.0,
+             any.haddock-library ==1.10.0,
              any.hadoop-streaming ==0.2.0.3,
-             any.hakyll ==4.13.4.0,
-             any.half ==0.3,
+             any.hakyll-convert ==0.3.0.4,
+             any.hal ==0.4.8,
+             any.half ==0.3.1,
              any.hall-symbols ==0.1.0.6,
              any.hamtsolo ==1.0.3,
-             any.hapistrano ==0.4.1.2,
-             any.happstack-server ==7.6.1,
-             any.happy ==1.19.12,
-             any.hasbolt ==0.1.4.3,
+             any.hapistrano ==0.4.3.0,
+             any.happstack-server ==7.7.1.1,
+             any.happy ==1.20.0,
+             any.happy-meta ==0.2.0.11,
+             any.hasbolt ==0.1.6.1,
              any.hashable ==1.3.0.0,
-             any.hashable-time ==0.2.0.2,
+             any.hashable-time ==0.2.1,
              any.hashids ==1.0.2.4,
+             any.hashing ==0.1.0.1,
              any.hashmap ==1.3.3,
-             any.hashtables ==1.2.4.1,
-             any.haskeline ==0.7.5.0,
-             any.haskell-gi ==0.23.1,
-             any.haskell-gi-base ==0.23.0,
+             any.hashtables ==1.2.4.2,
+             any.haskeline ==0.8.2,
+             any.haskell-awk ==1.2.0.1,
+             any.haskell-gi ==0.25.0,
+             any.haskell-gi-base ==0.25.0,
              any.haskell-gi-overloading ==1.0,
-             any.haskell-igraph ==0.8.0,
              any.haskell-import-graph ==1.0.4,
              any.haskell-lexer ==1.1,
-             any.haskell-lsp ==0.22.0.0,
-             any.haskell-lsp-types ==0.22.0.0,
+             any.haskell-lsp ==0.24.0.0,
+             any.haskell-lsp-types ==0.24.0.0,
              any.haskell-names ==0.9.9,
              any.haskell-src ==1.0.3.1,
              any.haskell-src-exts ==1.23.1,
              any.haskell-src-exts-util ==0.2.5,
-             any.haskell-src-meta ==0.8.5,
+             any.haskell-src-meta ==0.8.7,
              any.haskey-btree ==0.3.0.1,
-             any.haskoin-core ==0.13.4,
-             any.haskoin-node ==0.13.0,
-             any.hasql ==1.4.3,
+             any.hasktags ==0.72.0,
+             any.hasql ==1.4.5.3,
+             any.hasql-notifications ==0.2.0.0,
              any.hasql-optparse-applicative ==0.3.0.6,
              any.hasql-pool ==0.5.2,
-             any.hasql-transaction ==1.0.0.1,
-             any.hasty-hamiltonian ==1.3.3,
+             any.hasql-queue ==1.2.0.2,
+             any.hasql-transaction ==1.0.1,
+             any.hasty-hamiltonian ==1.3.4,
              any.haxr ==3000.11.4.1,
              any.hdaemonize ==0.5.6,
-             any.headroom ==0.2.1.0,
+             any.headroom ==0.4.2.0,
              any.heap ==1.0.4,
-             any.heaps ==0.3.6.1,
+             any.heaps ==0.4,
              any.hebrew-time ==0.1.2,
-             any.hedgehog ==1.0.3,
+             any.hedgehog ==1.0.5,
              any.hedgehog-corpus ==0.2.0,
-             any.hedgehog-fakedata ==0.0.1.3,
+             any.hedgehog-fakedata ==0.0.1.4,
              any.hedgehog-fn ==1.0,
              any.hedgehog-quickcheck ==0.1.1,
-             any.hedis ==0.12.14,
+             any.hedis ==0.14.4,
+             any.hedn ==0.3.0.4,
              any.here ==1.2.13,
              any.heredoc ==0.2.0.0,
-             any.heterocephalus ==1.0.5.3,
+             any.heterocephalus ==1.0.5.4,
              any.hex ==0.2.0,
              any.hexml ==0.3.4,
              any.hexml-lens ==0.2.1,
              any.hexpat ==0.20.13,
-             any.hexstring ==0.11.1,
              any.hformat ==0.3.3.1,
              any.hfsevents ==0.1.6,
-             any.hi-file-parser ==0.1.0.0,
-             any.hidapi ==0.1.5,
-             any.hie-bios ==0.5.1,
-             any.higher-leveldb ==0.5.0.2,
+             any.hgeometry ==0.12.0.4,
+             any.hgeometry-combinatorial ==0.12.0.3,
+             any.hgrev ==0.2.6,
+             any.hi-file-parser ==0.1.2.0,
+             any.hidapi ==0.1.7,
+             any.hie-bios ==0.7.6,
+             any.higher-leveldb ==0.6.0.0,
              any.highlighting-kate ==0.6.4,
              any.hinfo ==0.0.3.0,
-             any.hinotify ==0.4,
-             any.hint ==0.9.0.3,
+             any.hinotify ==0.4.1,
+             any.hint ==0.9.0.4,
              any.hjsmin ==0.2.0.4,
              any.hkd-default ==1.1.0.0,
-             any.hkgr ==0.2.6.1,
-             any.hledger ==1.18.1,
-             any.hledger-iadd ==1.3.12,
-             any.hledger-lib ==1.18.1,
-             any.hledger-stockquotes ==0.1.0.0,
-             any.hledger-ui ==1.18.1,
-             any.hledger-web ==1.18.1,
+             any.hkgr ==0.3,
+             any.hledger ==1.21,
+             any.hledger-iadd ==1.3.14,
+             any.hledger-interest ==1.6.1,
+             any.hledger-lib ==1.21,
+             any.hledger-stockquotes ==0.1.2.0,
+             any.hledger-ui ==1.21,
+             any.hledger-web ==1.21,
              any.hlibcpuid ==0.2.0,
              any.hlibgit2 ==0.18.0.16,
-             any.hlint ==3.1.6,
-             any.hmatrix ==0.20.0.0,
+             any.hlibsass ==0.1.10.1,
+             any.hlint ==3.2.7,
+             any.hmatrix ==0.20.2,
+             any.hmatrix-backprop ==0.1.3.0,
              any.hmatrix-gsl ==0.19.0.1,
              any.hmatrix-gsl-stats ==0.4.1.8,
              any.hmatrix-morpheus ==0.1.1.2,
              any.hmatrix-vector-sized ==0.1.3.0,
+             any.hmm-lapack ==0.4,
              any.hmpfr ==0.4.4,
              any.hnock ==0.4.0,
-             any.hoauth2 ==1.14.0,
-             any.hopenpgp-tools ==0.23.1,
+             any.hoauth2 ==1.16.0,
+             any.hoogle ==5.0.18.2,
+             any.hopenpgp-tools ==0.23.6,
              any.hopenssl ==2.2.4,
              any.hopfli ==0.2.2.1,
-             any.hosc ==0.17,
+             any.hosc ==0.18.1,
              any.hostname ==1.0,
              any.hostname-validate ==1.0.0,
              any.hourglass ==0.2.12,
              any.hourglass-orphans ==0.1.0.0,
-             any.hp2pretty ==0.9,
-             any.hpack ==0.34.2,
-             any.hpack-dhall ==0.5.2,
-             any.hpc-codecov ==0.2.0.0,
+             any.hp2pretty ==0.10,
+             any.hpack ==0.34.5,
+             any.hpack-dhall ==0.5.3,
+             any.hpc-codecov ==0.3.0.0,
              any.hpc-lcov ==1.0.1,
-             any.hreader ==1.1.0,
-             any.hreader-lens ==0.1.3.0,
-             any.hruby ==0.3.8,
+             any.hprotoc ==2.4.17,
+             any.hruby ==0.3.8.1,
              any.hs-GeoIP ==0.3,
              any.hs-bibutils ==6.10.0.0,
              any.hs-functors ==0.1.7.1,
              any.hs-php-session ==0.0.9.3,
-             any.hsc2hs ==0.68.7,
+             any.hs-tags ==0.1.5.2,
+             any.hsass ==0.8.0,
+             any.hsc2hs ==0.68.8,
              any.hscolour ==1.24.4,
              any.hsdns ==1.8,
              any.hsebaysdk ==0.4.1.0,
-             any.hsemail ==2.2.0,
-             any.hset ==2.2.0,
+             any.hsemail ==2.2.1,
              any.hsini ==0.5.1.2,
              any.hsinstall ==2.6,
              any.hslogger ==1.3.1.0,
-             any.hslua ==1.0.3.2,
-             any.hslua-aeson ==1.0.3,
-             any.hslua-module-doclayout ==0.1.0,
-             any.hslua-module-system ==0.2.2,
-             any.hslua-module-text ==0.2.1,
+             any.hslua ==1.3.0.2,
+             any.hslua-aeson ==1.0.3.1,
+             any.hslua-module-doclayout ==0.2.0.1,
+             any.hslua-module-path ==0.1.0.1,
+             any.hslua-module-system ==0.2.2.1,
+             any.hslua-module-text ==0.3.0.1,
              any.hsp ==0.10.0,
-             any.hspec ==2.7.4,
+             any.hspec ==2.7.10,
              any.hspec-attoparsec ==0.1.0.2,
              any.hspec-checkers ==0.1.0.2,
              any.hspec-contrib ==0.5.1,
-             any.hspec-core ==2.7.4,
-             any.hspec-discover ==2.7.4,
+             any.hspec-core ==2.7.10,
+             any.hspec-discover ==2.7.10,
              any.hspec-expectations ==0.8.2,
+             any.hspec-expectations-json ==1.0.0.4,
              any.hspec-expectations-lifted ==0.10.0,
              any.hspec-expectations-pretty-diff ==0.7.2.5,
              any.hspec-golden ==0.1.0.3,
              any.hspec-golden-aeson ==0.7.0.0,
              any.hspec-hedgehog ==0.0.1.2,
-             any.hspec-leancheck ==0.0.4,
-             any.hspec-megaparsec ==2.1.0,
-             any.hspec-meta ==2.6.0,
-             any.hspec-need-env ==0.1.0.5,
+             any.hspec-junit-formatter ==1.0.0.5,
+             any.hspec-leancheck ==0.0.6,
+             any.hspec-megaparsec ==2.2.0,
+             any.hspec-meta ==2.7.8,
+             any.hspec-need-env ==0.1.0.8,
              any.hspec-parsec ==0,
              any.hspec-smallcheck ==0.5.2,
              any.hspec-tables ==0.0.1,
-             any.hspec-wai-json ==0.10.1,
-             any.hsshellscript ==3.4.5,
+             any.hspec-wai-json ==0.11.0,
+             any.hsshellscript ==3.5.0,
              any.hsyslog ==5.0.2,
              any.htaglib ==1.2.0,
              any.html ==1.0.1.2,
-             any.html-conduit ==1.3.2.1,
-             any.html-entities ==1.1.4.3,
+             any.html-conduit ==1.3.2.2,
+             any.html-entities ==1.1.4.5,
              any.html-entity-map ==0.1.0.0,
              any.htoml ==1.0.0.3,
-             any.http-api-data ==0.4.1.1,
+             any.http-api-data ==0.4.2,
              any.http-client-overrides ==0.1.1.0,
-             any.http-common ==0.8.2.1,
-             any.http-date ==0.0.8,
+             any.http-common ==0.8.3.4,
+             any.http-date ==0.0.11,
              any.http-directory ==0.1.8,
              any.http-download ==0.2.0.0,
-             any.http-link-header ==1.0.3.1,
+             any.http-link-header ==1.2.1,
              any.http-media ==0.8.0.0,
+             any.http-query ==0.1.0.1,
              any.http-reverse-proxy ==0.6.0,
-             any.http-streams ==0.8.7.2,
+             any.http-streams ==0.8.9.4,
              any.http-types ==0.12.3,
              any.httpd-shed ==0.4.1.1,
              any.human-readable-duration ==0.2.1.4,
-             any.hunit-dejafu ==2.0.0.4,
+             any.hunit-dejafu ==2.0.0.5,
              any.hvect ==0.4.0.0,
-             any.hvega ==0.9.1.0,
-             any.hw-balancedparens ==0.4.1.0,
+             any.hvega ==0.11.0.1,
+             any.hw-balancedparens ==0.4.1.1,
              any.hw-bits ==0.7.2.1,
              any.hw-conduit ==0.2.1.0,
              any.hw-conduit-merges ==0.2.1.0,
@@ -1154,147 +1239,169 @@ constraints: any.AC-Angle ==1.0,
              any.hw-hspec-hedgehog ==0.1.1.0,
              any.hw-int ==0.0.2.0,
              any.hw-json-simd ==0.1.1.0,
-             any.hw-mquery ==0.2.1.0,
+             any.hw-kafka-client ==4.0.3,
+             any.hw-packed-vector ==0.2.1.0,
              any.hw-parser ==0.1.1.0,
              any.hw-prim ==0.6.3.0,
+             any.hw-rankselect ==0.13.4.0,
              any.hw-rankselect-base ==0.3.4.1,
+             any.hw-simd ==0.1.2.0,
              any.hw-streams ==0.0.1.0,
              any.hw-string-parse ==0.0.0.4,
+             any.hw-succinct ==0.1.0.1,
              any.hweblib ==0.6.3,
              hxt +network-uri,
-             any.hxt ==9.3.1.18,
-             any.hxt-charproperties ==9.4.0.0,
+             any.hxt ==9.3.1.22,
+             any.hxt-charproperties ==9.5.0.0,
              any.hxt-css ==0.1.0.3,
              any.hxt-curl ==9.1.1.1,
              any.hxt-expat ==9.1.1,
              hxt-http +network-uri,
              any.hxt-http ==9.1.5.2,
-             any.hxt-regex-xmlschema ==9.2.0.3,
+             any.hxt-regex-xmlschema ==9.2.0.7,
              any.hxt-tagsoup ==9.1.4,
              any.hxt-unicode ==9.0.2.4,
              any.hybrid-vectors ==0.2.2,
-             any.hyperloglog ==0.4.3,
-             any.hyphenation ==0.8,
-             any.hyraxAbif ==0.2.3.21,
+             any.hyper ==0.2.1.1,
+             any.hyperloglog ==0.4.5,
+             any.hyphenation ==0.8.2,
              any.iconv ==0.4.1.3,
              any.identicon ==0.2.2,
              any.ieee754 ==0.8.0,
              any.if ==0.1.0.0,
              any.iff ==0.0.6,
-             any.ihaskell ==0.10.1.2,
+             any.ihaskell ==0.10.2.1,
              any.ihs ==0.1.0.3,
              any.ilist ==0.4.0.1,
              any.imagesize-conduit ==1.1,
              any.immortal ==0.3,
              any.immortal-queue ==0.1.0.1,
-             any.implicit-hie ==0.1.2.5,
+             any.implicit-hie ==0.1.2.6,
+             any.inbox ==0.1.0,
              any.include-file ==0.1.0.4,
-             any.incremental-parser ==0.4.0.2,
+             any.incremental-parser ==0.5.0.2,
              any.indents ==0.5.0.1,
              any.indexed ==0.1.3,
              any.indexed-containers ==0.1.0.2,
              any.indexed-list-literals ==0.2.1.3,
-             any.indexed-profunctors ==0.1,
+             any.indexed-profunctors ==0.1.1,
+             any.indexed-traversable ==0.1.2,
+             any.indexed-traversable-instances ==0.1,
              any.infer-license ==0.2.0,
              any.inflections ==0.4.0.6,
-             any.influxdb ==1.7.1.6,
+             any.influxdb ==1.9.2.1,
              any.ini ==0.4.1,
              any.inj ==1.0,
-             any.inline-c ==0.9.1.0,
-             any.inline-c-cpp ==0.4.0.2,
+             any.inline-c ==0.9.1.5,
+             any.inline-c-cpp ==0.4.0.3,
+             any.inline-r ==0.10.5,
              any.inliterate ==0.1.0,
-             any.insert-ordered-containers ==0.2.3.1,
-             any.inspection-testing ==0.4.2.4,
+             any.input-parsers ==0.2.3.1,
+             any.insert-ordered-containers ==0.2.5.1,
+             any.inspection-testing ==0.4.6.0,
              any.instance-control ==0.1.2.0,
              any.int-cast ==0.2.0.0,
-             any.integer-logarithms ==1.0.3,
-             any.integer-roots ==1.0,
+             any.integer-logarithms ==1.0.3.1,
+             any.integer-roots ==1.0.1.0,
              any.integration ==0.2.1,
-             any.intern ==0.9.2,
+             any.intern ==0.9.4,
              any.interpolate ==0.2.1,
              any.interpolatedstring-perl6 ==1.0.2,
-             any.interpolation ==0.1.1.1,
-             any.interpolator ==1.0.0,
-             any.intervals ==0.9.1,
-             any.intro ==0.7.0.0,
+             any.interpolation ==0.1.1.2,
+             any.interpolator ==1.1.0.2,
+             any.intervals ==0.9.2,
+             any.intro ==0.9.0.0,
              any.intset-imperative ==0.1.0.0,
-             any.invariant ==0.5.3,
+             any.invariant ==0.5.5,
              any.invertible ==0.2.0.7,
-             any.invertible-grammar ==0.1.3,
+             any.invertible-grammar ==0.1.3.2,
              any.invertible-hxt ==0.1,
              any.io-machine ==0.2.0.0,
              any.io-manager ==0.1.0.3,
              any.io-memoize ==1.1.1.0,
              any.io-region ==0.1.1,
              any.io-storage ==0.3,
-             any.io-streams ==1.5.2.0,
+             any.io-streams ==1.5.2.1,
              any.io-streams-haproxy ==1.0.1.0,
-             any.ip6addr ==1.0.1,
-             any.iproute ==1.7.9,
-             any.ipynb ==0.1.0.1,
+             any.ip6addr ==1.0.2,
+             any.ipa ==0.3.1.1,
+             any.iproute ==1.7.12,
+             any.ipynb ==0.1.0.2,
              any.ipython-kernel ==0.10.2.1,
              any.irc ==0.6.1.0,
-             any.irc-client ==1.1.1.1,
-             any.irc-conduit ==0.3.0.4,
-             any.irc-ctcp ==0.1.3.0,
-             any.isbn ==1.0.0.0,
+             any.irc-client ==1.1.2.2,
+             any.irc-conduit ==0.3.0.5,
+             any.irc-ctcp ==0.1.3.1,
+             any.isbn ==1.1.0.2,
              any.islink ==0.1.0.0,
              any.iso3166-country-codes ==0.20140203.8,
              any.iso639 ==0.1.0.3,
              any.iso8601-time ==0.1.5,
-             any.it-has ==0.2.0.0,
              any.iterable ==3.0,
              any.ix-shapable ==0.1.0,
              any.ixset-typed ==0.5,
-             any.jack ==0.7.1.4,
+             any.ixset-typed-binary-instance ==0.1.0.2,
+             any.ixset-typed-conversions ==0.1.2.0,
+             any.ixset-typed-hashable-instance ==0.1.0.2,
+             any.jack ==0.7.2,
              any.jailbreak-cabal ==1.3.5,
-             any.jira-wiki-markup ==1.1.4,
-             any.jose ==0.8.3.1,
-             any.jose-jwt ==0.8.0,
+             any.jalaali ==1.0.0.0,
+             any.java-adt ==0.2018.11.4,
+             any.jira-wiki-markup ==1.4.0,
+             any.jose ==0.8.4,
+             any.jose-jwt ==0.9.2,
+             any.js-chart ==2.9.4.1,
              any.js-dgtable ==0.5.2,
              any.js-flot ==0.8.3,
              any.js-jquery ==3.3.1,
-             any.json-alt ==1.0.0,
-             any.json-feed ==1.0.11,
+             any.json ==0.10,
+             any.json-feed ==1.0.15,
              any.json-rpc ==1.0.3,
-             any.json-rpc-generic ==0.2.1.5,
+             any.json-rpc-generic ==0.2.1.6,
+             any.jsonifier ==0.1.1,
              any.jsonpath ==0.2.0.0,
-             any.junit-xml ==0.1.0.1,
+             any.junit-xml ==0.1.0.2,
              any.justified-containers ==0.3.0.0,
              any.jwt ==0.10.0,
-             any.kan-extensions ==5.2,
+             any.kan-extensions ==5.2.3,
              any.kanji ==3.4.1,
-             any.katip ==0.8.5.0,
+             any.katip ==0.8.7.0,
+             any.katip-logstash ==0.1.0.0,
              any.kawhi ==0.3.0,
              any.kazura-queue ==0.1.0.4,
              any.kdt ==0.2.4,
+             any.keep-alive ==0.2.0.0,
              any.keycode ==0.2.2,
              any.keys ==3.12.3,
+             any.ki ==0.2.0.1,
              any.kind-apply ==0.3.2.0,
              any.kind-generics ==0.4.1.0,
-             any.kind-generics-th ==0.2.2.0,
+             any.kind-generics-th ==0.2.2.2,
              any.kmeans ==0.1.3,
+             any.koji ==0.0.2,
              any.koofr-client ==1.0.0.3,
-             any.krank ==0.2.2,
+             any.krank ==0.2.3,
              any.kubernetes-webhook-haskell ==0.2.0.3,
              any.l10n ==0.1.0.1,
              any.labels ==0.3.3,
-             any.lackey ==1.0.13,
+             any.lackey ==1.0.16,
+             any.lambdabot-core ==5.3.0.2,
              any.lame ==0.2.0,
              any.language-avro ==0.1.3.1,
              any.language-bash ==0.9.2,
-             any.language-c ==0.8.3,
-             any.language-c-quote ==0.12.2.1,
-             any.language-docker ==9.1.1,
-             any.language-haskell-extract ==0.2.4,
+             any.language-c ==0.9.0.1,
+             any.language-c-quote ==0.13,
+             any.language-docker ==10.0.2,
              any.language-java ==0.2.9,
              any.language-javascript ==0.7.1.0,
              any.language-nix ==2.2.0,
              any.language-protobuf ==1.0.1,
-             any.language-puppet ==1.4.6.5,
+             any.language-python ==0.5.8,
+             any.language-thrift ==0.12.0.0,
+             any.lapack ==0.3.2,
              any.lapack-carray ==0.0.3,
-             any.lapack-comfort-array ==0.0.0.1,
-             any.lapack-ffi ==0.0.2,
+             any.lapack-comfort-array ==0.0.1,
+             any.lapack-ffi ==0.0.3,
              any.lapack-ffi-tools ==0.1.2.1,
              any.largeword ==1.2.5,
              any.latex ==0.1.0.4,
@@ -1302,84 +1409,104 @@ constraints: any.AC-Angle ==1.0,
              any.lawful ==0.1.0.0,
              any.lazy-csv ==0.5.1,
              any.lazyio ==0.1.0.4,
-             any.lca ==0.3.1,
-             any.leancheck ==0.9.3,
+             any.lazysmallcheck ==0.6,
+             any.lca ==0.4,
+             any.leancheck ==0.9.10,
              any.leancheck-instances ==0.0.4,
              any.leapseconds-announced ==2017.1.0.1,
              any.learn-physics ==0.6.5,
-             any.lens ==4.18.1,
-             any.lens-action ==0.2.4,
-             any.lens-aeson ==1.1,
+             any.lens ==4.19.2,
+             any.lens-action ==0.2.6,
+             any.lens-aeson ==1.1.3,
+             any.lens-csv ==0.1.1.0,
              any.lens-datetime ==0.3,
              any.lens-family ==2.0.0,
              any.lens-family-core ==2.0.0,
-             any.lens-family-th ==0.5.1.0,
+             any.lens-family-th ==0.5.2.1,
              any.lens-misc ==0.0.2.0,
+             any.lens-process ==0.4.0.0,
              any.lens-properties ==4.11.1,
-             any.lens-regex ==0.1.1,
+             any.lens-regex ==0.1.3,
+             any.lens-regex-pcre ==1.1.0.0,
              any.lenz ==0.4.2.0,
              any.leveldb-haskell ==0.6.5,
+             any.libBF ==0.6.2,
              any.libffi ==0.1,
              any.libgit ==0.3.1,
              any.libgraph ==1.14,
-             any.libmpd ==0.9.1.0,
+             any.libjwt-typed ==0.2,
+             any.libmpd ==0.10.0.0,
+             any.liboath-hs ==0.0.1.2,
              any.libyaml ==0.1.2,
-             any.life-sync ==1.1.1.0,
-             any.lift-generics ==0.1.3,
-             any.lifted-async ==0.10.1.2,
+             any.lift-generics ==0.2.1,
+             any.lift-type ==0.1.0.1,
+             any.lifted-async ==0.10.2.2,
              any.lifted-base ==0.2.3.12,
              any.line ==4.0.1,
-             any.linear ==1.21.1,
+             any.linear ==1.21.6,
+             any.linear-circuit ==0.1.0.2,
              any.linenoise ==0.3.2,
+             any.linux-capabilities ==0.1.0.0,
              any.linux-file-extents ==0.2.0.0,
              any.linux-namespaces ==0.1.3.0,
+             any.liquid-fixpoint ==0.8.10.2,
              any.list-predicate ==0.1.0.1,
-             any.list-singleton ==1.0.0.4,
-             any.list-t ==1.0.4,
+             any.list-singleton ==1.0.0.5,
+             any.list-t ==1.0.5,
+             any.list-transformer ==1.0.7,
              any.listsafe ==0.1.0.1,
-             any.little-logger ==0.1.0,
-             any.little-rio ==0.1.1,
+             any.literatex ==0.1.0.2,
+             any.little-rio ==0.2.2,
              any.llvm-hs ==9.0.1,
              any.llvm-hs-pure ==9.0.0,
              any.lmdb ==0.2.5,
              any.load-env ==0.2.1.0,
-             any.loc ==0.1.3.8,
+             any.loc ==0.1.3.10,
+             any.locators ==0.3.0.3,
              any.loch-th ==0.2.2,
              any.lockfree-queue ==0.2.3.1,
-             any.log-base ==0.8.0.1,
-             any.log-domain ==0.13,
-             any.logfloat ==0.13.3.3,
+             any.log-domain ==0.13.2,
+             any.logfloat ==0.13.4,
              any.logging ==3.0.5,
-             any.logging-facade ==0.3.0,
+             any.logging-facade ==0.3.1,
              any.logging-facade-syslog ==1,
-             any.logict ==0.7.0.3,
+             any.logict ==0.7.1.0,
+             any.logstash ==0.1.0.1,
              any.loop ==0.3.0,
-             any.loopbreaker ==0.1.1.1,
              any.lrucache ==1.2.0.1,
              any.lrucaching ==0.3.3,
-             any.lsp-test ==0.10.3.0,
-             any.lucid ==2.9.12,
+             any.lsp ==1.2.0.0,
+             any.lsp-test ==0.14.0.0,
+             any.lsp-types ==1.2.0.0,
+             any.lucid ==2.9.12.1,
+             any.lucid-cdn ==0.2.2.0,
              any.lucid-extras ==0.2.2,
-             any.lukko ==0.1.1.2,
+             any.lukko ==0.1.1.3,
+             any.lz4-frame-conduit ==0.1.0.1,
              any.lzma ==0.0.0.3,
-             any.lzma-conduit ==1.2.1,
-             any.machines ==0.7,
+             any.lzma-clib ==5.2.2,
+             any.lzma-conduit ==1.2.2,
+             any.machines ==0.7.2,
+             any.machines-binary ==7.0.0.0,
              any.magic ==1.1,
+             any.magico ==0.0.2.1,
              any.main-tester ==0.2.0.1,
-             any.mainland-pretty ==0.7.0.1,
+             any.mainland-pretty ==0.7.1,
              any.makefile ==1.1.0.0,
              any.managed ==1.0.8,
-             any.markdown ==0.1.17.4,
-             any.markdown-unlit ==0.5.0,
+             any.markdown ==0.1.17.5,
+             any.markdown-unlit ==0.5.1,
              any.markov-chain ==0.0.3.4,
              any.markov-chain-usage-model ==0.0.0,
-             any.massiv ==0.5.4.0,
-             any.massiv-io ==0.2.1.0,
-             any.massiv-test ==0.1.4,
+             any.massiv ==0.6.1.0,
+             any.massiv-io ==0.4.1.0,
+             any.massiv-persist ==0.1.0.0,
+             any.massiv-serialise ==0.1.0.0,
+             any.massiv-test ==0.1.6.1,
              any.math-extras ==0.1.1.0,
-             any.math-functions ==0.3.4.1,
+             any.math-functions ==0.3.4.2,
              any.mathexpr ==0.3.0.0,
-             any.matplotlib ==0.7.5,
+             any.matplotlib ==0.7.7,
              any.matrices ==0.5.0,
              any.matrix ==0.3.6.1,
              any.matrix-as-xyz ==0.1.2.2,
@@ -1388,78 +1515,83 @@ constraints: any.AC-Angle ==1.0,
              any.maximal-cliques ==0.1.1,
              any.mbox ==0.3.4,
              any.mbox-utility ==0.0.3.1,
+             any.mcmc ==0.5.0.0,
              any.mcmc-types ==1.0.3,
-             any.medea ==1.1.2,
+             any.med-module ==0.1.2.1,
+             any.medea ==1.2.0,
              any.median-stream ==0.7.0.0,
-             any.megaparsec ==8.0.0,
-             any.megaparsec-tests ==8.0.0,
+             any.megaparsec ==9.0.1,
+             any.megaparsec-tests ==9.0.1,
              any.membrain ==0.0.0.2,
              any.memory ==0.15.0,
              any.mercury-api ==0.1.0.2,
              any.mergeful ==0.2.0.0,
              any.mergeless ==0.3.0.0,
+             any.mersenne-random ==1.0.0.1,
              mersenne-random-pure64 -small_base,
              any.mersenne-random-pure64 ==0.2.2.0,
              any.messagepack ==0.5.4,
              any.metrics ==0.4.1.1,
              any.mfsolve ==0.3.2.0,
-             any.microlens ==0.4.11.2,
+             any.microlens ==0.4.12.0,
              any.microlens-aeson ==2.3.1,
              any.microlens-contra ==0.1.0.2,
-             any.microlens-ghc ==0.4.12,
+             any.microlens-ghc ==0.4.13.1,
              any.microlens-mtl ==0.2.0.1,
-             any.microlens-platform ==0.4.1,
+             any.microlens-platform ==0.4.2.1,
              any.microlens-process ==0.2.0.2,
-             any.microlens-th ==0.4.3.5,
+             any.microlens-th ==0.4.3.10,
              any.microspec ==0.2.1.3,
-             any.microstache ==1.0.1.1,
+             any.microstache ==1.0.2,
              any.midair ==0.2.0.1,
              any.midi ==0.2.2.2,
              any.mighty-metropolis ==2.0.0,
              any.mime ==0.4.0.2,
-             any.mime-mail ==0.5.0,
+             any.mime-mail ==0.5.1,
              any.mime-mail-ses ==0.4.3,
              any.mime-types ==0.1.0.9,
              any.min-max-pqueue ==0.1.0.2,
              any.mini-egison ==1.0.0,
              any.minimal-configuration ==0.1.4,
-             any.minimorph ==0.2.2.0,
-             any.minio-hs ==1.5.2,
-             any.miniutter ==0.5.1.0,
-             mintty +win32-2-5-3,
-             any.mintty ==0.1.2,
-             any.miso ==1.6.0.0,
+             any.minimorph ==0.3.0.0,
+             any.minio-hs ==1.5.3,
+             any.miniutter ==0.5.1.1,
+             mintty +win32-2-13-1,
+             any.mintty ==0.1.3,
              any.missing-foreign ==0.1.1,
-             any.mixed-types-num ==0.4.0.2,
-             any.mixpanel-client ==0.2.1,
+             any.mixed-types-num ==0.5.9.1,
              any.mltool ==0.2.0.1,
              any.mmap ==0.5.9,
              any.mmark ==0.0.7.2,
              any.mmark-cli ==0.0.5.0,
-             any.mmark-ext ==0.2.1.2,
-             any.mmorph ==1.1.3,
+             any.mmark-ext ==0.2.1.3,
+             any.mmorph ==1.1.5,
              any.mnist-idx ==0.1.2.8,
+             any.mnist-idx-conduit ==0.4.0.0,
+             any.mock-time ==0.1.0,
              any.mockery ==0.3.5,
-             any.mod ==0.1.2.0,
+             any.mod ==0.1.2.2,
              any.model ==0.5,
-             any.modern-uri ==0.3.2.0,
+             any.modern-uri ==0.3.4.2,
              any.modular ==0.1.0.8,
-             any.monad-bayes ==0.1.1.0,
-             any.monad-control ==1.0.2.3,
+             any.monad-chronicle ==1.0.0.1,
+             any.monad-control ==1.0.3.1,
              any.monad-control-aligned ==0.0.1.1,
-             any.monad-coroutine ==0.9.0.4,
+             any.monad-coroutine ==0.9.1.3,
              any.monad-extras ==0.6.0,
              any.monad-journal ==0.8.1,
-             any.monad-logger ==0.3.35,
+             any.monad-logger ==0.3.36,
              any.monad-logger-json ==0.1.0.0,
-             any.monad-logger-prefix ==0.1.11,
+             any.monad-logger-logstash ==0.1.0.0,
+             any.monad-logger-prefix ==0.1.12,
              any.monad-loops ==0.4.3,
-             any.monad-memo ==0.5.1,
-             any.monad-metrics ==0.2.1.4,
+             any.monad-memo ==0.5.3,
+             any.monad-metrics ==0.2.2.0,
              any.monad-par ==0.3.5,
              any.monad-par-extras ==0.3.3,
-             any.monad-parallel ==0.7.2.3,
+             any.monad-parallel ==0.7.2.5,
              any.monad-peel ==0.2.1.2,
+             any.monad-primitive ==0.1,
              any.monad-products ==4.0.1,
              any.monad-resumption ==0.1.4.0,
              any.monad-skeleton ==0.1.5,
@@ -1468,18 +1600,22 @@ constraints: any.AC-Angle ==1.0,
              any.monad-unlift ==0.2.0,
              any.monad-unlift-ref ==0.2.1,
              any.monadic-arrays ==0.2.2,
+             any.monadlist ==0.0.2,
              any.monads-tf ==0.1.0.3,
              mongoDB -_old-network,
-             any.mongoDB ==2.7.0.0,
-             any.mono-traversable ==1.0.15.1,
+             any.mongoDB ==2.7.1.1,
+             any.mono-traversable ==1.0.15.3,
              any.mono-traversable-instances ==0.1.1.0,
              any.mono-traversable-keys ==0.1.0,
-             any.monoid-extras ==0.5.1,
-             any.monoid-subclasses ==1.0.1,
+             any.monoid-subclasses ==1.1.2,
              any.monoid-transformer ==0.0.4,
-             any.more-containers ==0.2.2.0,
-             any.morpheus-graphql ==0.12.0,
-             any.morpheus-graphql-core ==0.12.0,
+             any.more-containers ==0.2.2.2,
+             any.morpheus-graphql ==0.17.0,
+             any.morpheus-graphql-app ==0.17.0,
+             any.morpheus-graphql-client ==0.17.0,
+             any.morpheus-graphql-core ==0.17.0,
+             any.morpheus-graphql-subscriptions ==0.17.0,
+             any.moss ==0.2.0.0,
              any.mountpoints ==1.0.2,
              any.mpi-hs ==0.7.2.0,
              any.mpi-hs-binary ==0.1.1.0,
@@ -1489,17 +1625,19 @@ constraints: any.AC-Angle ==1.0,
              any.multi-containers ==0.1.1,
              any.multiarg ==0.30.0.10,
              any.multimap ==1.2.1,
+             any.multipart ==0.2.1,
              any.multiset ==0.3.4.3,
              any.multistate ==0.8.0.3,
-             any.murmur-hash ==0.1.0.9,
-             any.murmur3 ==1.0.4,
+             any.murmur-hash ==0.1.0.10,
+             any.murmur3 ==1.0.5,
              any.mustache ==2.3.1,
              any.mutable-containers ==0.3.4,
              any.mwc-probability ==2.3.1,
-             any.mwc-random ==0.14.0.0,
+             any.mwc-random ==0.15.0.2,
+             any.mwc-random-monad ==0.7.3.1,
              any.mx-state-codes ==1.0.0.0,
-             any.mysql ==0.1.7,
-             any.mysql-simple ==0.4.5,
+             any.mysql ==0.2.1,
+             any.mysql-simple ==0.4.7,
              any.n2o ==0.11.1,
              any.nagios-check ==0.3.2,
              any.names-th ==0.3.0.1,
@@ -1510,105 +1648,116 @@ constraints: any.AC-Angle ==1.0,
              any.natural-sort ==0.1.2,
              any.natural-transformation ==0.4,
              any.ndjson-conduit ==0.1.0.5,
-             any.neat-interpolation ==0.3.2.6,
+             any.neat-interpolation ==0.5.1.2,
+             any.net-mqtt ==0.7.1.1,
+             any.net-mqtt-lens ==0.1.1.0,
+             any.netcode-io ==0.0.3,
              any.netlib-carray ==0.1,
-             any.netlib-comfort-array ==0.0.0.1,
+             any.netlib-comfort-array ==0.0.0.2,
              any.netlib-ffi ==0.1.1,
-             any.netpbm ==1.0.3,
-             any.netrc ==0.2.0.0,
+             any.netpbm ==1.0.4,
              any.nettle ==0.3.0,
              any.netwire ==5.0.3,
              any.netwire-input ==0.0.7,
              any.netwire-input-glfw ==0.0.11,
              any.network ==3.1.1.1,
              any.network-bsd ==2.8.1.0,
-             any.network-byte-order ==0.1.5,
+             any.network-byte-order ==0.1.6,
              any.network-conduit-tls ==1.3.2,
              any.network-info ==0.2.0.10,
              any.network-ip ==0.3.0.3,
              any.network-messagepack-rpc ==0.1.2.0,
              any.network-messagepack-rpc-websocket ==0.1.1.1,
+             any.network-run ==0.2.4,
              any.network-simple ==0.4.5,
              any.network-simple-tls ==0.4,
              any.network-transport ==0.5.4,
              any.network-transport-composed ==0.2.1,
-             any.network-uri ==2.6.3.0,
+             any.network-uri ==2.6.4.1,
              any.newtype ==0.2.2.0,
-             any.newtype-generics ==0.5.4,
+             any.newtype-generics ==0.6.1,
              any.nicify-lib ==1.0.1,
+             any.nix-derivation ==1.1.2,
              nix-paths +allow-relative-paths,
              any.nix-paths ==1.0.1,
              any.no-value ==1.0.0.0,
-             any.non-empty ==0.3.2,
+             any.non-empty ==0.3.3,
              any.non-empty-sequence ==0.2.0.4,
              any.non-negative ==0.1.2,
              any.nonce ==1.0.7,
              any.nondeterminism ==1.4,
-             any.nonempty-containers ==0.3.4.1,
-             any.nonempty-vector ==0.2.0.2,
+             any.nonempty-containers ==0.3.4.4,
+             any.nonempty-vector ==0.2.1.0,
+             any.nonempty-zipper ==1.0.0.3,
              any.nonemptymap ==0.0.6.0,
              any.not-gloss ==0.7.7.0,
              any.nowdoc ==0.1.1.0,
              any.nqe ==0.6.3,
+             any.nri-env-parser ==0.1.0.7,
+             any.nri-observability ==0.1.1.3,
+             any.nri-prelude ==0.6.0.5,
              any.nsis ==0.3.3,
              any.numbers ==3000.2.0.2,
              any.numeric-extras ==0.1,
-             any.numeric-prelude ==0.4.3.2,
-             any.numhask ==0.4.0,
-             any.numtype-dk ==0.5.0.2,
+             any.numeric-limits ==0.1.0.0,
+             any.numeric-prelude ==0.4.3.3,
+             any.numhask ==0.7.1.0,
+             any.numtype-dk ==0.5.0.3,
              any.nuxeo ==0.3.2,
-             any.o-clock ==1.1.0,
+             any.nvim-hs ==2.1.0.4,
+             any.nvim-hs-contrib ==2.0.0.0,
+             any.nvim-hs-ghcid ==2.0.0.0,
+             any.o-clock ==1.2.1,
              any.oauthenticated ==0.2.1.0,
-             any.odbc ==0.2.2,
-             any.oeis2 ==1.0.4,
+             any.odbc ==0.2.5,
+             any.oeis2 ==1.0.5,
              any.ofx ==0.4.4.0,
              any.old-locale ==1.0.0.7,
              any.old-time ==1.1.0.3,
              any.once ==0.4,
              any.one-liner ==1.0,
-             any.one-liner-instances ==0.1.2.1,
              any.oo-prototypes ==0.1.0.0,
-             any.opaleye ==0.6.7006.1,
+             any.opaleye ==0.7.6.2,
              any.open-browser ==0.2.1.0,
+             any.openapi3 ==3.1.0,
              any.openexr-write ==0.1.0.2,
              any.openpgp-asciiarmor ==0.1.2,
              any.opensource ==0.1.1.0,
              any.openssl-streams ==1.2.3.0,
-             any.opentelemetry ==0.4.2,
-             any.opentelemetry-extra ==0.4.2,
-             any.opentelemetry-lightstep ==0.4.2,
-             any.opentelemetry-wai ==0.4.2,
-             any.operational ==0.2.3.5,
+             any.opentelemetry ==0.7.0,
+             any.opentelemetry-extra ==0.7.0,
+             any.opentelemetry-lightstep ==0.7.0,
+             any.opentelemetry-wai ==0.7.0,
+             any.operational ==0.2.4.1,
              any.operational-class ==0.3.0.0,
-             any.optics ==0.2,
-             any.optics-core ==0.2,
-             any.optics-extra ==0.2,
-             any.optics-th ==0.2,
-             any.optics-vl ==0.2,
+             any.optics ==0.3,
+             any.optics-core ==0.3.0.1,
+             any.optics-extra ==0.3,
+             any.optics-th ==0.3.0.2,
+             any.optics-vl ==0.2.1,
              any.optional-args ==1.0.2,
              any.options ==1.2.1.1,
-             any.optparse-applicative ==0.15.1.0,
-             any.optparse-generic ==1.3.1,
-             any.optparse-simple ==0.1.1.3,
+             any.optparse-applicative ==0.16.1.0,
+             any.optparse-generic ==1.4.7,
+             any.optparse-simple ==0.1.1.4,
              any.optparse-text ==0.1.1.0,
              any.ordered-containers ==0.2.2,
              any.ormolu ==0.1.4.1,
              any.overhang ==1.0.0,
              any.packcheck ==0.5.1,
+             any.packdeps ==0.6.0.0,
              any.pager ==0.1.1.0,
-             any.pagination ==0.2.1,
+             any.pagination ==0.2.2,
              any.pagure-cli ==0.2,
-             any.pandoc ==2.9.2.1,
-             any.pandoc-citeproc ==0.17.0.1,
-             any.pandoc-csv2table ==1.0.8,
-             any.pandoc-plot ==0.6.1.0,
-             any.pandoc-pyplot ==2.3.0.1,
-             any.pandoc-types ==1.20,
-             any.pantry ==0.4.0.2,
-             any.papillon ==0.1.1.1,
+             any.pandoc ==2.14.0.3,
+             any.pandoc-dhall-decoder ==0.1.0.1,
+             any.pandoc-plot ==1.2.3,
+             any.pandoc-throw ==0.1.0.0,
+             any.pandoc-types ==1.22.1,
+             any.pantry ==0.5.2.3,
              any.parallel ==3.2.2.0,
-             any.parallel-io ==0.3.3,
-             any.paripari ==0.6.0.1,
+             any.parameterized ==0.5.0.0,
+             any.paripari ==0.7.0.0,
              any.parseargs ==0.2.0.9,
              any.parsec-class ==1.0.0.0,
              any.parsec-numbers ==0.1.0,
@@ -1618,51 +1767,60 @@ constraints: any.AC-Angle ==1.0,
              any.parsers ==0.12.10,
              any.partial-handler ==1.0.3,
              any.partial-isomorphisms ==0.2.2.1,
-             any.partial-semigroup ==0.5.1.8,
-             any.password ==2.0.1.1,
-             any.password-instances ==2.0.0.1,
-             any.path ==0.7.0,
+             any.partial-semigroup ==0.5.1.12,
+             any.password ==3.0.0.0,
+             any.password-instances ==3.0.0.0,
+             any.password-types ==1.0.0.0,
+             any.path ==0.8.0,
+             any.path-binary-instance ==0.1.0.1,
+             any.path-extensions ==0.1.1.0,
              any.path-extra ==0.2.0,
-             any.path-io ==1.6.0,
+             any.path-io ==1.6.3,
+             any.path-like ==0.2.0.2,
              any.path-pieces ==0.2.1,
-             any.path-text-utf8 ==0.0.1.6,
+             any.path-text-utf8 ==0.0.1.8,
              pathtype -old-time,
              any.pathtype ==0.8.1.1,
              any.pathwalk ==0.3.1.2,
              any.pattern-arrows ==0.0.2,
-             any.pattern-trie ==0.1.0,
-             any.pcg-random ==0.1.3.6,
+             any.pattern-trie ==0.1.1,
+             any.pava ==0.1.1.2,
+             any.pcg-random ==0.1.3.7,
              any.pcre-heavy ==1.0.0.2,
              any.pcre-light ==0.4.1.0,
-             any.pcre-utils ==0.1.8.1.1,
+             any.pcre-utils ==0.1.8.2,
+             any.pcre2 ==1.1.5,
              any.pdfinfo ==1.5.4,
              any.peano ==0.1.0.1,
              any.pem ==0.2.4,
-             any.percent-format ==0.0.1,
+             any.percent-format ==0.0.2,
+             any.peregrin ==0.3.1,
              any.perfect-hash-generator ==0.2.0.6,
              any.perfect-vector-shuffle ==0.1.1.1,
              any.persist ==0.1.1.5,
              any.persistable-record ==0.6.0.5,
              any.persistable-types-HDBC-pg ==0.0.3.5,
-             any.persistent ==2.10.5.2,
-             any.persistent-mysql ==2.10.2.3,
-             any.persistent-pagination ==0.1.1.1,
-             any.persistent-postgresql ==2.10.1.2,
-             any.persistent-qq ==2.9.1.1,
-             any.persistent-sqlite ==2.10.6.2,
-             any.persistent-template ==2.8.2.3,
-             any.persistent-test ==2.0.3.1,
-             any.persistent-typed-db ==0.1.0.1,
+             any.persistent ==2.13.2.1,
+             any.persistent-mtl ==0.2.2.0,
+             any.persistent-mysql ==2.13.0.2,
+             any.persistent-pagination ==0.1.1.2,
+             any.persistent-postgresql ==2.13.2.1,
+             any.persistent-qq ==2.12.0.1,
+             any.persistent-sqlite ==2.13.0.3,
+             any.persistent-template ==2.12.0.0,
+             any.persistent-test ==2.13.0.3,
+             any.persistent-typed-db ==0.1.0.5,
              any.pg-harness-client ==0.6.0,
-             any.pg-transact ==0.3.1.1,
+             any.pg-transact ==0.3.2.0,
              any.pgp-wordlist ==0.1.0.3,
              any.phantom-state ==0.2.1.2,
-             any.pid1 ==0.1.2.0,
-             any.pipes ==4.3.14,
+             any.pid1 ==0.1.3.0,
+             any.pinboard ==0.10.2.0,
+             any.pipes ==4.3.16,
              any.pipes-aeson ==0.4.1.8,
              any.pipes-attoparsec ==0.5.1.5,
-             any.pipes-binary ==0.4.2,
-             any.pipes-bytestring ==2.1.6,
+             any.pipes-binary ==0.4.3,
+             any.pipes-bytestring ==2.1.7,
              any.pipes-concurrency ==2.0.12,
              any.pipes-csv ==1.4.3,
              any.pipes-extras ==1.0.15,
@@ -1671,99 +1829,108 @@ constraints: any.AC-Angle ==1.0,
              any.pipes-http ==1.0.6,
              any.pipes-network ==0.6.5,
              any.pipes-network-tls ==0.4,
-             any.pipes-ordered-zip ==1.1.0,
-             any.pipes-parse ==3.0.8,
+             any.pipes-ordered-zip ==1.2.1,
+             any.pipes-parse ==3.0.9,
              any.pipes-random ==1.0.0.5,
-             any.pipes-safe ==2.3.2,
+             any.pipes-safe ==2.3.3,
              any.pipes-wai ==3.2.0,
              any.pkcs10 ==0.2.0.0,
+             any.pkgtreediff ==0.4.1,
+             any.place-cursor-at ==1.0.1,
              any.placeholders ==0.1,
              any.plaid ==0.1.0.4,
-             any.planb-token-introspection ==0.1.4.0,
              any.plotlyhs ==0.2.1,
-             any.pointed ==5.0.1,
+             any.pointed ==5.0.3,
              any.pointedlist ==0.6.1,
-             any.pointless-fun ==1.1.0.6,
-             any.poll ==0.0.0.1,
-             any.poly ==0.4.0.0,
+             any.pointless-fun ==1.1.0.8,
+             any.poll ==0.0.0.2,
+             any.polling-cache ==0.1.1.0,
+             any.poly ==0.5.0.0,
              any.poly-arity ==0.1.0,
              any.polynomials-bernstein ==1.1.2,
              any.polyparse ==1.13,
-             any.polysemy ==1.7.0.0,
+             any.polysemy ==1.7.1.0,
              any.polysemy-check ==0.9.0.0,
              any.polysemy-plugin ==0.4.2.0,
              any.pooled-io ==0.0.2.2,
              any.port-utils ==0.2.1.0,
-             any.posix-paths ==0.2.1.6,
+             any.posix-paths ==0.3.0.0,
              any.possibly ==1.0.0.0,
              any.post-mess-age ==0.2.1.0,
              any.postgres-options ==0.2.0.0,
-             any.postgresql-binary ==0.12.2,
-             any.postgresql-libpq ==0.9.4.2,
+             any.postgresql-binary ==0.12.4.1,
+             any.postgresql-libpq ==0.9.4.3,
+             any.postgresql-libpq-notify ==0.2.0.0,
              any.postgresql-orm ==0.5.1,
-             any.postgresql-simple ==0.6.2,
-             any.postgrest ==7.0.0,
+             any.postgresql-simple ==0.6.4,
+             any.postgresql-typed ==0.6.2.0,
+             any.postgrest ==7.0.1,
              any.pptable ==0.3.0.0,
              any.pqueue ==1.4.1.3,
+             any.prairie ==0.0.1.0,
              any.prefix-units ==0.2.0,
              any.prelude-compat ==0.0.0.2,
-             any.prelude-safeenum ==0.1.1.2,
+             any.prelude-safeenum ==0.1.1.3,
              any.pretty-class ==1.0.1.1,
+             any.pretty-diff ==0.4.0.3,
              any.pretty-hex ==1.1,
              any.pretty-relative-time ==0.2.0.0,
              any.pretty-show ==1.10,
-             any.pretty-simple ==3.2.3.0,
+             any.pretty-simple ==4.0.0.0,
              any.pretty-sop ==0.2.0.3,
              any.pretty-terminal ==0.1.0.0,
-             any.pretty-types ==0.3.0.1,
              any.prettyclass ==1.0.0.0,
-             any.prettyprinter ==1.6.2,
-             any.prettyprinter-ansi-terminal ==1.1.2,
-             any.prettyprinter-compat-annotated-wl-pprint ==1,
-             any.prettyprinter-compat-ansi-wl-pprint ==1.0.1,
-             any.prettyprinter-compat-wl-pprint ==1.0.0.1,
-             any.prettyprinter-convert-ansi-wl-pprint ==1.1.1,
+             any.prettyprinter ==1.7.1,
+             any.prettyprinter-ansi-terminal ==1.1.3,
+             any.prettyprinter-compat-annotated-wl-pprint ==1.1,
+             any.prettyprinter-compat-ansi-wl-pprint ==1.0.2,
+             any.prettyprinter-compat-wl-pprint ==1.0.1,
+             any.prettyprinter-convert-ansi-wl-pprint ==1.1.2,
+             any.prim-uniq ==0.2,
              any.primes ==0.2.1.0,
-             any.primitive ==0.7.0.1,
+             any.primitive ==0.7.3.0,
              any.primitive-addr ==0.1.0.2,
-             any.primitive-extras ==0.8,
+             any.primitive-extras ==0.10.1.1,
              any.primitive-unaligned ==0.1.1.1,
-             any.primitive-unlifted ==0.1.2.0,
+             any.primitive-unlifted ==1.0.0.0,
              any.print-console-colors ==0.1.0.0,
+             any.probability ==0.2.7,
              any.process-extras ==0.7.4,
              any.product-isomorphic ==0.0.3.3,
-             any.product-profunctors ==0.10.0.1,
+             any.product-profunctors ==0.11.0.2,
              any.profiterole ==0.1,
-             any.profunctors ==5.5.2,
+             any.profunctors ==5.6.2,
              any.project-template ==0.2.1.0,
              any.projectroot ==0.2.0.1,
              any.prometheus ==2.2.2,
              any.prometheus-client ==1.0.1,
+             any.prometheus-metrics-ghc ==1.0.1.2,
+             any.prometheus-wai-middleware ==1.0.1.0,
              any.promises ==0.3,
              any.prompt ==0.1.1.2,
              any.prospect ==0.1.0.0,
-             any.proto-lens ==0.7.0.0,
-             any.proto-lens-arbitrary ==0.1.2.9,
-             any.proto-lens-optparse ==0.1.1.7,
-             any.proto-lens-protobuf-types ==0.7.0.0,
-             any.proto-lens-protoc ==0.7.0.0,
-             any.proto-lens-runtime ==0.7.0.0,
-             any.proto-lens-setup ==0.4.0.4,
-             any.proto3-wire ==1.1.0,
+             any.proto-lens ==0.7.1.0,
+             any.proto-lens-protoc ==0.7.1.0,
+             any.proto-lens-runtime ==0.7.0.1,
+             any.proto-lens-setup ==0.4.0.5,
+             any.proto3-wire ==1.2.2,
              any.protobuf ==0.2.1.3,
-             any.protobuf-simple ==0.1.1.0,
+             any.protobuf-simple ==0.1.1.1,
+             any.protocol-buffers ==2.4.17,
+             any.protocol-buffers-descriptor ==2.4.17,
              any.protocol-radius ==0.0.1.1,
              any.protocol-radius-test ==0.1.0.1,
-             any.protolude ==0.2.4,
+             any.protolude ==0.3.0,
              any.proxied ==0.3.1,
-             any.psqueues ==0.2.7.2,
+             any.psqueues ==0.2.7.3,
+             any.ptr-poker ==0.1.1.4,
              any.publicsuffix ==0.20200526,
              any.pulse-simple ==0.1.14,
-             any.pureMD5 ==2.1.3,
+             any.pureMD5 ==2.1.4,
              any.purescript-bridge ==0.14.0.0,
              any.pushbullet-types ==0.4.1.0,
-             any.pusher-http-haskell ==1.5.1.14,
-             any.pvar ==0.2.0.0,
+             any.pusher-http-haskell ==2.1.0.7,
+             any.pvar ==1.0.0.0,
              any.qchas ==1.1.0.1,
              any.qm-interpolated-string ==0.3.0.0,
              any.qrcode-core ==0.9.4,
@@ -1771,346 +1938,394 @@ constraints: any.AC-Angle ==1.0,
              any.quadratic-irrational ==0.1.1,
              any.quickcheck-arbitrary-adt ==0.3.1.0,
              any.quickcheck-assertions ==0.3.0,
-             any.quickcheck-classes ==0.6.4.0,
-             any.quickcheck-classes-base ==0.6.1.0,
-             any.quickcheck-instances ==0.3.23,
+             any.quickcheck-classes ==0.6.5.0,
+             any.quickcheck-classes-base ==0.6.2.0,
+             any.quickcheck-higherorder ==0.1.0.0,
+             any.quickcheck-instances ==0.3.25.2,
              any.quickcheck-io ==0.2.0,
              any.quickcheck-simple ==0.1.1.1,
              any.quickcheck-special ==0.1.0.6,
-             any.quickcheck-state-machine ==0.6.0,
+             any.quickcheck-state-machine ==0.7.1,
              any.quickcheck-text ==0.1.2.1,
              any.quickcheck-transformer ==0.3.1.1,
              any.quickcheck-unicode ==1.0.1.0,
              any.quiet ==0.2,
-             any.radius ==0.6.1.0,
+             any.quote-quot ==0.2.0.0,
+             any.radius ==0.7.1.0,
              any.rainbow ==0.34.2.2,
              any.rainbox ==0.26.0.0,
-             any.ral ==0.1,
+             any.ral ==0.2,
+             any.rampart ==1.1.0.4,
              any.ramus ==0.1.2,
              any.rando ==0.0.0.4,
-             any.random ==1.1,
-             any.random-bytestring ==0.1.3.2,
+             any.random ==1.2.0,
+             any.random-bytestring ==0.1.4,
+             any.random-fu ==0.2.7.7,
              any.random-shuffle ==0.0.4,
+             any.random-source ==0.3.0.11,
              any.random-tree ==0.6.0.5,
              any.range ==0.3.0.2,
              any.range-set-list ==0.1.3.1,
-             any.rank1dynamic ==0.4.0,
-             any.rank2classes ==1.3.2.1,
+             any.ranged-list ==0.1.0.0,
+             any.rank1dynamic ==0.4.1,
+             any.rank2classes ==1.4.3,
              any.rasterific-svg ==0.3.3.2,
              any.rate-limit ==1.4.2,
-             any.ratel ==1.0.12,
-             any.ratel-wai ==1.1.3,
+             any.ratel ==1.0.17,
+             any.ratel-wai ==1.1.5,
+             any.rattle ==0.2,
+             any.rattletrap ==11.1.1,
              any.raw-strings-qq ==1.1,
              any.rawfilepath ==0.2.4,
              any.rawstring-qm ==0.2.3.0,
-             any.rcu ==0.2.4,
-             any.rdf ==0.1.0.4,
+             any.rcu ==0.2.5,
+             any.rdf ==0.1.0.5,
              any.rdtsc ==1.3.0.1,
              any.re2 ==0.3,
              any.read-editor ==0.1.0.2,
              any.read-env-var ==1.0.0.0,
              any.readable ==0.3.1,
-             any.reanimate ==0.3.3.0,
-             any.reanimate-svg ==0.9.8.0,
-             any.rebase ==1.6.1,
-             any.record-dot-preprocessor ==0.2.6,
+             any.reanimate ==1.1.4.0,
+             any.reanimate-svg ==0.13.0.1,
+             any.rebase ==1.13.1,
+             any.record-dot-preprocessor ==0.2.13,
              any.record-hasfield ==1.0,
-             any.records-sop ==0.1.0.3,
-             any.recursion-schemes ==5.1.3,
+             any.record-wrangler ==0.1.1.0,
+             any.records-sop ==0.1.1.0,
+             any.recursion-schemes ==5.2.2.2,
              any.redis-io ==1.1.0,
              any.redis-resp ==1.0.0,
-             any.reducers ==3.12.3,
-             any.ref-fd ==0.4.0.2,
+             any.reducers ==3.12.4,
+             any.ref-fd ==0.5,
+             any.ref-tf ==0.5,
              any.refact ==0.3.0.2,
+             any.refined ==0.6.2,
              any.reflection ==2.1.6,
              any.reform ==0.2.7.4,
              any.reform-blaze ==0.2.4.3,
              any.reform-hamlet ==0.0.5.3,
-             any.reform-happstack ==0.2.5.3,
+             any.reform-happstack ==0.2.5.4,
              any.regex ==1.1.0.0,
-             any.regex-applicative ==0.3.3.1,
+             any.regex-applicative ==0.3.4,
              any.regex-applicative-text ==0.1.0.1,
-             any.regex-base ==0.94.0.0,
-             any.regex-compat ==0.95.2.0,
+             any.regex-base ==0.94.0.2,
+             any.regex-compat ==0.95.2.1,
              any.regex-compat-tdfa ==0.95.1.4,
              any.regex-pcre ==0.95.0.0,
-             any.regex-pcre-builtin ==0.95.1.2.8.43,
-             any.regex-posix ==0.96.0.0,
-             any.regex-tdfa ==1.3.1.0,
+             any.regex-pcre-builtin ==0.95.2.3.8.44,
+             any.regex-posix ==0.96.0.1,
+             any.regex-posix-clib ==2.7,
+             any.regex-tdfa ==1.3.1.1,
              any.regex-with-pcre ==1.1.0.0,
-             any.registry ==0.1.9.3,
+             any.registry ==0.2.0.3,
              any.reinterpret-cast ==0.1.0,
              any.relapse ==1.0.0.0,
-             any.relational-query ==0.12.2.3,
+             any.relational-query ==0.12.3.0,
              any.relational-query-HDBC ==0.7.2.0,
              any.relational-record ==0.2.2.0,
              any.relational-schemas ==0.1.8.0,
+             any.reliable-io ==0.0.1,
              any.relude ==0.7.0.0,
              any.renderable ==0.2.0.1,
-             any.replace-attoparsec ==1.4.1.0,
-             any.replace-megaparsec ==1.4.2.0,
-             any.repline ==0.2.2.0,
-             any.req ==3.2.0,
-             any.req-conduit ==1.0.0,
-             any.rerebase ==1.6.1,
+             any.replace-attoparsec ==1.4.5.0,
+             any.replace-megaparsec ==1.4.4.0,
+             any.repline ==0.4.0.0,
+             any.req ==3.9.0,
+             any.req-conduit ==1.0.1,
+             any.rerebase ==1.13.1,
+             any.rescue ==0.4.2.1,
+             any.resistor-cube ==0.0.1.2,
              any.resolv ==0.1.2.0,
              any.resource-pool ==0.2.3.2,
-             any.resourcet ==1.2.4.2,
+             any.resourcet ==1.2.4.3,
              any.result ==0.2.6.0,
              any.rethinkdb-client-driver ==0.0.25,
              any.retry ==0.8.1.2,
              any.rev-state ==0.1.2,
              any.rfc1751 ==0.1.3,
-             any.rfc5051 ==0.1.0.4,
-             any.rhine ==0.6.0,
-             any.rhine-gloss ==0.6.0.1,
+             any.rfc5051 ==0.2,
+             any.rhbzquery ==0.4.4,
+             any.rhine ==0.7.0,
+             any.rhine-gloss ==0.7.0,
              any.rigel-viz ==0.2.0.0,
-             any.rio ==0.1.18.0,
-             any.rio-orphans ==0.1.1.0,
+             any.rio ==0.1.21.0,
+             any.rio-orphans ==0.1.2.0,
              any.rio-prettyprint ==0.1.1.0,
              any.roc-id ==0.1.0.0,
              any.rocksdb-haskell ==1.0.1,
-             any.rocksdb-query ==0.3.2,
-             any.roles ==0.2.0.0,
-             any.rope-utf16-splay ==0.3.1.0,
+             any.rocksdb-haskell-jprupp ==2.1.3,
+             any.rocksdb-query ==0.4.2,
+             any.roles ==0.2.1.0,
+             any.rope-utf16-splay ==0.3.2.0,
              any.rosezipper ==0.2,
              any.rot13 ==0.2.0.1,
-             any.rpmbuild-order ==0.3.1,
+             any.rp-tree ==0.6,
+             any.rpm-nvr ==0.1.1,
+             any.rpmbuild-order ==0.4.5,
              any.runmemo ==1.0.0.1,
+             any.rvar ==0.2.0.6,
              any.safe ==0.3.19,
-             any.safe-decimal ==0.2.0.0,
-             any.safe-exceptions ==0.1.7.1,
-             any.safe-exceptions-checked ==0.1.0,
+             any.safe-coloured-text ==0.1.0.0,
+             any.safe-coloured-text-terminfo ==0.0.0.0,
+             any.safe-decimal ==0.2.1.0,
+             any.safe-exceptions ==0.1.7.2,
              any.safe-foldable ==0.1.0.0,
-             any.safe-json ==1.1.1,
-             any.safe-money ==0.9,
-             any.safecopy ==0.10.3,
+             any.safe-json ==1.1.1.1,
+             any.safe-money ==0.9.1,
+             any.safe-tensor ==0.2.1.1,
+             any.safecopy ==0.10.4.2,
              any.safeio ==0.0.5.0,
-             any.salak ==0.3.6,
-             any.salak-yaml ==0.3.5.3,
-             any.saltine ==0.1.1.0,
-             any.salve ==1.0.10,
+             any.saltine ==0.1.1.1,
+             any.salve ==1.0.11,
              any.sample-frame ==0.0.3,
              any.sample-frame-np ==0.0.4.1,
              any.sampling ==0.3.5,
+             any.sandwich ==0.1.0.9,
+             any.sandwich-quickcheck ==0.1.0.6,
+             any.sandwich-slack ==0.1.0.6,
+             any.sandwich-webdriver ==0.1.0.6,
              any.say ==0.1.0.1,
              any.sbp ==2.6.3,
+             any.sbv ==8.15,
              any.scalpel ==0.6.2,
              any.scalpel-core ==0.6.2,
              any.scanf ==0.1.0.0,
              any.scanner ==0.3.1,
-             any.scheduler ==1.4.2.3,
-             any.scientific ==0.3.6.2,
-             any.scotty ==0.11.6,
+             any.scheduler ==1.5.0,
+             any.scientific ==0.3.7.0,
+             any.scotty ==0.12,
              any.scrypt ==0.5.0,
-             any.sdl2 ==2.5.2.0,
+             any.sdl2 ==2.5.3.0,
              any.sdl2-gfx ==0.2,
              any.sdl2-image ==2.0.0,
              any.sdl2-mixer ==1.1.0,
-             any.sdl2-ttf ==2.1.1,
+             any.sdl2-ttf ==2.1.2,
              any.search-algorithms ==0.3.1,
-             any.secp256k1-haskell ==0.2.5,
+             any.secp256k1-haskell ==0.5.0,
              any.securemem ==0.1.10,
              any.selda ==0.5.1.0,
              any.selda-json ==0.1.1.0,
-             any.selective ==0.4.1.1,
+             any.selda-postgresql ==0.1.8.1,
+             any.selda-sqlite ==0.1.7.1,
+             any.selections ==0.3.0.0,
+             any.selective ==0.4.2,
              any.semialign ==1.1.0.1,
              any.semialign-indexed ==1.1,
              any.semialign-optics ==1.1,
              any.semigroupoid-extras ==5,
-             any.semigroupoids ==5.3.4,
-             any.semigroups ==0.19.1,
+             any.semigroupoids ==5.3.6,
+             any.semigroups ==0.19.2,
              any.semiring-simple ==1.0.0.1,
-             any.semirings ==0.5.4,
-             any.semver ==0.3.4,
+             any.semirings ==0.6,
+             any.semver ==0.4.0.1,
              any.sendfile ==0.7.11.1,
+             any.sendgrid-v3 ==0.3.0.0,
              any.seqalign ==0.2.0.4,
-             any.sequence-formats ==1.4.1,
-             any.sequenceTools ==1.4.0.5,
+             any.seqid ==0.6.2,
+             any.seqid-streams ==0.7.2,
+             any.sequence-formats ==1.6.1,
+             any.sequenceTools ==1.5.0,
              any.serf ==0.1.1.0,
-             any.serialise ==0.2.3.0,
-             any.servant-JuicyPixels ==0.3.0.5,
-             any.servant-auth ==0.3.2.0,
+             any.serialise ==0.2.4.0,
+             any.servant-auth ==0.4.0.0,
+             any.servant-auth-client ==0.4.1.0,
              any.servant-auth-docs ==0.2.10.0,
-             any.servant-auth-server ==0.4.5.1,
-             any.servant-auth-swagger ==0.2.10.0,
-             any.servant-blaze ==0.9,
-             any.servant-cassava ==0.10,
-             any.servant-checked-exceptions ==2.2.0.0,
-             any.servant-checked-exceptions-core ==2.2.0.0,
+             any.servant-auth-server ==0.4.6.0,
+             any.servant-auth-swagger ==0.2.10.1,
+             any.servant-auth-wordpress ==1.0.0.2,
+             any.servant-blaze ==0.9.1,
              any.servant-conduit ==0.15.1,
-             any.servant-docs ==0.11.4,
-             any.servant-docs-simple ==0.2.0.1,
+             any.servant-docs ==0.11.9,
              any.servant-elm ==0.7.2,
              any.servant-errors ==0.1.6.0,
-             any.servant-foreign ==0.15,
-             any.servant-js ==0.9.4.2,
-             any.servant-lucid ==0.9,
+             any.servant-exceptions ==0.2.1,
+             any.servant-exceptions-server ==0.2.1,
+             any.servant-foreign ==0.15.4,
+             any.servant-http-streams ==0.18.3,
              any.servant-machines ==0.15.1,
              any.servant-mock ==0.8.7,
-             any.servant-multipart ==0.11.5,
-             any.servant-pipes ==0.15.2,
-             any.servant-purescript ==0.10.0.0,
-             any.servant-rawm ==0.3.2.0,
-             any.servant-static-th ==0.2.4.0,
-             any.servant-subscriber ==0.7.0.0,
-             any.servant-swagger-ui ==0.3.4.3.36.1,
-             any.servant-swagger-ui-core ==0.3.3,
-             any.servant-swagger-ui-redoc ==0.3.3.1.22.3,
-             any.servant-yaml ==0.1.0.1,
-             any.serverless-haskell ==0.11.3,
-             any.serversession ==1.0.1,
+             any.servant-multipart ==0.12.1,
+             any.servant-multipart-api ==0.12.1,
+             any.servant-openapi3 ==2.0.1.2,
+             any.servant-pipes ==0.15.3,
+             any.servant-rawm ==1.0.0.0,
+             any.servant-swagger-ui ==0.3.5.3.52.5,
+             any.servant-swagger-ui-core ==0.3.5,
+             any.serverless-haskell ==0.12.6,
+             any.serversession ==1.0.2,
              any.serversession-frontend-wai ==1.0,
              any.ses-html ==0.4.0.0,
              any.set-cover ==0.1.1,
              any.setenv ==0.1.1.3,
-             any.setlocale ==1.0.0.9,
-             any.sexp-grammar ==2.1.0,
-             any.shake ==0.19.1,
-             any.shake-plus ==0.1.10.0,
+             any.setlocale ==1.0.0.10,
+             any.sexp-grammar ==2.3.3.1,
+             any.shake ==0.19.6,
+             any.shake-language-c ==0.12.0,
+             any.shake-plus ==0.3.4.0,
+             any.shake-plus-extended ==0.4.1.0,
              any.shakespeare ==2.0.25,
              any.shared-memory ==0.2.0.0,
-             any.shell-conduit ==4.7.0,
+             any.shell-conduit ==5.0.0,
              any.shell-escape ==0.2.0,
              any.shell-utility ==0.1,
-             any.shellmet ==0.0.3.1,
+             any.shellmet ==0.0.4.0,
              any.shelltestrunner ==1.9,
              any.shelly ==1.9.0,
+             any.shikensu ==0.3.11,
+             any.shortcut-links ==0.5.1.1,
              any.should-not-typecheck ==2.1.0,
              any.show-combinators ==0.2.0.0,
              any.siggy-chardust ==1.0.0,
              any.signal ==0.1.0.4,
-             any.silently ==1.2.5.1,
+             any.silently ==1.2.5.2,
              any.simple-affine-space ==0.1.1,
-             any.simple-cabal ==0.1.2,
-             any.simple-cmd ==0.2.2,
-             any.simple-cmd-args ==0.1.6,
+             any.simple-cabal ==0.1.3,
+             any.simple-cmd ==0.2.3,
+             any.simple-cmd-args ==0.1.7,
              any.simple-log ==0.9.12,
              any.simple-reflect ==0.3.3,
              any.simple-sendfile ==0.2.30,
              any.simple-templates ==1.0.0,
              any.simple-vec3 ==0.6.0.1,
-             any.simplest-sqlite ==0.1.0.2,
              any.simplistic-generics ==2.0.0,
              any.since ==0.0.0,
              any.singleton-bool ==0.1.5,
              any.singleton-nats ==0.4.5,
-             any.singletons ==2.6,
-             any.singletons-presburger ==0.3.0.1,
+             any.singletons ==2.7,
+             any.singletons-presburger ==0.6.1.0,
              any.siphash ==1.0.3,
              any.sitemap-gen ==0.1.0.0,
-             any.size-based ==0.1.2.0,
-             any.sized ==0.4.0.0,
+             any.sized ==1.0.0.0,
              any.skein ==1.0.9.4,
              any.skews ==0.1.0.3,
              any.skip-var ==0.1.1.0,
-             any.skylighting ==0.8.5,
-             any.skylighting-core ==0.8.5,
+             any.skylighting ==0.10.5.2,
+             any.skylighting-core ==0.10.5.2,
              any.slack-api ==0.12,
-             any.slist ==0.1.1.0,
-             any.smallcheck ==1.1.7,
-             any.smash ==0.1.1.0,
+             any.slack-progressbar ==0.1.0.1,
+             any.slick ==1.1.2.2,
+             any.slist ==0.2.0.0,
+             any.slynx ==0.5.1.1,
+             any.smallcheck ==1.2.1,
+             any.smash ==0.1.2,
              any.smash-aeson ==0.1.0.0,
-             any.smash-lens ==0.1.0.0,
+             any.smash-lens ==0.1.0.1,
              any.smash-microlens ==0.1.0.0,
              any.smoothie ==0.4.2.11,
-             any.smtp-mail ==0.2.0.0,
+             any.smtp-mail ==0.3.0.0,
              any.snap-blaze ==0.2.1.5,
              any.snap-core ==1.0.4.2,
-             any.snap-server ==1.1.1.2,
+             any.snap-server ==1.1.2.0,
              any.snowflake ==0.1.1.1,
              any.soap ==0.2.3.6,
+             any.soap-openssl ==0.1.0.2,
              any.soap-tls ==0.1.1.4,
+             any.socket ==0.8.3.0,
              any.socks ==0.6.1,
-             any.some ==1.0.1,
+             any.some ==1.0.2,
              any.sop-core ==0.5.0.1,
              any.sort ==1.0.0.0,
              any.sorted-list ==0.2.1.0,
-             any.sourcemap ==0.1.6,
+             any.sourcemap ==0.1.6.1,
              any.sox ==0.2.3.1,
              any.soxlib ==0.0.3.1,
+             any.spacecookie ==1.0.0.0,
              any.sparse-linear-algebra ==0.3.1,
-             any.sparse-tensor ==0.2.1.4,
+             any.sparse-tensor ==0.2.1.5,
              any.spatial-math ==0.5.0.1,
              any.special-values ==0.1.0.0,
-             any.speculate ==0.4.2,
-             any.speedy-slice ==0.3.1,
+             any.speculate ==0.4.10,
+             any.speedy-slice ==0.3.2,
              any.splice ==0.6.1.1,
+             any.splint ==1.0.1.4,
              any.split ==0.2.3.4,
-             any.splitmix ==0.0.4,
+             any.splitmix ==0.1.0.4,
+             any.splitmix-distributions ==0.9.0.0,
              any.spoon ==0.3.1,
              any.spreadsheet ==0.1.3.8,
              any.sql-words ==0.1.6.4,
              any.sqlcli ==0.2.2.0,
              any.sqlcli-odbc ==0.2.0.1,
-             any.squeather ==0.4.0.0,
-             any.srcloc ==0.5.1.2,
-             any.stache ==2.1.1,
-             any.stack ==2.3.3,
+             any.sqlite-simple ==0.4.18.0,
+             any.squeal-postgresql ==0.7.0.1,
+             any.squeather ==0.8.0.0,
+             any.srcloc ==0.6,
+             any.stache ==2.3.0,
+             any.stack ==2.7.3,
              any.stack-templatizer ==0.1.0.2,
-             any.stackcollapse-ghc ==0.0.1.2,
-             any.starter ==0.3.0,
+             any.stackcollapse-ghc ==0.0.1.3,
              any.stateref ==0.3,
-             any.statestack ==0.3,
-             any.static-text ==0.2.0.6,
+             any.static-text ==0.2.0.7,
              any.statistics ==0.15.2.0,
-             any.status-notifier-item ==0.3.0.5,
+             any.status-notifier-item ==0.3.1.0,
              any.stb-image-redux ==0.2.1.3,
              any.step-function ==0.2,
-             any.stm-chans ==3.0.0.4,
+             any.stm-chans ==3.0.0.6,
              any.stm-conduit ==4.0.1,
-             any.stm-containers ==1.1.0.4,
+             any.stm-containers ==1.2,
              any.stm-delay ==0.1.1.1,
              any.stm-extras ==0.1.0.3,
-             any.stm-hamt ==1.2.0.4,
+             any.stm-hamt ==1.2.0.6,
+             any.stm-lifted ==2.5.0.0,
              any.stm-split ==0.0.2.1,
-             any.stomp-queue ==0.3.1,
-             any.stompl ==0.5.0,
+             any.stomp-queue ==0.5.1,
+             any.stompl ==0.6.0,
              any.stopwatch ==0.1.0.6,
              any.storable-complex ==0.2.3.0,
+             any.storable-endian ==0.2.6,
              any.storable-record ==0.0.5,
              any.storable-tuple ==0.0.3.3,
              any.storablevector ==0.2.13.1,
-             any.stratosphere ==0.53.0,
+             any.store ==0.7.14,
+             any.store-core ==0.4.4.4,
+             any.store-streaming ==0.2.0.3,
+             any.stratosphere ==0.59.1,
              any.streaming ==0.2.3.0,
-             any.streaming-bytestring ==0.1.6,
-             any.streaming-commons ==0.2.2.1,
-             any.streamly ==0.7.2,
-             any.streamly-bytestring ==0.1.2,
+             any.streaming-attoparsec ==1.0.0.1,
+             any.streaming-bytestring ==0.2.1,
+             any.streaming-commons ==0.2.2.2,
+             any.streamly ==0.7.3,
              any.streams ==3.3,
-             any.strict ==0.3.2,
-             any.strict-base-types ==0.6.1,
+             any.streamt ==0.5.0.0,
+             any.strict ==0.4.0.1,
              any.strict-concurrency ==0.2.4.3,
-             any.strict-list ==0.1.5,
-             any.strict-tuple ==0.1.3,
+             any.strict-list ==0.1.6,
+             any.strict-tuple ==0.1.4,
              any.strict-tuple-lens ==0.1.0.1,
              any.string-class ==0.1.7.0,
              any.string-combinators ==0.6.0.5,
              any.string-conv ==0.1.2,
              any.string-conversions ==0.4.0.1,
-             any.string-interpolate ==0.2.1.0,
+             any.string-interpolate ==0.3.1.1,
              any.string-qq ==0.0.4,
+             any.string-random ==0.1.4.1,
              any.string-transform ==1.1.1,
              any.stringbuilder ==0.5.1,
              any.stringsearch ==0.3.6.6,
-             any.stripe-concepts ==1.0.2.4,
-             any.stripe-signature ==1.0.0.6,
-             any.strive ==5.0.12,
-             any.structs ==0.1.3,
-             any.structured ==0.1,
-             any.structured-cli ==2.5.2.0,
-             any.stylish-haskell ==0.11.0.3,
+             any.stripe-concepts ==1.0.3,
+             any.stripe-core ==2.6.2,
+             any.stripe-haskell ==2.6.2,
+             any.stripe-http-client ==2.6.2,
+             any.strive ==5.0.16,
+             any.structs ==0.1.6,
+             any.structured ==0.1.1,
+             any.structured-cli ==2.7.0.1,
+             any.subcategories ==0.1.1.0,
              any.sum-type-boilerplate ==0.1.1,
-             any.summoner ==2.0.1.1,
-             any.summoner-tui ==2.0.1.1,
              any.sundown ==0.6,
              any.superbuffer ==0.3.1.1,
-             any.svg-builder ==0.1.1,
              any.svg-tree ==0.6.2.4,
              any.swagger ==0.3.0,
-             any.swagger2 ==2.5,
-             any.swish ==0.10.0.4,
-             any.syb ==0.7.1,
+             any.swagger2 ==2.6,
+             any.sweet-egison ==0.1.1.3,
+             any.swish ==0.10.0.8,
+             any.syb ==0.7.2.1,
+             any.sydtest ==0.2.0.0,
+             any.sydtest-discover ==0.0.0.1,
+             any.sydtest-persistent-sqlite ==0.1.0.0,
+             any.sydtest-servant ==0.1.0.0,
+             any.sydtest-wai ==0.1.0.0,
+             any.sydtest-yesod ==0.1.0.0,
              any.symbol ==0.2.4,
              any.symengine ==0.1.2.0,
              any.symmetry-operations-symbols ==0.0.2.1,
@@ -2118,12 +2333,11 @@ constraints: any.AC-Angle ==1.0,
              any.system-argv0 ==0.1.1,
              any.system-fileio ==0.3.16.4,
              any.system-filepath ==0.4.14,
-             any.system-info ==0.5.1,
+             any.system-info ==0.5.2,
              any.systemd ==2.3.0,
              any.tabular ==0.2.2.8,
-             any.taffybar ==3.2.2,
              any.tagchup ==0.4.1.1,
-             any.tagged ==0.8.6,
+             any.tagged ==0.8.6.1,
              any.tagged-binary ==0.2.0.1,
              any.tagged-identity ==0.1.3,
              any.tagged-transformer ==0.8.1,
@@ -2134,98 +2348,108 @@ constraints: any.AC-Angle ==1.0,
              tar -old-time,
              any.tar ==0.5.1.1,
              any.tar-conduit ==0.3.2,
-             any.tardis ==0.4.1.0,
-             any.tasty ==1.2.3,
-             any.tasty-ant-xml ==1.1.6,
-             any.tasty-dejafu ==2.0.0.6,
-             any.tasty-discover ==4.2.1,
-             any.tasty-expected-failure ==0.11.1.2,
-             any.tasty-golden ==2.3.3.2,
-             any.tasty-hedgehog ==1.0.0.2,
-             any.tasty-hspec ==1.1.5.1,
-             any.tasty-hunit ==0.10.0.2,
+             any.tardis ==0.4.3.0,
+             any.tasty ==1.4.2,
+             any.tasty-ant-xml ==1.1.8,
+             any.tasty-bench ==0.2.5,
+             any.tasty-dejafu ==2.0.0.8,
+             any.tasty-discover ==4.2.2,
+             any.tasty-expected-failure ==0.12.3,
+             any.tasty-focus ==1.0.1,
+             any.tasty-golden ==2.3.4,
+             any.tasty-hedgehog ==1.1.0.0,
+             any.tasty-hspec ==1.1.6,
+             any.tasty-hunit ==0.10.0.3,
+             any.tasty-hunit-compat ==0.2.0.1,
+             any.tasty-inspection-testing ==0.1,
              any.tasty-kat ==0.0.3,
-             any.tasty-leancheck ==0.0.1,
-             any.tasty-lua ==0.2.3,
+             any.tasty-leancheck ==0.0.2,
+             any.tasty-lua ==0.2.3.2,
              any.tasty-program ==1.0.5,
-             any.tasty-quickcheck ==0.10.1.1,
-             any.tasty-rerun ==1.1.17,
-             any.tasty-silver ==3.1.15,
-             any.tasty-smallcheck ==0.8.1,
+             any.tasty-quickcheck ==0.10.1.2,
+             any.tasty-rerun ==1.1.18,
+             any.tasty-silver ==3.2.3,
+             any.tasty-smallcheck ==0.8.2,
+             any.tasty-test-reporter ==0.1.1.4,
              any.tasty-th ==0.1.7,
-             any.tasty-wai ==0.1.1.0,
+             any.tasty-wai ==0.1.1.1,
              any.tce-conf ==1.3,
-             any.tdigest ==0.2.1,
+             any.tdigest ==0.2.1.1,
              any.template ==0.2.0.10,
-             any.template-haskell-compat-v0208 ==0.1.5,
+             any.template-haskell-compat-v0208 ==0.1.7,
              any.temporary ==1.3,
              any.temporary-rc ==1.2.0.3,
              any.temporary-resourcet ==0.1.0.1,
              any.tensorflow-test ==0.1.0.0,
-             any.tensors ==0.1.4,
+             any.tensors ==0.1.5,
+             any.termbox ==0.3.0,
              any.terminal-progress-bar ==0.4.1,
              any.terminal-size ==0.3.2.1,
              any.test-framework ==0.8.2.0,
              any.test-framework-hunit ==0.3.0.2,
-             any.test-framework-leancheck ==0.0.1,
+             any.test-framework-leancheck ==0.0.4,
              any.test-framework-quickcheck2 ==0.3.0.5,
              any.test-framework-smallcheck ==0.2,
-             any.test-framework-th ==0.2.4,
-             any.testing-feat ==1.1.0.0,
+             any.test-fun ==0.1.0.0,
              any.testing-type-modifiers ==0.1.0.1,
-             any.texmath ==0.12.0.2,
+             any.texmath ==0.12.3.2,
+             any.text-ansi ==0.1.1,
              any.text-binary ==0.2.1.1,
-             any.text-builder ==0.6.6.1,
-             any.text-conversions ==0.3.0,
+             any.text-builder ==0.6.6.3,
+             any.text-conversions ==0.3.1,
              any.text-format ==0.3.2,
-             any.text-icu ==0.7.0.1,
+             any.text-icu ==0.7.1.0,
              any.text-icu-translit ==0.1.0.7,
              any.text-latin1 ==0.3.1,
-             any.text-ldap ==0.1.1.13,
-             any.text-manipulate ==0.2.0.1,
-             any.text-metrics ==0.3.0,
+             any.text-ldap ==0.1.1.14,
+             any.text-manipulate ==0.3.0.0,
+             any.text-metrics ==0.3.1,
              any.text-postgresql ==0.0.3.1,
-             any.text-printer ==0.5.0.1,
+             any.text-printer ==0.5.0.2,
+             any.text-regex-replace ==0.1.1.4,
              any.text-region ==0.3.1.0,
              any.text-short ==0.1.3,
-             any.text-show ==3.8.5,
-             any.text-show-instances ==3.8.3,
-             any.text-zipper ==0.10.1,
+             any.text-show ==3.9.2,
+             any.text-show-instances ==3.8.4,
+             any.text-zipper ==0.11,
              any.textlocal ==0.1.0.5,
              any.tf-random ==0.5,
-             any.tfp ==1.0.1.1,
-             any.th-abstraction ==0.3.2.0,
+             any.tfp ==1.0.2,
+             any.th-abstraction ==0.4.3.0,
              any.th-bang-compat ==0.0.1.0,
+             any.th-compat ==0.1.3,
              any.th-constraint-compat ==0.0.1.0,
              any.th-data-compat ==0.1.0.0,
-             any.th-desugar ==1.10,
-             any.th-env ==0.1.0.2,
-             any.th-expand-syns ==0.4.6.0,
-             any.th-extras ==0.0.0.4,
-             any.th-lift ==0.8.1,
-             any.th-lift-instances ==0.1.17,
+             any.th-desugar ==1.11,
+             any.th-env ==0.1.0.3,
+             any.th-expand-syns ==0.4.8.0,
+             any.th-extras ==0.0.0.5,
+             any.th-lift ==0.8.2,
+             any.th-lift-instances ==0.1.18,
              any.th-nowq ==0.1.0.5,
-             any.th-orphans ==0.13.10,
+             any.th-orphans ==0.13.12,
              any.th-printf ==0.7,
              any.th-reify-compat ==0.0.1.5,
-             any.th-reify-many ==0.1.9,
+             any.th-reify-many ==0.1.10,
              any.th-strict-compat ==0.1.0.1,
-             any.th-test-utils ==1.0.2,
+             any.th-test-utils ==1.1.1,
+             any.th-utilities ==0.2.4.3,
              any.these ==1.1.1.1,
-             any.these-lens ==1.0.0.1,
-             any.these-optics ==1,
+             any.these-lens ==1.0.1.2,
+             any.these-optics ==1.0.1.2,
+             any.these-skinny ==0.7.4,
              any.thread-hierarchy ==0.3.0.2,
              any.thread-local-storage ==0.2,
-             any.thread-supervisor ==0.1.0.1,
+             any.thread-supervisor ==0.2.0.0,
              any.threads ==0.5.1.6,
-             any.threepenny-gui ==0.9.0.0,
+             any.threepenny-gui ==0.9.1.0,
              any.throttle-io-stream ==0.2.0.1,
              any.through-text ==0.1.0.0,
              any.throwable-exceptions ==0.1.0.9,
              any.thyme ==0.3.5.5,
-             any.tidal ==1.5.2,
+             any.tidal ==1.7.8,
              any.tile ==0.3.0.0,
-             any.time-compat ==1.9.3,
+             any.time-compat ==1.9.5,
              any.time-lens ==0.4.0.2,
              time-locale-compat -old-locale,
              any.time-locale-compat ==0.1.1.5,
@@ -2235,175 +2459,195 @@ constraints: any.AC-Angle ==1.0,
              any.time-units ==1.0.0,
              any.timeit ==2.0,
              any.timelens ==0.2.0.2,
-             any.timerep ==2.0.0.2,
+             any.timer-wheel ==0.3.0,
+             any.timerep ==2.0.1.0,
              any.timezone-olson ==0.2.0,
              any.timezone-series ==0.1.9,
              any.tinylog ==0.15.0,
              any.titlecase ==1.0.1,
-             any.tldr ==0.6.4,
+             any.tldr ==0.9.2,
              any.tls ==1.5.5,
              any.tls-debug ==0.4.8,
              any.tls-session-manager ==0.0.4,
+             any.tlynx ==0.5.1.1,
              any.tmapchan ==0.0.3,
              any.tmapmvar ==0.0.4,
              any.tmp-postgres ==1.34.1.0,
-             any.tomland ==1.3.0.0,
-             any.tonalude ==0.1.1.0,
+             any.tomland ==1.3.2.0,
+             any.tonalude ==0.1.1.1,
              any.topograph ==1.0.0.1,
              any.torsor ==0.1,
              any.tostring ==0.2.1.1,
-             any.tracing ==0.0.5.1,
+             any.tracing ==0.0.7.2,
              any.transaction ==0.1.1.3,
-             any.transformers-base ==0.4.5.2,
+             any.transformers-base ==0.4.6,
              any.transformers-bifunctors ==0.1,
              transformers-compat +five-three,
-             any.transformers-compat ==0.6.5,
+             any.transformers-compat ==0.6.6,
              any.transformers-fix ==1.0,
-             any.traverse-with-class ==1.0.1.0,
-             any.tree-diff ==0.1,
+             any.traverse-with-class ==1.0.1.1,
+             any.tree-diff ==0.2.1,
              any.tree-fun ==0.8.1.0,
-             any.trifecta ==2.1,
+             any.tree-view ==0.5.1,
+             any.trifecta ==2.1.2,
              any.triplesec ==0.2.2.1,
-             any.trivial-constraint ==0.6.0.0,
+             any.trivial-constraint ==0.7.0.0,
              any.tsv2csv ==0.1.0.2,
-             any.ttc ==0.2.2.0,
+             any.ttc ==1.1.0.2,
              any.ttl-hashtables ==1.4.1.0,
-             any.ttrie ==0.1.2.1,
+             any.ttrie ==0.1.2.2,
              any.tuple ==0.3.0.2,
              any.tuple-sop ==0.3.1.0,
              any.tuple-th ==0.2.5,
              any.tuples-homogenous-h98 ==0.1.1.0,
-             any.turtle ==1.5.20,
+             any.turtle ==1.5.23,
              any.type-equality ==1,
              any.type-errors ==0.2.0.0,
-             any.type-errors-pretty ==0.0.1.1,
-             any.type-fun ==0.1.1,
+             any.type-errors-pretty ==0.0.1.2,
              any.type-hint ==0.1,
              any.type-level-integers ==0.0.1,
              any.type-level-kv-list ==1.1.0,
+             any.type-level-natural-number ==2.0,
              any.type-level-numbers ==0.1.1.1,
              any.type-map ==0.1.6.0,
-             any.type-natural ==0.8.3.1,
-             any.type-of-html ==1.5.1.0,
+             any.type-natural ==1.1.0.0,
+             any.type-of-html ==1.6.2.0,
              any.type-of-html-static ==0.1.0.2,
              any.type-operators ==0.2.0.0,
              any.type-spec ==0.4.0.0,
-             any.typed-process ==0.2.6.0,
-             any.typed-uuid ==0.0.0.2,
-             any.typenums ==0.1.2.1,
+             any.typecheck-plugin-nat-simple ==0.1.0.2,
+             any.typed-process ==0.2.7.0,
+             any.typed-uuid ==0.1.0.0,
+             any.typelits-witnesses ==0.4.0.0,
+             any.typenums ==0.1.4,
              any.typerep-map ==0.3.3.0,
-             any.tzdata ==0.1.20190911.0,
-             any.ua-parser ==0.7.5.1,
+             any.tzdata ==0.2.20201021.0,
+             any.ua-parser ==0.7.6.0,
              any.uglymemo ==0.1.0.1,
-             any.ulid ==0.3.0.0,
              any.unagi-chan ==0.4.1.3,
-             any.unbounded-delays ==0.1.1.0,
+             any.unbounded-delays ==0.1.1.1,
              any.unboxed-ref ==0.4.0.0,
-             any.unboxing-vector ==0.1.1.0,
+             any.unboxing-vector ==0.2.0.0,
+             any.uncaught-exception ==0.1.0,
              any.uncertain ==0.3.1.0,
              any.unconstrained ==0.1.0.2,
              any.unexceptionalio ==0.5.1,
              any.unexceptionalio-trans ==0.5.1,
              any.unicode ==0.0.1.1,
-             any.unicode-show ==0.1.0.4,
-             any.unicode-transforms ==0.3.7,
-             any.unification-fd ==0.10.0.1,
+             any.unicode-collation ==0.1.3.1,
+             any.unicode-show ==0.1.1.0,
+             any.unicode-transforms ==0.3.7.1,
+             any.unification-fd ==0.11.1,
+             any.union-angle ==0.1.0.1,
              any.union-find ==0.2,
-             any.uniplate ==1.6.12,
+             any.unipatterns ==0.0.0.0,
+             any.uniplate ==1.6.13,
              any.uniprot-kb ==0.1.2.0,
-             any.uniq-deep ==1.2.0,
-             any.unique ==0,
+             any.uniq-deep ==1.2.1,
+             any.unique ==0.0.1,
              any.unique-logic ==0.4,
              any.unique-logic-tf ==0.5.1,
              any.unit-constraint ==0.0.0,
-             any.universe ==1.2,
-             any.universe-base ==1.1.1,
+             any.universe ==1.2.1,
+             any.universe-base ==1.1.2,
+             any.universe-dependent-sum ==1.3,
              any.universe-instances-base ==1.1,
-             any.universe-instances-extended ==1.1.1,
+             any.universe-instances-extended ==1.1.2,
              any.universe-instances-trans ==1.1,
-             any.universe-reverse-instances ==1.1,
-             any.universe-some ==1.2,
-             any.universum ==1.6.1,
-             any.unix-bytestring ==0.3.7.3,
-             any.unix-compat ==0.5.2,
+             any.universe-reverse-instances ==1.1.1,
+             any.universe-some ==1.2.1,
+             any.universum ==1.7.2,
+             any.unix-bytestring ==0.3.7.6,
+             any.unix-compat ==0.5.3,
              any.unix-time ==0.4.7,
-             any.unliftio ==0.2.13,
-             any.unliftio-core ==0.1.2.0,
+             any.unliftio ==0.2.20,
+             any.unliftio-core ==0.2.0.1,
              any.unliftio-pool ==0.2.1.1,
+             any.unliftio-streams ==0.1.1.1,
              any.unlit ==0.4.0.0,
-             any.unordered-containers ==0.2.10.0,
-             any.unordered-intmap ==0.1.1,
+             any.unordered-containers ==0.2.15.0,
              any.unsafe ==0.0,
              any.urbit-hob ==0.3.3,
-             any.uri-bytestring ==0.3.2.2,
+             any.uri-bytestring ==0.3.3.1,
              any.uri-bytestring-aeson ==0.1.0.8,
-             any.uri-encode ==1.5.0.6,
+             any.uri-encode ==1.5.0.7,
              any.url ==2.1.3,
              any.users ==0.5.0.0,
              any.utf8-conversions ==0.1.0.4,
              any.utf8-light ==0.4.2,
-             any.utf8-string ==1.0.1.1,
+             any.utf8-string ==1.0.2,
              any.util ==0.1.17.1,
-             any.utility-ht ==0.0.15,
-             any.uuid ==1.3.13,
-             any.uuid-types ==1.0.3,
-             any.validation ==1.1,
-             any.validation-selective ==0.1.0.0,
-             any.validity ==0.11.0.0,
+             any.utility-ht ==0.0.16,
+             any.uuid ==1.3.15,
+             any.uuid-types ==1.0.5,
+             any.validation ==1.1.2,
+             any.validation-selective ==0.1.0.1,
+             any.validity ==0.11.0.1,
              any.validity-aeson ==0.2.0.4,
              any.validity-bytestring ==0.4.1.1,
              any.validity-containers ==0.5.0.4,
              any.validity-path ==0.4.0.1,
+             any.validity-persistent ==0.0.0.0,
              any.validity-primitive ==0.0.0.1,
              any.validity-scientific ==0.2.0.3,
              any.validity-text ==0.3.1.1,
-             any.validity-time ==0.3.0.0,
+             any.validity-time ==0.4.0.0,
              any.validity-unordered-containers ==0.2.0.3,
              any.validity-uuid ==0.1.0.3,
              any.validity-vector ==0.2.0.3,
              any.valor ==0.1.0.0,
-             any.vault ==0.3.1.4,
-             any.vec ==0.3,
-             any.vector ==0.12.1.2,
-             any.vector-algorithms ==0.8.0.3,
-             any.vector-binary-instances ==0.2.5.1,
+             any.vault ==0.3.1.5,
+             any.vcs-ignore ==0.0.1.0,
+             any.vec ==0.4,
+             any.vector ==0.12.3.1,
+             any.vector-algorithms ==0.8.0.4,
+             any.vector-binary-instances ==0.2.5.2,
              any.vector-buffer ==0.4.1,
-             any.vector-builder ==0.3.8,
+             any.vector-builder ==0.3.8.2,
              any.vector-bytes-instances ==0.1.1,
+             any.vector-circular ==0.1.3,
              any.vector-instances ==3.4,
              any.vector-mmap ==0.0.3,
-             any.vector-rotcev ==0.1.0.0,
-             any.vector-sized ==1.4.2,
+             any.vector-rotcev ==0.1.0.1,
+             any.vector-sized ==1.4.4,
              any.vector-space ==0.16,
              any.vector-split ==1.0.0.2,
-             any.vector-th-unbox ==0.2.1.7,
+             any.vector-th-unbox ==0.2.2,
              any.verbosity ==0.4.0.0,
-             any.versions ==3.5.4,
+             any.versions ==5.0.0,
              any.vformat ==0.14.1.0,
              any.vformat-aeson ==0.1.0.1,
              any.vformat-time ==0.1.0.0,
+             any.vinyl ==0.13.3,
              any.void ==0.7.3,
-             any.vty ==5.28.2,
-             any.wai ==3.2.2.1,
+             any.vty ==5.33,
+             any.wai ==3.2.3,
              any.wai-app-static ==3.1.7.2,
              any.wai-conduit ==3.0.0.4,
              any.wai-cors ==0.2.7,
              any.wai-enforce-https ==0.0.2.1,
              any.wai-eventsource ==3.0.0,
-             any.wai-extra ==3.0.29.2,
+             any.wai-extra ==3.1.7,
+             any.wai-feature-flags ==0.1.0.2,
              any.wai-handler-launch ==3.0.3.1,
              any.wai-logger ==2.3.6,
+             any.wai-middleware-auth ==0.2.5.1,
              any.wai-middleware-caching ==0.1.0.2,
              any.wai-middleware-clacks ==0.1.0.1,
              any.wai-middleware-gunzip ==0.0.2,
-             any.wai-middleware-static ==0.8.3,
+             any.wai-middleware-static ==0.9.1,
              any.wai-predicates ==1.0.0,
+             any.wai-rate-limit ==0.1.0.0,
+             any.wai-rate-limit-redis ==0.1.0.0,
              any.wai-route ==0.4.0,
+             any.wai-saml2 ==0.2.1.2,
              any.wai-session ==0.3.3,
+             any.wai-session-redis ==0.1.0.4,
              any.wai-slack-middleware ==0.2.0,
              any.wai-websockets ==3.0.1.2,
+             any.wakame ==0.1.0.0,
              any.warp ==3.3.17,
-             any.warp-tls ==3.2.12,
+             any.warp-tls ==3.3.2,
              any.warp-tls-uid ==0.2.0.6,
              any.wave ==0.2.0,
              any.wcwidth ==0.0.2,
@@ -2411,21 +2655,22 @@ constraints: any.AC-Angle ==1.0,
              any.webex-teams-api ==0.2.0.1,
              any.webex-teams-conduit ==0.2.0.1,
              any.webex-teams-pipes ==0.2.0.1,
+             any.webgear-server ==0.2.1,
              any.webrtc-vad ==0.1.0.3,
-             any.websockets ==0.12.7.1,
+             any.websockets ==0.12.7.3,
              any.websockets-snap ==0.10.3.1,
              any.weigh ==0.0.16,
-             any.wide-word ==0.1.1.1,
-             any.wikicfp-scraper ==0.1.0.11,
-             any.wild-bind ==0.1.2.6,
-             any.wild-bind-x11 ==0.2.0.10,
+             any.wide-word ==0.1.1.2,
+             any.wikicfp-scraper ==0.1.0.12,
+             any.wild-bind ==0.1.2.7,
+             any.wild-bind-x11 ==0.2.0.13,
              windns +allow-non-windows,
              any.windns ==0.1.0.1,
+             any.witch ==0.3.4.0,
              any.with-location ==0.1.0,
-             any.with-utf8 ==1.0.2.1,
-             any.witherable-class ==0,
-             any.within ==0.1.1.0,
-             any.witness ==0.4,
+             any.with-utf8 ==1.0.2.3,
+             any.witherable ==0.4.2,
+             any.within ==0.2.0.1,
              any.wizards ==1.0.3,
              any.wl-pprint-annotated ==0.1.0.1,
              any.wl-pprint-console ==0.1.0.2,
@@ -2434,34 +2679,33 @@ constraints: any.AC-Angle ==1.0,
              any.word-wrap ==0.4.1,
              any.word24 ==2.0.1,
              any.word8 ==0.1.3,
+             any.wordpress-auth ==1.0.0.1,
              any.world-peace ==1.0.2.0,
              any.wrap ==0.0.0,
-             any.wreq ==0.5.3.2,
+             any.wreq ==0.5.3.3,
              any.writer-cps-exceptions ==0.1.0.1,
              any.writer-cps-mtl ==0.1.1.6,
              any.writer-cps-transformers ==0.5.6.1,
              any.wss-client ==0.3.0.0,
-             any.wuss ==1.1.17,
+             any.wuss ==1.1.18,
              any.x11-xim ==0.0.9.0,
              any.x509 ==1.7.5,
              any.x509-system ==1.6.6,
              any.x509-validation ==1.6.11,
              any.xdg-basedir ==0.2.2,
-             any.xdg-desktop-entry ==0.1.1.1,
              any.xdg-userdirs ==0.1.0.2,
-             any.xeno ==0.4.2,
-             any.xls ==0.1.3,
-             any.xlsx ==0.8.1,
+             any.xeno ==0.4.3,
+             any.xlsx ==0.8.4,
              any.xlsx-tabular ==0.2.2.1,
              any.xml ==1.3.14,
              any.xml-basic ==0.1.3.1,
-             any.xml-conduit ==1.9.0.0,
+             any.xml-conduit ==1.9.1.1,
              any.xml-conduit-writer ==0.1.1.2,
              any.xml-hamlet ==0.5.0.1,
              any.xml-helpers ==1.0.0,
              any.xml-html-qq ==0.1.0.1,
              any.xml-indexed-cursor ==0.1.1.0,
-             any.xml-lens ==0.2,
+             any.xml-lens ==0.3,
              any.xml-picklers ==0.3.6,
              any.xml-to-json ==2.0.1,
              any.xml-to-json-fast ==2.0.0,
@@ -2469,46 +2713,51 @@ constraints: any.AC-Angle ==1.0,
              any.xmlgen ==0.6.2.2,
              any.xmonad ==0.15,
              any.xmonad-contrib ==0.16,
-             any.xmonad-extras ==0.15.2,
+             any.xmonad-extras ==0.15.3,
              any.xss-sanitize ==0.3.6,
-             any.xturtle ==0.2.0.0,
              any.xxhash-ffi ==0.2.0.0,
-             any.yaml ==0.11.5.0,
-             any.yamlparse-applicative ==0.1.0.1,
+             any.yaml ==0.11.7.0,
+             any.yamlparse-applicative ==0.2.0.1,
              any.yes-precure5-command ==5.5.3,
-             any.yesod ==1.6.1.0,
-             any.yesod-auth ==1.6.10,
-             any.yesod-auth-fb ==1.10.1,
-             any.yesod-auth-hashdb ==1.7.1.2,
-             any.yesod-bin ==1.6.0.6,
-             any.yesod-core ==1.6.18,
+             any.yesod ==1.6.1.2,
+             any.yesod-auth ==1.6.10.5,
+             any.yesod-auth-hashdb ==1.7.1.7,
+             any.yesod-auth-oauth2 ==0.6.3.4,
+             any.yesod-bin ==1.6.1,
+             any.yesod-core ==1.6.21.0,
              any.yesod-fb ==0.6.1,
-             any.yesod-form ==1.6.7,
-             any.yesod-form-bootstrap4 ==3.0.0,
-             any.yesod-gitrev ==0.2.1,
+             any.yesod-form ==1.7.0,
+             any.yesod-gitrev ==0.2.2,
+             any.yesod-markdown ==0.12.6.12,
              any.yesod-newsfeed ==1.7.0.0,
-             any.yesod-persistent ==1.6.0.4,
-             any.yesod-recaptcha2 ==1.0.1,
+             any.yesod-page-cursor ==2.0.0.9,
+             any.yesod-paginator ==1.1.1.0,
+             any.yesod-persistent ==1.6.0.7,
              any.yesod-sitemap ==1.6.0,
              any.yesod-static ==1.6.1.0,
-             any.yesod-test ==1.6.10,
-             any.yesod-websockets ==0.3.0.2,
+             any.yesod-test ==1.6.12,
+             any.yesod-websockets ==0.3.0.3,
              any.yi-rope ==0.11,
              any.yjsvg ==0.2.0.1,
              any.yjtools ==0.9.18,
              any.yoga ==0.0.0.5,
              any.youtube ==0.2.1.1,
-             any.zasni-gerna ==0.0.7.1,
+             any.zenacy-html ==2.0.4,
+             any.zenacy-unicode ==1.0.1,
              any.zero ==0.1.5,
              any.zeromq4-haskell ==0.8.0,
              any.zeromq4-patterns ==0.3.1.0,
              any.zim-parser ==0.2.1.0,
-             any.zip ==1.5.0,
+             any.zio ==0.1.0.2,
+             any.zip ==1.7.2,
              any.zip-archive ==0.4.1,
-             any.zip-stream ==0.2.0.1,
-             any.zippers ==0.3,
-             any.zlib ==0.6.2.2,
+             any.zip-stream ==0.2.1.0,
+             any.zipper-extra ==0.1.3.2,
+             any.zippers ==0.3.2,
+             any.zlib ==0.6.2.3,
              any.zlib-bindings ==0.1.1.5,
              any.zlib-lens ==0.1.2.1,
              any.zot ==0.0.3,
-             any.zstd ==0.1.2.0
+             any.zstd ==0.1.3.0,
+             any.ztail ==1.2.0.2,
+             any.zydiskell ==0.2.0.0
diff --git a/changelog.d/0-release-notes/ubuntu-images b/changelog.d/0-release-notes/ubuntu-images
new file mode 100644
index 00000000000..16c9c4dd5ba
--- /dev/null
+++ b/changelog.d/0-release-notes/ubuntu-images
@@ -0,0 +1,3 @@
+From this release onwards, the images for haskell components (brig, galley,
+cargohold, etc.) will be using Ubuntu 20.04 as the base. The images are about
+30-35 MB larger than the previous alpine based images.
\ No newline at end of file
diff --git a/changelog.d/5-internal/ghc-8107 b/changelog.d/5-internal/ghc-8107
new file mode 100644
index 00000000000..b1581527d97
--- /dev/null
+++ b/changelog.d/5-internal/ghc-8107
@@ -0,0 +1 @@
+Use GHC 8.10.7 and stack 2.7.3 for builds
\ No newline at end of file
diff --git a/changelog.d/5-internal/nixpkgs b/changelog.d/5-internal/nixpkgs
new file mode 100644
index 00000000000..750845b483e
--- /dev/null
+++ b/changelog.d/5-internal/nixpkgs
@@ -0,0 +1 @@
+Upgrade nixpkgs pin used to provision developement dependencies
\ No newline at end of file
diff --git a/dev-packages.nix b/dev-packages.nix
index 3747cc9ae2a..73522c868eb 100644
--- a/dev-packages.nix
+++ b/dev-packages.nix
@@ -51,15 +51,15 @@ let
     };
 
   pinned = {
-    stack = staticBinaryInTarball {
+    stack = staticBinaryInTarball rec {
       pname = "stack";
-      version = "2.3.1";
+      version = "2.7.3";
 
-      darwinAmd64Url = "https://github.com/commercialhaskell/stack/releases/download/v2.3.1/stack-2.3.1-osx-x86_64.tar.gz";
-      darwinAmd64Sha256 = "089nrb8mxf76a0r0hdccaxfvx1ly24b5zc0cy05gs4adybjygvkk";
+      darwinAmd64Url = "https://github.com/commercialhaskell/stack/releases/download/v${version}/stack-${version}-osx-x86_64.tar.gz";
+      darwinAmd64Sha256 = "0c7yx670h1qi2g5l4xx9s4552pz77k31lhjjd2rafi5g00501ra2";
 
-      linuxAmd64Url = "https://github.com/commercialhaskell/stack/releases/download/v2.3.1/stack-2.3.1-linux-x86_64-static.tar.gz";
-      linuxAmd64Sha256 = "0iqfqcd88rvlwgm2h8avs0rsi9f3pdxilvcacgrxskb1n8q8ibjb";
+      linuxAmd64Url = "https://github.com/commercialhaskell/stack/releases/download/v${version}/stack-${version}-linux-x86_64-static.tar.gz";
+      linuxAmd64Sha256 = "sha256-xbziTe+isrhvG7sUvtTx7oO+wUxu2fzIEXTVRz+/NFA=";
     };
 
     helm = staticBinaryInTarball {
@@ -109,6 +109,19 @@ let
     };
   };
 
+  c-lib-out-deps = [
+    pkgs.cryptobox
+    pkgs.icu.out
+    pkgs.libsodium.out
+    pkgs.libxml2.out
+    pkgs.ncurses.out
+    pkgs.openssl.out
+    pkgs.pcre.out
+    pkgs.snappy.out
+    pkgs.zlib.out
+    pkgs.lzma.out
+  ];
+
   compile-deps = pkgs.buildEnv {
     name = "wire-server-compile-deps";
     paths = [
@@ -120,30 +133,20 @@ let
       pkgs.gawk
       pkgs.git
 
-      pkgs.haskell.compiler.ghc884
+      pkgs.haskell.compiler.ghc8107
       pkgs.protobuf
 
       pkgs.cryptobox
-      pkgs.geoip
       pkgs.icu.dev
-      pkgs.icu.out
       pkgs.libsodium.dev
-      pkgs.libsodium.out
       pkgs.libxml2.dev
-      pkgs.libxml2.out
       pkgs.ncurses.dev
-      pkgs.ncurses.out
       pkgs.openssl.dev
-      pkgs.openssl.out
       pkgs.pcre.dev
-      pkgs.pcre.out
       pkgs.snappy.dev
-      pkgs.snappy.out
       pkgs.zlib.dev
-      pkgs.zlib.out
       pkgs.lzma.dev
-      pkgs.lzma.out
-    ];
+    ] ++ c-lib-out-deps;
   };
 
   # This performs roughly the same setup as direnv's load_prefix function, but
@@ -163,7 +166,7 @@ in
   pkgs.cfssl
   pkgs.docker-compose
   pkgs.gnumake
-  pkgs.haskell-language-server
+  (pkgs.haskell-language-server.override {supportedGhcVersions = ["8107"];})
   pkgs.jq
   pkgs.ormolu
   pkgs.telepresence
@@ -187,4 +190,6 @@ in
   # We don't use pkgs.cabal-install here, as we invoke it with a wrapper
   # which sets LD_LIBRARY_PATH and others correctly.
   cabal-wrapper
+  pkgs.haskellPackages.implicit-hie
 ]
+++ c-lib-out-deps # Required to run HLS
diff --git a/docs/developer/dependencies.md b/docs/developer/dependencies.md
index 878132cebfc..0d5d01619f3 100644
--- a/docs/developer/dependencies.md
+++ b/docs/developer/dependencies.md
@@ -4,11 +4,6 @@ This page documents how to install necessary dependencies to work with the wire-
 
 This repository makes use of git submodules. When cloning or updating, use `git submodule update --init --recursive` to check out the code dependencies.
 
-In addition to the information below, you can also consult the Dockerfiles for Alpine Linux, that could serve as inspiration:
-
-* [alpine setup for Haskell services](../../build/alpine/Dockerfile.builder)
-* [alpine setup for nginz](../../services/nginz/Dockerfile)
-
 ## General package dependencies (needed to compile Haskell services)
 
 *Note: all the below sections for getting compile-time dependencies necessary to compile all of wire-server may potentially go out of date; if you spot a mistake please open an issue or PR*
@@ -89,7 +84,7 @@ sudo installer -pkg /Library/Developer/CommandLineTools/Packages/macOS_SDK_heade
 
 Please refer to [Stack's installation instructions](https://docs.haskellstack.org/en/stable/README/#how-to-install).
 
-When you're done, ensure `stack --version` is the same as `STACK_ALPINE_VERSION` in [`build/alpine/Dockerfile.prebuilder`](../../build/alpine/Dockerfile.prebuilder).
+When you're done, ensure `stack --version` is the same as `STACK_VERSION` in [`build/ubuntu/Dockerfile.prebuilder`](../../build/ubuntu/Dockerfile.prebuilder).
 
 If you have to, you can downgrade stack with this command:
 
diff --git a/hack/bin/buildah-compile.sh b/hack/bin/buildah-compile.sh
index 713cc19f637..ff257b4c5ed 100755
--- a/hack/bin/buildah-compile.sh
+++ b/hack/bin/buildah-compile.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-# This compiles wire-server inside an alpine-based container based on quay.io/wire/alpine-builder.
+# This compiles wire-server inside an ubuntu-based container based on quay.io/wire/ubuntu20-builder.
 # the tool 'buildah' is used to mount some folders in, and to
 # keep the stack caches of .stack and .stack-work (renamed to avoid conflicts) for the next compilation
 
@@ -20,9 +20,9 @@ CONTAINER_NAME=wire-server-dev
 
 # check for the existence of; or create a working container
 buildah containers | awk '{print $5}' | grep "$CONTAINER_NAME" \
-    || buildah from --name "$CONTAINER_NAME" -v "${TOP_LEVEL}":/src --pull quay.io/wire/alpine-builder:develop
+    || buildah from --name "$CONTAINER_NAME" -v "${TOP_LEVEL}":/src --pull quay.io/wire/ubuntu20-builder:develop
 
-# The first time round, we want to copy the .stack folder from the alpine-builder for future use. Afterwards, we want to re-use the "dirty" stack root folder.
+# The first time round, we want to copy the .stack folder from the ubuntu20-builder for future use. Afterwards, we want to re-use the "dirty" stack root folder.
 # Current check hinges on the existence of a config file, and hardcodes some paths
 ls "$TOP_LEVEL/.stack-root-buildah/config.yaml" 2> /dev/null \
     || buildah run "$CONTAINER_NAME" -- cp -a /root/.stack/. /src/.stack-root-buildah/
diff --git a/hack/bin/buildah-make-images.sh b/hack/bin/buildah-make-images.sh
index a52c470282d..4fa80899116 100755
--- a/hack/bin/buildah-make-images.sh
+++ b/hack/bin/buildah-make-images.sh
@@ -10,7 +10,7 @@ CONTAINER_NAME="output"
 DOCKER_TAG=${DOCKER_TAG:-$USER}
 
 buildah containers | awk '{print $5}' | grep "$CONTAINER_NAME" ||
-    buildah from --name "$CONTAINER_NAME" -v "${TOP_LEVEL}":/src --pull quay.io/wire/alpine-deps:develop
+    buildah from --name "$CONTAINER_NAME" -v "${TOP_LEVEL}":/src --pull quay.io/wire/ubuntu20-deps:develop
 
 # Only brig needs these templates, but for simplicity we add them to all resulting images (optimization FUTUREWORK)
 buildah run "$CONTAINER_NAME" -- sh -c 'mkdir -p /usr/share/wire/ && cp -r "/src/services/brig/deb/opt/brig/templates/." "/usr/share/wire/templates"'
diff --git a/libs/api-bot/api-bot.cabal b/libs/api-bot/api-bot.cabal
index 5edff02e242..e7d323890ee 100644
--- a/libs/api-bot/api-bot.cabal
+++ b/libs/api-bot/api-bot.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 75d171e4af4336949458672c5c82f2cc7fb00e0e5ef4823cb10692f903396df1
+-- hash: e1d75e3473601a708c1154cd12e54b8990937ab09168ea17d8359c4573dd5987
 
 name:           api-bot
 version:        0.4.2
@@ -36,7 +36,46 @@ library
       Paths_api_bot
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       HaskellNet >=0.5
diff --git a/libs/api-client/api-client.cabal b/libs/api-client/api-client.cabal
index 0401f2be7df..810e6bd5fc8 100644
--- a/libs/api-client/api-client.cabal
+++ b/libs/api-client/api-client.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: d476963623ad1a6ebc3261c3e3abea13a40f95682c9d0a696fb423037fc6360b
+-- hash: 55c2d2915aedb6a1fffd5a9cf920729e473ce67d106d456c5f499572967e8034
 
 name:           api-client
 version:        0.4.2
@@ -35,7 +35,46 @@ library
       Paths_api_client
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       aeson >=0.11
diff --git a/libs/bilge/bilge.cabal b/libs/bilge/bilge.cabal
index ca21e9ed253..443c91a643d 100644
--- a/libs/bilge/bilge.cabal
+++ b/libs/bilge/bilge.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 8edb13a7bddfafe7d2906bff5e3671bd529be1c1726e113907c70a373cfc2606
+-- hash: 35c665e33076366baa18f5cac9e0d715b8d137004bf07f93b69eb9ae99c93195
 
 name:           bilge
 version:        0.22.0
@@ -35,7 +35,46 @@ library
       Paths_bilge
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       aeson >=0.6
diff --git a/libs/brig-types/brig-types.cabal b/libs/brig-types/brig-types.cabal
index 2ce16e19919..f7dad9b128b 100644
--- a/libs/brig-types/brig-types.cabal
+++ b/libs/brig-types/brig-types.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 42d648b07cd5a5d45e2ca36fd4631c37047fc74aea88fce77073a3efa99327a2
+-- hash: 7d28adb77d06047d2fb59e1470865a151254230ed48075e7ea0d68d35366147c
 
 name:           brig-types
 version:        1.35.0
@@ -45,7 +45,46 @@ library
       Paths_brig_types
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -funbox-strict-fields
   build-depends:
       QuickCheck >=2.9
@@ -80,7 +119,46 @@ test-suite brig-types-tests
       Paths_brig_types
   hs-source-dirs:
       test/unit
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded -with-rtsopts=-N
   build-depends:
       QuickCheck >=2.9
diff --git a/libs/cargohold-types/cargohold-types.cabal b/libs/cargohold-types/cargohold-types.cabal
index 05263ea04d9..b9e414d9a53 100644
--- a/libs/cargohold-types/cargohold-types.cabal
+++ b/libs/cargohold-types/cargohold-types.cabal
@@ -1,10 +1,8 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
---
--- hash: 33860dd6b7263a9496b0ffc60303472a71fc9da43168c9cd017f6c2eb626faa3
 
 name:           cargohold-types
 version:        1.5.0
@@ -25,7 +23,46 @@ library
       Paths_cargohold_types
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       base ==4.*
diff --git a/libs/cassandra-util/cassandra-util.cabal b/libs/cassandra-util/cassandra-util.cabal
index d68adc82518..cc43fe634ae 100644
--- a/libs/cassandra-util/cassandra-util.cabal
+++ b/libs/cassandra-util/cassandra-util.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 0e7f101562d82c7e04fbc1824f5bc9ef427915eacf3bd7370a2412a016a022be
+-- hash: a517eff209060dd72d3ddfdf3d5af57021c95a989da62cca8c98584144cbb7e3
 
 name:           cassandra-util
 version:        0.16.5
@@ -29,7 +29,46 @@ library
       Paths_cassandra_util
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       aeson >=0.7
diff --git a/libs/deriving-swagger2/deriving-swagger2.cabal b/libs/deriving-swagger2/deriving-swagger2.cabal
index 258c590d500..1f2e7539bb6 100644
--- a/libs/deriving-swagger2/deriving-swagger2.cabal
+++ b/libs/deriving-swagger2/deriving-swagger2.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 70e4168ab448671990c8ab35db93f44679a06283813db5aeb53fe33442d4ecac
+-- hash: 314df46c4097fb6a56f853e430a9148ccc7ee76375387bec6d03b68c1827f51f
 
 name:           deriving-swagger2
 version:        0.1.0
@@ -24,10 +24,49 @@ library
       Paths_deriving_swagger2
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
-      base >=4 && <5
+      base ==4.*
     , extra
     , imports
     , swagger2 >=0.6
diff --git a/libs/dns-util/dns-util.cabal b/libs/dns-util/dns-util.cabal
index e74687b6ab4..a674dc74860 100644
--- a/libs/dns-util/dns-util.cabal
+++ b/libs/dns-util/dns-util.cabal
@@ -1,10 +1,8 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
---
--- hash: 2025228a75d939373b4d108c8d9848c70c7e85debb5f2380344806e5b5b0314d
 
 name:           dns-util
 version:        0.1.0
@@ -27,7 +25,46 @@ library
       Paths_dns_util
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       base >=4.6 && <5.0
@@ -46,7 +83,46 @@ test-suite spec
       Paths_dns_util
   hs-source-dirs:
       test
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded -rtsopts -with-rtsopts=-N
   build-tool-depends:
       hspec-discover:hspec-discover
diff --git a/libs/extended/extended.cabal b/libs/extended/extended.cabal
index aee67e062f1..b3070542fe5 100644
--- a/libs/extended/extended.cabal
+++ b/libs/extended/extended.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 3aab57e8600541201e0b0f8cd7308f624eb479a4f5601e800399b4787656c449
+-- hash: 380f8ec2858bc5b11252ece06a472e4458f97cff4803d261b6d9624d2d0793bf
 
 name:           extended
 version:        0.1.0
@@ -30,7 +30,46 @@ library
       Paths_extended
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       aeson
@@ -61,7 +100,46 @@ test-suite extended-tests
       Paths_extended
   hs-source-dirs:
       test
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded -with-rtsopts=-N
   build-tool-depends:
       hspec-discover:hspec-discover
diff --git a/libs/extended/src/System/Logger/Extended.hs b/libs/extended/src/System/Logger/Extended.hs
index ec51ba4870e..6bb4cb8ebba 100644
--- a/libs/extended/src/System/Logger/Extended.hs
+++ b/libs/extended/src/System/Logger/Extended.hs
@@ -36,7 +36,7 @@ import Cassandra (MonadClient)
 import Control.Monad.Catch
 import Data.Aeson as Aeson
 import Data.Aeson.Encoding (list, pair, text)
-import qualified Data.ByteString.Lazy.Builder as B
+import qualified Data.ByteString.Builder as B
 import qualified Data.ByteString.Lazy.Char8 as L
 import qualified Data.Map.Lazy as Map
 import Data.String.Conversions (cs)
diff --git a/libs/galley-types/galley-types.cabal b/libs/galley-types/galley-types.cabal
index 60a176f4a1d..ace5070f043 100644
--- a/libs/galley-types/galley-types.cabal
+++ b/libs/galley-types/galley-types.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: ccecf8384a3050034fc05928ae9bd039006f4479289f73de11832052791a691f
+-- hash: fa648be72eab493846729545f4f4ec2a9cdc0f69add8e39150054510a9e9ac24
 
 name:           galley-types
 version:        0.81.0
@@ -33,12 +33,51 @@ library
       Paths_galley_types
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       QuickCheck
     , aeson >=0.6
-    , base >=4 && <5
+    , base ==4.*
     , bytestring
     , bytestring-conversion
     , containers >=0.5
@@ -68,7 +107,46 @@ test-suite galley-types-tests
       Paths_galley_types
   hs-source-dirs:
       test/unit
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded -with-rtsopts=-N
   build-depends:
       QuickCheck
diff --git a/libs/gundeck-types/gundeck-types.cabal b/libs/gundeck-types/gundeck-types.cabal
index 50727bb8026..021a011e806 100644
--- a/libs/gundeck-types/gundeck-types.cabal
+++ b/libs/gundeck-types/gundeck-types.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: f194c41b1f0f872204ed3e86abc49b16601caef978949cee922fe4fa08cd7b89
+-- hash: dba11fae094eb5ca67d599427dc30c857a0263eb293cf917e14442c7101bdb97
 
 name:           gundeck-types
 version:        1.45.0
@@ -31,12 +31,51 @@ library
       Paths_gundeck_types
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       aeson >=0.6
     , attoparsec >=0.10
-    , base >=4 && <5
+    , base ==4.*
     , bytestring >=0.10
     , bytestring-conversion >=0.2
     , containers >=0.5
diff --git a/libs/hscim/hscim.cabal b/libs/hscim/hscim.cabal
index d9c9a0732e6..381f3bc0939 100644
--- a/libs/hscim/hscim.cabal
+++ b/libs/hscim/hscim.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 8daa0bcbe43125e8d9749dd38e62f67cb01f62a1bcd57a0391e684860203e60c
+-- hash: cca3008213a478b2de914ed4e3bb1946613cc6cf4103168bacbe9b002e73764b
 
 name:           hscim
 version:        0.3.6
@@ -69,7 +69,23 @@ library
       Paths_hscim
   hs-source-dirs:
       src
-  default-extensions: ConstraintKinds DataKinds DeriveFunctor DeriveGeneric FlexibleContexts FlexibleInstances KindSignatures LambdaCase MultiParamTypeClasses OverloadedStrings RankNTypes ScopedTypeVariables TypeApplications TypeFamilies TypeOperators TypeSynonymInstances
+  default-extensions:
+      ConstraintKinds
+      DataKinds
+      DeriveFunctor
+      DeriveGeneric
+      FlexibleContexts
+      FlexibleInstances
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      OverloadedStrings
+      RankNTypes
+      ScopedTypeVariables
+      TypeApplications
+      TypeFamilies
+      TypeOperators
+      TypeSynonymInstances
   ghc-options: -Wall -Werror
   build-depends:
       aeson >=1.4.5 && <1.5
@@ -118,7 +134,23 @@ executable hscim-server
       Paths_hscim
   hs-source-dirs:
       server
-  default-extensions: ConstraintKinds DataKinds DeriveFunctor DeriveGeneric FlexibleContexts FlexibleInstances KindSignatures LambdaCase MultiParamTypeClasses OverloadedStrings RankNTypes ScopedTypeVariables TypeApplications TypeFamilies TypeOperators TypeSynonymInstances
+  default-extensions:
+      ConstraintKinds
+      DataKinds
+      DeriveFunctor
+      DeriveGeneric
+      FlexibleContexts
+      FlexibleInstances
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      OverloadedStrings
+      RankNTypes
+      ScopedTypeVariables
+      TypeApplications
+      TypeFamilies
+      TypeOperators
+      TypeSynonymInstances
   ghc-options: -Wall -Werror -threaded -rtsopts -with-rtsopts=-N
   build-depends:
       aeson >=1.4.5 && <1.5
@@ -183,7 +215,23 @@ test-suite spec
       Paths_hscim
   hs-source-dirs:
       test
-  default-extensions: ConstraintKinds DataKinds DeriveFunctor DeriveGeneric FlexibleContexts FlexibleInstances KindSignatures LambdaCase MultiParamTypeClasses OverloadedStrings RankNTypes ScopedTypeVariables TypeApplications TypeFamilies TypeOperators TypeSynonymInstances
+  default-extensions:
+      ConstraintKinds
+      DataKinds
+      DeriveFunctor
+      DeriveGeneric
+      FlexibleContexts
+      FlexibleInstances
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      OverloadedStrings
+      RankNTypes
+      ScopedTypeVariables
+      TypeApplications
+      TypeFamilies
+      TypeOperators
+      TypeSynonymInstances
   ghc-options: -Wall -Werror -threaded -rtsopts -with-rtsopts=-N
   build-tool-depends:
       hspec-discover:hspec-discover
diff --git a/libs/imports/imports.cabal b/libs/imports/imports.cabal
index 5a7862cd301..10933ff8a24 100644
--- a/libs/imports/imports.cabal
+++ b/libs/imports/imports.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 5bcdd74f4b3651bbe5b4f894d0e285677e39b1f7c4ae2992bcad1fbe3ad9310c
+-- hash: 09458f8cad6c5214c9692291bb633f780944463c5690e2af99d7e516dc93e0f2
 
 name:           imports
 version:        0.1.0
@@ -29,7 +29,46 @@ library
       Paths_imports
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       base
diff --git a/libs/metrics-core/metrics-core.cabal b/libs/metrics-core/metrics-core.cabal
index 9920cd291ba..e9e4be85d41 100644
--- a/libs/metrics-core/metrics-core.cabal
+++ b/libs/metrics-core/metrics-core.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 39576413f564e6922f09dafea8363144a30845c18008270e2f357ea3b32534b9
+-- hash: ed00633977e31daad2e0efcc5e21e8e4a800a2737e5848e9b0770091f9a94b3d
 
 name:           metrics-core
 version:        0.3.2
@@ -25,7 +25,46 @@ library
       Paths_metrics_core
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       base >=4.9
diff --git a/libs/metrics-wai/metrics-wai.cabal b/libs/metrics-wai/metrics-wai.cabal
index 7658bf9348a..422bc7598ba 100644
--- a/libs/metrics-wai/metrics-wai.cabal
+++ b/libs/metrics-wai/metrics-wai.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: aefa1a394ca2caa5cad577e67967aace67b79d4c94afeba4dd399b77de826a6c
+-- hash: aa7fa2126e1b9420894641828a3548c191a7daa9c997585531827b092557e393
 
 name:           metrics-wai
 version:        0.5.7
@@ -29,7 +29,46 @@ library
       Paths_metrics_wai
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   ghc-prof-options: -fprof-auto
   build-depends:
@@ -57,7 +96,46 @@ test-suite unit
       Paths_metrics_wai
   hs-source-dirs:
       test
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded -with-rtsopts=-N
   build-tool-depends:
       hspec-discover:hspec-discover
diff --git a/libs/polysemy-wire-zoo/polysemy-wire-zoo.cabal b/libs/polysemy-wire-zoo/polysemy-wire-zoo.cabal
index f573732a8b0..9467c73c9cc 100644
--- a/libs/polysemy-wire-zoo/polysemy-wire-zoo.cabal
+++ b/libs/polysemy-wire-zoo/polysemy-wire-zoo.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 27700378ec8705a58122804d0ac5c5da8f428b037271401e27abab3cce46ab9f
+-- hash: 4b1ed885b5ee0e7a49013f134724d41277e8cc3ff45a6023404e24793c6303c5
 
 name:           polysemy-wire-zoo
 version:        0.1.0
@@ -24,7 +24,46 @@ library
       Paths_polysemy_wire_zoo
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       base >=4.6 && <5.0
diff --git a/libs/ropes/ropes.cabal b/libs/ropes/ropes.cabal
index 58fbbe9d87e..58b7ae927f0 100644
--- a/libs/ropes/ropes.cabal
+++ b/libs/ropes/ropes.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: d71b49463ed7862c72fa0f2ce5e50bb9735fddc8270de52ec3d30e29043b6b59
+-- hash: 037e046804ad490d6ca65048cb0f7809f2b15ff57a4b513a64cf34153a2a7342
 
 name:           ropes
 version:        0.4.20
@@ -25,7 +25,46 @@ library
       Paths_ropes
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       aeson >=0.6
diff --git a/libs/schema-profunctor/schema-profunctor.cabal b/libs/schema-profunctor/schema-profunctor.cabal
index 2fd553cb16f..a3c1e5841a9 100644
--- a/libs/schema-profunctor/schema-profunctor.cabal
+++ b/libs/schema-profunctor/schema-profunctor.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 0ae8ea501bb947c4d9d743cdd9ea56a104dcc8791c62288e99bff1e8399c8ebb
+-- hash: 83646796a68e282b2b169035619c5d5ca2c53e12d08311ae712682f24cd90658
 
 name:           schema-profunctor
 version:        0.1.0
@@ -24,11 +24,50 @@ library
       Paths_schema_profunctor
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       aeson >=1.0 && <1.6
-    , base >=4 && <5
+    , base ==4.*
     , bifunctors
     , comonad
     , containers
@@ -49,12 +88,51 @@ test-suite schemas-tests
       Paths_schema_profunctor
   hs-source-dirs:
       test/unit
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       aeson
     , aeson-qq
-    , base >=4 && <5
+    , base ==4.*
     , imports
     , insert-ordered-containers
     , lens
diff --git a/libs/sodium-crypto-sign/sodium-crypto-sign.cabal b/libs/sodium-crypto-sign/sodium-crypto-sign.cabal
index a1cd7844cdb..d8701b66da4 100644
--- a/libs/sodium-crypto-sign/sodium-crypto-sign.cabal
+++ b/libs/sodium-crypto-sign/sodium-crypto-sign.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: f1ee42f25a00c893e5fa4a2dd1fde6c9aa2b39c8f0b558bfc8e217f21ecc78dd
+-- hash: 7f0ee2a8b0a69d4f589716632e47f0b9bd431ca5cbfd7a8bf5dfe273c6489de0
 
 name:           sodium-crypto-sign
 version:        0.1.2
@@ -25,7 +25,46 @@ library
       Paths_sodium_crypto_sign
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   pkgconfig-depends:
       libsodium >= 0.4.5
diff --git a/libs/ssl-util/ssl-util.cabal b/libs/ssl-util/ssl-util.cabal
index 6b76590b4f9..c9a1cd65b47 100644
--- a/libs/ssl-util/ssl-util.cabal
+++ b/libs/ssl-util/ssl-util.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 3699fbc088cccb96703289fb6f01c595b9dbb41fb871090b5665305eede020b3
+-- hash: d91dea84564b802aae13b5514b1babf2f1a50b0d33a58bc7dade37d6c60c2182
 
 name:           ssl-util
 version:        0.1.0
@@ -25,7 +25,46 @@ library
       Paths_ssl_util
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       HsOpenSSL >=0.11
diff --git a/libs/tasty-cannon/tasty-cannon.cabal b/libs/tasty-cannon/tasty-cannon.cabal
index 11de15b68e6..106ce076031 100644
--- a/libs/tasty-cannon/tasty-cannon.cabal
+++ b/libs/tasty-cannon/tasty-cannon.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 3e4d6b79f93c721b5df897b6653023feaa197910713bf3a2a759ea37ca05427f
+-- hash: 2d2de3cb5a7dcf524d840d49e590bea00dd40610a5488224cf4b25b15991f64b
 
 name:           tasty-cannon
 version:        0.4.0
@@ -24,7 +24,46 @@ library
       Paths_tasty_cannon
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       aeson
diff --git a/libs/types-common-aws/types-common-aws.cabal b/libs/types-common-aws/types-common-aws.cabal
index 7f9bc911d05..9c3ca1dd1b3 100644
--- a/libs/types-common-aws/types-common-aws.cabal
+++ b/libs/types-common-aws/types-common-aws.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 78e336e58361643ff6e3248bd8893419b6b9984cf680fe6e26614b22d222c542
+-- hash: 4b83070073d35300a38f4eeaac64a4d3ad4822df651b881a6a8eea293aa4dfcf
 
 name:           types-common-aws
 version:        0.16.0
@@ -35,7 +35,46 @@ library
       Paths_types_common_aws
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   ghc-prof-options: -fprof-auto-exported
   build-depends:
diff --git a/libs/types-common/src/Data/Text/Ascii.hs b/libs/types-common/src/Data/Text/Ascii.hs
index bb01459f607..9edd77b13cb 100644
--- a/libs/types-common/src/Data/Text/Ascii.hs
+++ b/libs/types-common/src/Data/Text/Ascii.hs
@@ -339,9 +339,7 @@ encodeBase16 = unsafeFromByteString . B16.encode
 -- | Decode a text containing only hex characters.
 -- Decoding only succeeds if the text is a multiple of 2 bytes in length.
 decodeBase16 :: AsciiBase16 -> Maybe ByteString
-decodeBase16 t = case B16.decode (toByteString' t) of
-  (b, r) | r == mempty -> Just b
-  (_, _) -> Nothing
+decodeBase16 t = either (const Nothing) Just (B16.decode (toByteString' t))
 
 --------------------------------------------------------------------------------
 -- Safe Widening
diff --git a/libs/types-common/types-common.cabal b/libs/types-common/types-common.cabal
index a5fb47da135..03402763a91 100644
--- a/libs/types-common/types-common.cabal
+++ b/libs/types-common/types-common.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 53508b02f4785530bef7924e0bafe2862b003cac226877857f99805418ffcf6d
+-- hash: 00836419e46c5f3ba70a9a8c3048fe32fb28f3d7176f97a681722bfb63807bd3
 
 name:           types-common
 version:        0.16.0
@@ -45,7 +45,46 @@ library
       Paths_types_common
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   ghc-prof-options: -fprof-auto-exported
   build-depends:
@@ -107,7 +146,46 @@ test-suite tests
       Paths_types_common
   hs-source-dirs:
       test
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded
   build-depends:
       QuickCheck
diff --git a/libs/wai-utilities/wai-utilities.cabal b/libs/wai-utilities/wai-utilities.cabal
index 04ee8c4afb7..8b0d7a76ba4 100644
--- a/libs/wai-utilities/wai-utilities.cabal
+++ b/libs/wai-utilities/wai-utilities.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 22be42374e2a06d9a91beff690fe12864bae17c8960db23f9f8d30e230bf1507
+-- hash: 52a60b4f6f7985a3b05c720cb7f00a1034117a09c5d39bbf1d9bb4f0828b86c8
 
 name:           wai-utilities
 version:        0.16.1
@@ -31,7 +31,46 @@ library
       Paths_wai_utilities
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       aeson >=0.6
diff --git a/libs/wire-api-federation/wire-api-federation.cabal b/libs/wire-api-federation/wire-api-federation.cabal
index 362aa467ca5..aa0dc39024a 100644
--- a/libs/wire-api-federation/wire-api-federation.cabal
+++ b/libs/wire-api-federation/wire-api-federation.cabal
@@ -1,10 +1,8 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
---
--- hash: 41830e5193234bf215634c6d48cfa68be3a633d1f2750d9f8e3c237f37021709
 
 name:           wire-api-federation
 version:        0.1.0
@@ -35,7 +33,46 @@ library
       Paths_wire_api_federation
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       QuickCheck >=2.13
@@ -90,7 +127,46 @@ test-suite spec
       Paths_wire_api_federation
   hs-source-dirs:
       test
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded -rtsopts -with-rtsopts=-N
   build-tool-depends:
       hspec-discover:hspec-discover
diff --git a/libs/wire-api/src/Wire/API/Arbitrary.hs b/libs/wire-api/src/Wire/API/Arbitrary.hs
index 3df8c80d4c4..70ca21c7510 100644
--- a/libs/wire-api/src/Wire/API/Arbitrary.hs
+++ b/libs/wire-api/src/Wire/API/Arbitrary.hs
@@ -25,7 +25,6 @@ module Wire.API.Arbitrary
   ( Arbitrary (..),
     GenericUniform (..),
     listOf',
-    list1Of',
     setOf',
     mapOf',
     generateExample,
@@ -39,7 +38,7 @@ import qualified Data.Currency as Currency
 import qualified Data.HashMap.Strict as HashMap
 import Data.ISO3166_CountryCodes (CountryCode)
 import Data.LanguageCodes (ISO639_1 (..))
-import Data.List1 (List1, list1)
+import Data.List.NonEmpty (NonEmpty (..))
 import qualified Data.Map.Strict as Map
 import qualified Data.Set as Set
 import GHC.Generics (Rep)
@@ -79,17 +78,18 @@ instance
 -- | We want plug in custom generators for all occurences of '[]' and 'List1'.
 type CustomSizedOpts =
   Generic.Options
+    'Generic.INCOHERENT
     'Generic.Sized
-    (Generic.Gen1 [] :+ Generic.Gen1 List1 :+ ())
+    (Generic.Gen1 [] :+ Generic.Gen1 NonEmpty :+ ())
 
 customSizedOpts :: CustomSizedOpts
 customSizedOpts =
   Generic.setGenerators
-    (Generic.Gen1 listOf' :+ Generic.Gen1 list1Of' :+ ())
+    (Generic.Gen1 listOf' :+ Generic.Gen1 nonEmptyListOf' :+ ())
     Generic.sizedOpts
 
-list1Of' :: Gen a -> Gen (List1 a)
-list1Of' g = list1 <$> g <*> Generic.listOf' g
+nonEmptyListOf' :: Gen a -> Gen (NonEmpty a)
+nonEmptyListOf' g = (:|) <$> g <*> listOf' g
 
 setOf' :: Ord a => Gen a -> Gen (Set a)
 setOf' g = Set.fromList <$> Generic.listOf' g
diff --git a/libs/wire-api/src/Wire/API/Routes/Public.hs b/libs/wire-api/src/Wire/API/Routes/Public.hs
index 0b64129d31d..84787518919 100644
--- a/libs/wire-api/src/Wire/API/Routes/Public.hs
+++ b/libs/wire-api/src/Wire/API/Routes/Public.hs
@@ -162,7 +162,7 @@ type ZOptConn = ZAuthServant 'ZAuthConn '[Servant.Optional, Servant.Strict]
 instance HasSwagger api => HasSwagger (ZAuthServant 'ZAuthUser _opts :> api) where
   toSwagger _ =
     toSwagger (Proxy @api)
-      & securityDefinitions <>~ InsOrdHashMap.singleton "ZAuth" secScheme
+      & securityDefinitions <>~ SecurityDefinitions (InsOrdHashMap.singleton "ZAuth" secScheme)
       & security <>~ [SecurityRequirement $ InsOrdHashMap.singleton "ZAuth" []]
     where
       secScheme =
diff --git a/libs/wire-api/src/Wire/API/Team/Role.hs b/libs/wire-api/src/Wire/API/Team/Role.hs
index 2a3ebca9df7..d9d9d74a216 100644
--- a/libs/wire-api/src/Wire/API/Team/Role.hs
+++ b/libs/wire-api/src/Wire/API/Team/Role.hs
@@ -29,9 +29,9 @@ where
 import qualified Cassandra as Cql
 import Data.Aeson
 import Data.Attoparsec.ByteString.Char8 (string)
+import Data.ByteString.Builder (toLazyByteString)
 import Data.ByteString.Conversion (FromByteString (..), ToByteString (..))
 import Data.ByteString.Conversion.From (runParser)
-import Data.ByteString.Lazy.Builder (toLazyByteString)
 import Data.String.Conversions (cs)
 import qualified Data.Swagger.Model.Api as Doc
 import Imports
diff --git a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generator.hs b/libs/wire-api/test/golden/Test/Wire/API/Golden/Generator.hs
index db70e032203..5416af10400 100644
--- a/libs/wire-api/test/golden/Test/Wire/API/Golden/Generator.hs
+++ b/libs/wire-api/test/golden/Test/Wire/API/Golden/Generator.hs
@@ -19,7 +19,7 @@ module Test.Wire.API.Golden.Generator where
 
 import Data.Id
 import Imports
-import System.IO (Handle, hPutStr, hPutStrLn, openFile)
+import System.IO (Handle, hPutStr, hPutStrLn)
 import Test.Tasty.QuickCheck (Arbitrary (..), generate)
 import Type.Reflection (typeRep)
 import qualified Wire.API.Asset as Asset
diff --git a/libs/wire-api/wire-api.cabal b/libs/wire-api/wire-api.cabal
index c508e20ebed..7da197c9c5b 100644
--- a/libs/wire-api/wire-api.cabal
+++ b/libs/wire-api/wire-api.cabal
@@ -1,10 +1,8 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
---
--- hash: 751fabb66be258a1c5a5cf055e0d9f8f59070f7084eb3dfdf88272f5ed177ed6
 
 name:           wire-api
 version:        0.1.0
@@ -101,13 +99,52 @@ library
       Paths_wire_api
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       QuickCheck >=2.14
     , aeson >=0.6
     , attoparsec >=0.10
-    , base >=4 && <5
+    , base ==4.*
     , base64-bytestring >=1.0
     , binary
     , bytestring >=0.9
@@ -425,7 +462,46 @@ test-suite wire-api-golden-tests
       Paths_wire_api
   hs-source-dirs:
       test/golden
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded -with-rtsopts=-N
   build-depends:
       QuickCheck
@@ -488,7 +564,46 @@ test-suite wire-api-tests
       Paths_wire_api
   hs-source-dirs:
       test/unit
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded -with-rtsopts=-N
   build-depends:
       QuickCheck
diff --git a/libs/zauth/zauth.cabal b/libs/zauth/zauth.cabal
index 0118d7a4615..921a1584f66 100644
--- a/libs/zauth/zauth.cabal
+++ b/libs/zauth/zauth.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 0d38dff701f563388d036116d5f2757ae74b04eab0b7fe2f3d5bfd8ef2800628
+-- hash: 645c91889ea532ce07463edf54a10559d3f581091b53c20903607d9800f6fa3f
 
 name:           zauth
 version:        0.10.3
@@ -30,7 +30,46 @@ library
       Paths_zauth
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -funbox-strict-fields
   build-depends:
       attoparsec >=0.11
@@ -56,7 +95,46 @@ executable zauth
       Paths_zauth
   hs-source-dirs:
       main
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       base
@@ -81,7 +159,46 @@ test-suite zauth-unit
       Paths_zauth
   hs-source-dirs:
       test
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       base
diff --git a/nix/overlays/wire-server.nix b/nix/overlays/wire-server.nix
index 602b42059fa..dd5a6b81880 100644
--- a/nix/overlays/wire-server.nix
+++ b/nix/overlays/wire-server.nix
@@ -37,7 +37,7 @@ self: super: {
         src = self.nix-gitignore.gitignoreSourcePure [ ../../.gitignore ] ../../libs/libzauth;
         sourceRoot = "libzauth/libzauth-c";
 
-        cargoSha256 = "10ijvi3rnnqpy589hhhp8s4p7xfpsbb1c3mzqnf65ra96q4nd6bf"; # self.lib.fakeSha256;
+        cargoSha256 = "sha256-umwOVCFHtszu64aIc8eqMPGCS7vt1nYQFAQh2XuV+v4="; # self.lib.fakeSha256;
 
         patchLibs = super.lib.optionalString super.stdenv.isDarwin ''
             install_name_tool -id $out/lib/libzauth.dylib $out/lib/libzauth.dylib
diff --git a/nix/sources.json b/nix/sources.json
index c3675c36b54..987e681846e 100644
--- a/nix/sources.json
+++ b/nix/sources.json
@@ -5,10 +5,10 @@
         "homepage": "https://github.com/nmattia/niv",
         "owner": "nmattia",
         "repo": "niv",
-        "rev": "18b7314c13a6d0e82113a15c14e7a5f54286327d",
-        "sha256": "0b2xb99nn7ddysvgzncwa4vglv0j6c0l4bgxz9hl4i3gmrlq3r59",
+        "rev": "5830a4dd348d77e39a0f3c4c762ff2663b602d4c",
+        "sha256": "1d3lsrqvci4qz2hwjrcnd8h5vfkg8aypq3sjd4g3izbc8frwz5sm",
         "type": "tarball",
-        "url": "https://github.com/nmattia/niv/archive/18b7314c13a6d0e82113a15c14e7a5f54286327d.tar.gz",
+        "url": "https://github.com/nmattia/niv/archive/5830a4dd348d77e39a0f3c4c762ff2663b602d4c.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     },
     "nixpkgs": {
@@ -17,10 +17,10 @@
         "homepage": "https://github.com/NixOS/nixpkgs",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8e1891d5b8d0b898db8890ddab73141f0cd3c2bc",
-        "sha256": "0a767mn0nfp4qnklsvs6bnc0vng4nc3ch566nmrz18ypk67z4zz0",
+        "rev": "cc61d6cca06aaa46ccde79a92cd94dbb27c634a7",
+        "sha256": "0qi05m6vk9zqqs9573w2rhwm5k7jga70sjzq370npcipayrifw99",
         "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/8e1891d5b8d0b898db8890ddab73141f0cd3c2bc.tar.gz",
+        "url": "https://github.com/NixOS/nixpkgs/archive/cc61d6cca06aaa46ccde79a92cd94dbb27c634a7.tar.gz",
         "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
     }
 }
diff --git a/nix/sources.nix b/nix/sources.nix
index 8a725cb4e7f..1938409dddb 100644
--- a/nix/sources.nix
+++ b/nix/sources.nix
@@ -6,52 +6,63 @@ let
   # The fetchers. fetch_<type> fetches specs of type <type>.
   #
 
-  fetch_file = pkgs: spec:
-    if spec.builtin or true then
-      builtins_fetchurl { inherit (spec) url sha256; }
-    else
-      pkgs.fetchurl { inherit (spec) url sha256; };
-
-  fetch_tarball = pkgs: spec:
-    if spec.builtin or true then
-      builtins_fetchTarball { inherit (spec) url sha256; }
-    else
-      pkgs.fetchzip { inherit (spec) url sha256; };
+  fetch_file = pkgs: name: spec:
+    let
+      name' = sanitizeName name + "-src";
+    in
+      if spec.builtin or true then
+        builtins_fetchurl { inherit (spec) url sha256; name = name'; }
+      else
+        pkgs.fetchurl { inherit (spec) url sha256; name = name'; };
 
-  fetch_git = spec:
-    builtins.fetchGit { url = spec.repo; inherit (spec) rev ref; };
+  fetch_tarball = pkgs: name: spec:
+    let
+      name' = sanitizeName name + "-src";
+    in
+      if spec.builtin or true then
+        builtins_fetchTarball { name = name'; inherit (spec) url sha256; }
+      else
+        pkgs.fetchzip { name = name'; inherit (spec) url sha256; };
 
-  fetch_builtin-tarball = spec:
-    builtins.trace
-      ''
-        WARNING:
-          The niv type "builtin-tarball" will soon be deprecated. You should
-          instead use `builtin = true`.
+  fetch_git = name: spec:
+    let
+      ref =
+        if spec ? ref then spec.ref else
+          if spec ? branch then "refs/heads/${spec.branch}" else
+            if spec ? tag then "refs/tags/${spec.tag}" else
+              abort "In git source '${name}': Please specify `ref`, `tag` or `branch`!";
+    in
+      builtins.fetchGit { url = spec.repo; inherit (spec) rev; inherit ref; };
 
-          $ niv modify <package> -a type=tarball -a builtin=true
-      ''
-      builtins_fetchTarball { inherit (spec) url sha256; };
+  fetch_local = spec: spec.path;
 
-  fetch_builtin-url = spec:
-    builtins.trace
-      ''
-        WARNING:
-          The niv type "builtin-url" will soon be deprecated. You should
-          instead use `builtin = true`.
+  fetch_builtin-tarball = name: throw
+    ''[${name}] The niv type "builtin-tarball" is deprecated. You should instead use `builtin = true`.
+        $ niv modify ${name} -a type=tarball -a builtin=true'';
 
-          $ niv modify <package> -a type=file -a builtin=true
-      ''
-      (builtins_fetchurl { inherit (spec) url sha256; });
+  fetch_builtin-url = name: throw
+    ''[${name}] The niv type "builtin-url" will soon be deprecated. You should instead use `builtin = true`.
+        $ niv modify ${name} -a type=file -a builtin=true'';
 
   #
   # Various helpers
   #
 
+  # https://github.com/NixOS/nixpkgs/pull/83241/files#diff-c6f540a4f3bfa4b0e8b6bafd4cd54e8bR695
+  sanitizeName = name:
+    (
+      concatMapStrings (s: if builtins.isList s then "-" else s)
+        (
+          builtins.split "[^[:alnum:]+._?=-]+"
+            ((x: builtins.elemAt (builtins.match "\\.*(.*)" x) 0) name)
+        )
+    );
+
   # The set of packages used when specs are fetched using non-builtins.
-  mkPkgs = sources:
+  mkPkgs = sources: system:
     let
       sourcesNixpkgs =
-        import (builtins_fetchTarball { inherit (sources.nixpkgs) url sha256; }) {};
+        import (builtins_fetchTarball { inherit (sources.nixpkgs) url sha256; }) { inherit system; };
       hasNixpkgsPath = builtins.any (x: x.prefix == "nixpkgs") builtins.nixPath;
       hasThisAsNixpkgsPath = <nixpkgs> == ./.;
     in
@@ -71,14 +82,27 @@ let
 
     if ! builtins.hasAttr "type" spec then
       abort "ERROR: niv spec ${name} does not have a 'type' attribute"
-    else if spec.type == "file" then fetch_file pkgs spec
-    else if spec.type == "tarball" then fetch_tarball pkgs spec
-    else if spec.type == "git" then fetch_git spec
-    else if spec.type == "builtin-tarball" then fetch_builtin-tarball spec
-    else if spec.type == "builtin-url" then fetch_builtin-url spec
+    else if spec.type == "file" then fetch_file pkgs name spec
+    else if spec.type == "tarball" then fetch_tarball pkgs name spec
+    else if spec.type == "git" then fetch_git name spec
+    else if spec.type == "local" then fetch_local spec
+    else if spec.type == "builtin-tarball" then fetch_builtin-tarball name
+    else if spec.type == "builtin-url" then fetch_builtin-url name
     else
       abort "ERROR: niv spec ${name} has unknown type ${builtins.toJSON spec.type}";
 
+  # If the environment variable NIV_OVERRIDE_${name} is set, then use
+  # the path directly as opposed to the fetched source.
+  replace = name: drv:
+    let
+      saneName = stringAsChars (c: if isNull (builtins.match "[a-zA-Z0-9]" c) then "_" else c) name;
+      ersatz = builtins.getEnv "NIV_OVERRIDE_${saneName}";
+    in
+      if ersatz == "" then drv else
+        # this turns the string into an actual Nix path (for both absolute and
+        # relative paths)
+        if builtins.substring 0 1 ersatz == "/" then /. + ersatz else /. + builtins.getEnv "PWD" + "/${ersatz}";
+
   # Ports of functions for older nix versions
 
   # a Nix version of mapAttrs if the built-in doesn't exist
@@ -87,23 +111,37 @@ let
     listToAttrs (map (attr: { name = attr; value = f attr set.${attr}; }) (attrNames set))
   );
 
+  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/lists.nix#L295
+  range = first: last: if first > last then [] else builtins.genList (n: first + n) (last - first + 1);
+
+  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L257
+  stringToCharacters = s: map (p: builtins.substring p 1 s) (range 0 (builtins.stringLength s - 1));
+
+  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L269
+  stringAsChars = f: s: concatStrings (map f (stringToCharacters s));
+  concatMapStrings = f: list: concatStrings (map f list);
+  concatStrings = builtins.concatStringsSep "";
+
+  # https://github.com/NixOS/nixpkgs/blob/8a9f58a375c401b96da862d969f66429def1d118/lib/attrsets.nix#L331
+  optionalAttrs = cond: as: if cond then as else {};
+
   # fetchTarball version that is compatible between all the versions of Nix
-  builtins_fetchTarball = { url, sha256 }@attrs:
+  builtins_fetchTarball = { url, name ? null, sha256 }@attrs:
     let
       inherit (builtins) lessThan nixVersion fetchTarball;
     in
       if lessThan nixVersion "1.12" then
-        fetchTarball { inherit url; }
+        fetchTarball ({ inherit url; } // (optionalAttrs (!isNull name) { inherit name; }))
       else
         fetchTarball attrs;
 
   # fetchurl version that is compatible between all the versions of Nix
-  builtins_fetchurl = { url, sha256 }@attrs:
+  builtins_fetchurl = { url, name ? null, sha256 }@attrs:
     let
       inherit (builtins) lessThan nixVersion fetchurl;
     in
       if lessThan nixVersion "1.12" then
-        fetchurl { inherit url; }
+        fetchurl ({ inherit url; } // (optionalAttrs (!isNull name) { inherit name; }))
       else
         fetchurl attrs;
 
@@ -115,14 +153,15 @@ let
         then abort
           "The values in sources.json should not have an 'outPath' attribute"
         else
-          spec // { outPath = fetch config.pkgs name spec; }
+          spec // { outPath = replace name (fetch config.pkgs name spec); }
     ) config.sources;
 
   # The "config" used by the fetchers
   mkConfig =
-    { sourcesFile ? ./sources.json
-    , sources ? builtins.fromJSON (builtins.readFile sourcesFile)
-    , pkgs ? mkPkgs sources
+    { sourcesFile ? if builtins.pathExists ./sources.json then ./sources.json else null
+    , sources ? if isNull sourcesFile then {} else builtins.fromJSON (builtins.readFile sourcesFile)
+    , system ? builtins.currentSystem
+    , pkgs ? mkPkgs sources system
     }: rec {
       # The sources, i.e. the attribute set of spec name to spec
       inherit sources;
@@ -130,5 +169,6 @@ let
       # The "pkgs" (evaluated nixpkgs) to use for e.g. non-builtin fetchers
       inherit pkgs;
     };
+
 in
 mkSources (mkConfig {}) // { __functor = _: settings: mkSources (mkConfig settings); }
diff --git a/services/brig/Makefile b/services/brig/Makefile
index c8acd908845..2f09ec70321 100644
--- a/services/brig/Makefile
+++ b/services/brig/Makefile
@@ -147,7 +147,7 @@ index-reset: install
 docker:
 	$(foreach executable,$(EXECUTABLES),\
 	docker build -t $(DOCKER_USER)/$(executable):$(DOCKER_TAG) \
-	-f ../../build/alpine/Dockerfile.executable \
+	-f ../../build/ubuntu/Dockerfile.executable \
 	--build-arg executable=$(executable) \
 	../.. && \
 	docker tag $(DOCKER_USER)/$(executable):$(DOCKER_TAG) $(DOCKER_USER)/$(executable):latest && \
diff --git a/services/brig/brig.cabal b/services/brig/brig.cabal
index 4bd10ed3417..005df78d29a 100644
--- a/services/brig/brig.cabal
+++ b/services/brig/brig.cabal
@@ -1,10 +1,8 @@
 cabal-version: 2.0
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
---
--- hash: ebb0470fb0502f00b8e472c5afbb27c0cad11b42d703d7330b43c75f80ea8257
 
 name:           brig
 version:        2.0
@@ -128,7 +126,46 @@ library
       Brig.Docs.Swagger
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -funbox-strict-fields
   build-depends:
       HaskellNet >=0.3
@@ -257,7 +294,46 @@ executable brig
   main-is: src/Main.hs
   other-modules:
       Paths_brig
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -funbox-strict-fields -threaded -with-rtsopts=-N1 -with-rtsopts=-T -rtsopts
   build-depends:
       HsOpenSSL
@@ -272,7 +348,46 @@ executable brig-index
   main-is: index/src/Main.hs
   other-modules:
       Paths_brig
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -funbox-strict-fields -threaded -with-rtsopts=-N
   build-depends:
       base
@@ -317,7 +432,46 @@ executable brig-integration
       Paths_brig
   hs-source-dirs:
       test/integration
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -funbox-strict-fields
   build-depends:
       HsOpenSSL
@@ -463,7 +617,46 @@ executable brig-schema
       Paths_brig
   hs-source-dirs:
       schema/src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -funbox-strict-fields
   build-depends:
       base
@@ -488,7 +681,46 @@ test-suite brig-tests
       Paths_brig
   hs-source-dirs:
       test/unit
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -funbox-strict-fields -threaded -with-rtsopts=-N
   build-depends:
       aeson
diff --git a/services/brig/src/Brig/AWS.hs b/services/brig/src/Brig/AWS.hs
index 15205905c07..0e0e4aec5a3 100644
--- a/services/brig/src/Brig/AWS.hs
+++ b/services/brig/src/Brig/AWS.hs
@@ -97,14 +97,10 @@ newtype Amazon a = Amazon
       MonadCatch,
       MonadMask,
       MonadReader Env,
-      MonadResource
+      MonadResource,
+      MonadUnliftIO
     )
 
-instance MonadUnliftIO Amazon where
-  askUnliftIO = Amazon . ReaderT $ \r ->
-    withUnliftIO $ \u ->
-      return (UnliftIO (unliftIO u . flip runReaderT r . unAmazon))
-
 instance MonadLogger Amazon where
   log l m = view logger >>= \g -> Logger.log g l m
 
diff --git a/services/brig/src/Brig/Data/Client.hs b/services/brig/src/Brig/Data/Client.hs
index b6a322f8877..491479b2c89 100644
--- a/services/brig/src/Brig/Data/Client.hs
+++ b/services/brig/src/Brig/Data/Client.hs
@@ -56,7 +56,7 @@ import Control.Error
 import qualified Control.Exception.Lens as EL
 import Control.Lens
 import Control.Monad.Catch
-import Control.Monad.Random (Random (randomRIO))
+import Control.Monad.Random (randomRIO)
 import Control.Retry
 import qualified Data.ByteString.Base64 as B64
 import Data.ByteString.Conversion (toByteString, toByteString')
diff --git a/services/brig/src/Brig/Run.hs b/services/brig/src/Brig/Run.hs
index 46179f9e372..f4402dce559 100644
--- a/services/brig/src/Brig/Run.hs
+++ b/services/brig/src/Brig/Run.hs
@@ -44,7 +44,7 @@ import qualified Control.Concurrent.Async as Async
 import Control.Exception.Safe (catchAny)
 import Control.Lens (view, (.~), (^.))
 import Control.Monad.Catch (MonadCatch, finally)
-import Control.Monad.Random (Random (randomRIO))
+import Control.Monad.Random (randomRIO)
 import qualified Data.Aeson as Aeson
 import Data.Default (Default (def))
 import Data.Id (RequestId (..))
diff --git a/services/brig/src/Brig/SMTP.hs b/services/brig/src/Brig/SMTP.hs
index 59818297d81..f176be2ddac 100644
--- a/services/brig/src/Brig/SMTP.hs
+++ b/services/brig/src/Brig/SMTP.hs
@@ -84,4 +84,4 @@ initSMTP lg host port credentials connType = do
       Logger.log lg Logger.Debug (msg $ val "Closing connection to: " +++ host)
 
 sendMail :: MonadIO m => SMTP -> Mail -> m ()
-sendMail s m = liftIO $ withResource (s ^. pool) $ SMTP.sendMimeMail2 m
+sendMail s m = liftIO $ withResource (s ^. pool) $ SMTP.sendMail m
diff --git a/services/cannon/Makefile b/services/cannon/Makefile
index 42372fe7d7f..965ec95d0c8 100644
--- a/services/cannon/Makefile
+++ b/services/cannon/Makefile
@@ -58,7 +58,7 @@ $(DEB):
 docker:
 	$(foreach executable,$(EXECUTABLES),\
 	docker build -t $(DOCKER_USER)/$(executable):$(DOCKER_TAG) \
-	-f ../../build/alpine/Dockerfile.executable \
+	-f ../../build/ubuntu/Dockerfile.executable \
 	--build-arg executable=$(executable) \
 	../.. && \
 	docker tag $(DOCKER_USER)/$(executable):$(DOCKER_TAG) $(DOCKER_USER)/$(executable):latest && \
diff --git a/services/cannon/cannon.cabal b/services/cannon/cannon.cabal
index e582aabe298..c8571bd1fa2 100644
--- a/services/cannon/cannon.cabal
+++ b/services/cannon/cannon.cabal
@@ -1,10 +1,8 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
---
--- hash: 5c6e877bcba6cc776493801203320fecfcec06a1384cc5cb0150262e4ef0f3b8
 
 name:           cannon
 version:        0.31.0
@@ -38,7 +36,46 @@ library
       Paths_cannon
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       aeson >=0.11
@@ -86,7 +123,46 @@ executable cannon
   main-is: src/Main.hs
   other-modules:
       Paths_cannon
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded -rtsopts -with-rtsopts=-N -with-rtsopts=-T -with-rtsopts=-M1g -with-rtsopts=-ki4k
   build-depends:
       base
@@ -106,7 +182,46 @@ test-suite cannon-tests
       Paths_cannon
   hs-source-dirs:
       test
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded -with-rtsopts=-N
   build-depends:
       QuickCheck >=2.7
@@ -135,7 +250,46 @@ benchmark cannon-bench
       Paths_cannon
   hs-source-dirs:
       bench
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded -with-rtsopts=-N
   build-depends:
       QuickCheck >=2.7
diff --git a/services/cargohold/Makefile b/services/cargohold/Makefile
index 5e7bbf94cde..5a5c25265a7 100644
--- a/services/cargohold/Makefile
+++ b/services/cargohold/Makefile
@@ -103,7 +103,7 @@ integration-%: fast
 docker:
 	$(foreach executable,$(EXECUTABLES),\
 	docker build -t $(DOCKER_USER)/$(executable):$(DOCKER_TAG) \
-	-f ../../build/alpine/Dockerfile.executable \
+	-f ../../build/ubuntu/Dockerfile.executable \
 	--build-arg executable=$(executable) \
 	../.. && \
 	docker tag $(DOCKER_USER)/$(executable):$(DOCKER_TAG) $(DOCKER_USER)/$(executable):latest && \
diff --git a/services/cargohold/cargohold.cabal b/services/cargohold/cargohold.cabal
index e77f5da24b8..7aad0bc98a8 100644
--- a/services/cargohold/cargohold.cabal
+++ b/services/cargohold/cargohold.cabal
@@ -1,10 +1,8 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
---
--- hash: 8291075b6b5e2e43a811343e51abb02d402fbc38a5a3efd0928f3f1b4c769485
 
 name:           cargohold
 version:        1.5.0
@@ -45,7 +43,46 @@ library
       Paths_cargohold
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       HsOpenSSL >=0.11
@@ -56,7 +93,7 @@ library
     , amazonka-s3 >=1.3.7
     , attoparsec >=0.12
     , auto-update >=0.1.4
-    , base >=4 && <5
+    , base ==4.*
     , base64-bytestring >=1.0
     , bilge >=0.21
     , bytestring >=0.10
@@ -105,7 +142,46 @@ executable cargohold
   main-is: src/Main.hs
   other-modules:
       Paths_cargohold
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded -rtsopts -with-rtsopts=-T
   build-depends:
       HsOpenSSL >=0.11
@@ -146,7 +222,46 @@ executable cargohold-integration
       Paths_cargohold
   hs-source-dirs:
       test/integration
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       HsOpenSSL >=0.11
diff --git a/services/cargohold/src/CargoHold/AWS.hs b/services/cargohold/src/CargoHold/AWS.hs
index da60da4db38..a25b90e0c20 100644
--- a/services/cargohold/src/CargoHold/AWS.hs
+++ b/services/cargohold/src/CargoHold/AWS.hs
@@ -91,17 +91,13 @@ newtype Amazon a = Amazon
       MonadCatch,
       MonadMask,
       MonadReader Env,
-      MonadResource
+      MonadResource,
+      MonadUnliftIO
     )
 
 instance MonadLogger Amazon where
   log l m = view logger >>= \g -> Logger.log g l m
 
-instance MonadUnliftIO Amazon where
-  askUnliftIO = Amazon . ReaderT $ \r ->
-    withUnliftIO $ \u ->
-      return (UnliftIO (unliftIO u . flip runReaderT r . unAmazon))
-
 instance AWS.MonadAWS Amazon where
   liftAWS a = view amazonkaEnv >>= flip AWS.runAWS a
 
diff --git a/services/federator/federator.cabal b/services/federator/federator.cabal
index b70dab8cda8..97a98e21d42 100644
--- a/services/federator/federator.cabal
+++ b/services/federator/federator.cabal
@@ -1,10 +1,8 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
---
--- hash: 292e08dea16bd9d7d61af769a915f4186507ba5d61e292d6f5380f3ea149aa8d
 
 name:           federator
 version:        1.0.0
@@ -58,7 +56,46 @@ library
       Paths_federator
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       aeson
@@ -125,7 +162,46 @@ executable federator
       Paths_federator
   hs-source-dirs:
       exec
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded -with-rtsopts=-N1 -with-rtsopts=-T -rtsopts
   build-depends:
       aeson
@@ -197,7 +273,46 @@ executable federator-integration
       Paths_federator
   hs-source-dirs:
       test/integration
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       QuickCheck
@@ -286,7 +401,46 @@ test-suite federator-tests
       Paths_federator
   hs-source-dirs:
       test/unit
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded -with-rtsopts=-N
   build-depends:
       QuickCheck
diff --git a/services/galley/Makefile b/services/galley/Makefile
index 0ab7e4bc276..5dbde93dabf 100644
--- a/services/galley/Makefile
+++ b/services/galley/Makefile
@@ -127,7 +127,7 @@ db-migrate-data:
 docker:
 	$(foreach executable,$(EXECUTABLES),\
 	docker build -t $(DOCKER_USER)/$(executable):$(DOCKER_TAG) \
-	-f ../../build/alpine/Dockerfile.executable \
+	-f ../../build/ubuntu/Dockerfile.executable \
 	--build-arg executable=$(executable) \
 	../.. && \
 	docker tag $(DOCKER_USER)/$(executable):$(DOCKER_TAG) $(DOCKER_USER)/$(executable):latest && \
diff --git a/services/galley/galley.cabal b/services/galley/galley.cabal
index fdb053a4772..94cca2e39b9 100644
--- a/services/galley/galley.cabal
+++ b/services/galley/galley.cabal
@@ -1,10 +1,8 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
---
--- hash: d0f941574eb095a4662d0a6333d341636673f8bbb0d097daed4d4e277ad7f37d
 
 name:           galley
 version:        0.83.0
@@ -127,7 +125,46 @@ library
       Paths_galley
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       HsOpenSSL >=0.11
@@ -223,7 +260,46 @@ executable galley
   main-is: src/Main.hs
   other-modules:
       Paths_galley
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded -with-rtsopts=-T -rtsopts
   build-depends:
       HsOpenSSL
@@ -269,7 +345,46 @@ executable galley-integration
       Paths_galley
   hs-source-dirs:
       test/integration
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded
   build-depends:
       HsOpenSSL
@@ -368,7 +483,46 @@ executable galley-migrate-data
       Paths_galley
   hs-source-dirs:
       migrate-data/src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       base
@@ -445,7 +599,46 @@ executable galley-schema
       Paths_galley
   hs-source-dirs:
       schema/src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       base
@@ -483,7 +676,46 @@ test-suite galley-tests
       Paths_galley
   hs-source-dirs:
       test/unit
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded -with-rtsopts=-N
   build-depends:
       QuickCheck
diff --git a/services/galley/src/Galley/API/Teams.hs b/services/galley/src/Galley/API/Teams.hs
index 4ecb0b6020d..a9e332d6e16 100644
--- a/services/galley/src/Galley/API/Teams.hs
+++ b/services/galley/src/Galley/API/Teams.hs
@@ -60,9 +60,9 @@ where
 import Brig.Types.Intra (accountUser)
 import Brig.Types.Team (TeamSize (..))
 import Control.Lens
+import Data.ByteString.Builder (lazyByteString)
 import Data.ByteString.Conversion (List, toByteString)
 import qualified Data.ByteString.Conversion
-import Data.ByteString.Lazy.Builder (lazyByteString)
 import qualified Data.CaseInsensitive as CI
 import Data.Csv (EncodeOptions (..), Quoting (QuoteAll), encodeDefaultOrderedByNameWith)
 import qualified Data.Handle as Handle
diff --git a/services/galley/src/Galley/Aws.hs b/services/galley/src/Galley/Aws.hs
index 5f5f055a7c6..9121ab43751 100644
--- a/services/galley/src/Galley/Aws.hs
+++ b/services/galley/src/Galley/Aws.hs
@@ -91,14 +91,10 @@ newtype Amazon a = Amazon
       MonadCatch,
       MonadMask,
       MonadReader Env,
-      MonadResource
+      MonadResource,
+      MonadUnliftIO
     )
 
-instance MonadUnliftIO Amazon where
-  askUnliftIO = Amazon . ReaderT $ \r ->
-    withUnliftIO $ \u ->
-      return (UnliftIO (unliftIO u . flip runReaderT r . unAmazon))
-
 instance MonadLogger Amazon where
   log l m = view logger >>= \g -> Logger.log g l m
 
diff --git a/services/gundeck/Makefile b/services/gundeck/Makefile
index ef0059ce50a..fcedb3ce780 100644
--- a/services/gundeck/Makefile
+++ b/services/gundeck/Makefile
@@ -127,7 +127,7 @@ db-migrate: fast
 docker:
 	$(foreach executable,$(EXECUTABLES),\
 	docker build -t $(DOCKER_USER)/$(executable):$(DOCKER_TAG) \
-	-f ../../build/alpine/Dockerfile.executable \
+	-f ../../build/ubuntu/Dockerfile.executable \
 	--build-arg executable=$(executable) \
 	../.. && \
 	docker tag $(DOCKER_USER)/$(executable):$(DOCKER_TAG) $(DOCKER_USER)/$(executable):latest && \
diff --git a/services/gundeck/gundeck.cabal b/services/gundeck/gundeck.cabal
index cec259bf5ad..a8643ca98c1 100644
--- a/services/gundeck/gundeck.cabal
+++ b/services/gundeck/gundeck.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 4bb58f9c4f7c25e77c57457292940bd69410c8a372272ad5afb14252c2ac399b
+-- hash: 4b94342561027580e950514565f60bb0d8d1465d92c773a7c4f588966dab6ffc
 
 name:           gundeck
 version:        1.45.0
@@ -58,7 +58,46 @@ library
       Paths_gundeck
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -fwarn-incomplete-uni-patterns
   build-depends:
       HsOpenSSL >=0.11
@@ -120,7 +159,46 @@ executable gundeck
   main-is: src/Main.hs
   other-modules:
       Paths_gundeck
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded -rtsopts -with-rtsopts=-T
   build-depends:
       HsOpenSSL
@@ -146,13 +224,52 @@ executable gundeck-integration
       Paths_gundeck
   hs-source-dirs:
       test/integration
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded
   build-depends:
       HsOpenSSL
     , aeson
     , async
-    , base >=4 && <5
+    , base ==4.*
     , base16-bytestring >=0.1
     , bilge
     , bytestring
@@ -201,7 +318,46 @@ executable gundeck-schema
       Paths_gundeck
   hs-source-dirs:
       schema/src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded
   build-depends:
       base
@@ -230,7 +386,46 @@ test-suite gundeck-tests
       Paths_gundeck
   hs-source-dirs:
       test/unit
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded
   build-depends:
       HsOpenSSL
@@ -277,7 +472,46 @@ benchmark gundeck-bench
       Paths_gundeck
   hs-source-dirs:
       test/bench
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       HsOpenSSL
diff --git a/services/gundeck/src/Gundeck/Aws.hs b/services/gundeck/src/Gundeck/Aws.hs
index b4a05082752..75bc30c1953 100644
--- a/services/gundeck/src/Gundeck/Aws.hs
+++ b/services/gundeck/src/Gundeck/Aws.hs
@@ -136,14 +136,10 @@ newtype Amazon a = Amazon
       MonadCatch,
       MonadMask,
       MonadReader Env,
-      MonadResource
+      MonadResource,
+      MonadUnliftIO
     )
 
-instance MonadUnliftIO Amazon where
-  askUnliftIO = Amazon . ReaderT $ \r ->
-    withUnliftIO $ \u ->
-      return (UnliftIO (unliftIO u . flip runReaderT r . unAmazon))
-
 instance MonadLogger Amazon where
   log l m = view logger >>= \g -> Logger.log g l m
 
diff --git a/services/gundeck/src/Gundeck/Monad.hs b/services/gundeck/src/Gundeck/Monad.hs
index 22851a12d81..4bea200a2ec 100644
--- a/services/gundeck/src/Gundeck/Monad.hs
+++ b/services/gundeck/src/Gundeck/Monad.hs
@@ -70,15 +70,10 @@ newtype Gundeck a = Gundeck
       MonadCatch,
       MonadMask,
       MonadReader Env,
-      MonadClient
+      MonadClient,
+      MonadUnliftIO
     )
 
-instance MonadUnliftIO Gundeck where
-  askUnliftIO =
-    Gundeck . ReaderT $ \r ->
-      withUnliftIO $ \u ->
-        return (UnliftIO (unliftIO u . flip runReaderT r . unGundeck))
-
 instance Redis.MonadClient Gundeck where
   liftClient m = view rstate >>= \p -> Redis.runRedis p m
 
diff --git a/services/gundeck/test/unit/ThreadBudget.hs b/services/gundeck/test/unit/ThreadBudget.hs
index 2d03c388279..b730e43d5b5 100644
--- a/services/gundeck/test/unit/ThreadBudget.hs
+++ b/services/gundeck/test/unit/ThreadBudget.hs
@@ -28,7 +28,6 @@ import Control.Monad.Catch (MonadCatch, catch)
 import Data.Metrics.Middleware (metrics)
 import Data.String.Conversions (cs)
 import Data.Time
-import Data.TreeDiff.Class (ToExpr)
 import GHC.Generics
 import Gundeck.Options
 import Gundeck.ThreadBudget.Internal
@@ -307,10 +306,10 @@ sm =
       STM.postcondition = postcondition,
       STM.invariant = Nothing,
       STM.generator = generator,
-      STM.distribution = Nothing,
       STM.shrinker = shrinker,
       STM.semantics = semantics,
-      STM.mock = mock
+      STM.mock = mock,
+      STM.cleanup = const (pure ())
     }
 
 -- | Remove resources created by the concrete 'STM.Commands', namely watcher and budgeted
diff --git a/services/proxy/Makefile b/services/proxy/Makefile
index 17a95642972..ed032ae8b23 100644
--- a/services/proxy/Makefile
+++ b/services/proxy/Makefile
@@ -58,7 +58,7 @@ $(DEB):
 docker:
 	$(foreach executable,$(EXECUTABLES),\
 	docker build -t $(DOCKER_USER)/$(executable):$(DOCKER_TAG) \
-	-f ../../build/alpine/Dockerfile.executable \
+	-f ../../build/ubuntu/Dockerfile.executable \
 	--build-arg executable=$(executable) \
 	../.. && \
 	docker tag $(DOCKER_USER)/$(executable):$(DOCKER_TAG) $(DOCKER_USER)/$(executable):latest && \
diff --git a/services/proxy/proxy.cabal b/services/proxy/proxy.cabal
index 73b9dc80213..0aa5d2d426a 100644
--- a/services/proxy/proxy.cabal
+++ b/services/proxy/proxy.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: e36a48793e77087ee1a5e60f78c9c308b686a1d9318e083dc6bb78d0e27ac056
+-- hash: 4b0eeea49373b98eff5aa94f2c7ec6e198b9db932ceeb3ff4311ffc25ab44b86
 
 name:           proxy
 version:        0.9.0
@@ -35,7 +35,46 @@ library
       Paths_proxy
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -funbox-strict-fields
   build-depends:
       aeson >=1.0
@@ -70,7 +109,46 @@ executable proxy
   main-is: src/Main.hs
   other-modules:
       Paths_proxy
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded -rtsopts -with-rtsopts=-T
   build-depends:
       base
diff --git a/services/spar/Makefile b/services/spar/Makefile
index b3846b0a816..523ac6c9e71 100644
--- a/services/spar/Makefile
+++ b/services/spar/Makefile
@@ -115,7 +115,7 @@ db-migrate: fast
 docker:
 	$(foreach executable,$(EXECUTABLES),\
 	docker build -t $(DOCKER_USER)/$(executable):$(DOCKER_TAG) \
-	-f ../../build/alpine/Dockerfile.executable \
+	-f ../../build/ubuntu/Dockerfile.executable \
 	--build-arg executable=$(executable) \
 	../.. && \
 	docker tag $(DOCKER_USER)/$(executable):$(DOCKER_TAG) $(DOCKER_USER)/$(executable):latest && \
diff --git a/services/spar/spar.cabal b/services/spar/spar.cabal
index f596bfc9ecd..b4823b1554f 100644
--- a/services/spar/spar.cabal
+++ b/services/spar/spar.cabal
@@ -1,10 +1,8 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
---
--- hash: c721f9a156f292d2f25f9189e2250e105c48a5a3a67d8fdbf3069c9b3a55f921
 
 name:           spar
 version:        0.1
@@ -95,7 +93,46 @@ library
       Paths_spar
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -j -Wno-redundant-constraints -Werror
   build-depends:
       HsOpenSSL
@@ -171,7 +208,46 @@ executable spar
       Paths_spar
   hs-source-dirs:
       exec
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -j -Wno-redundant-constraints -Werror -threaded -rtsopts -with-rtsopts=-N -with-rtsopts=-T
   build-depends:
       HsOpenSSL
@@ -262,7 +338,46 @@ executable spar-integration
       Paths_spar
   hs-source-dirs:
       test-integration
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -j -Wno-redundant-constraints -Werror -threaded -rtsopts -with-rtsopts=-N
   build-tool-depends:
       hspec-discover:hspec-discover
@@ -357,7 +472,46 @@ executable spar-migrate-data
       Paths_spar
   hs-source-dirs:
       migrate-data/src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -j -Wno-redundant-constraints -Werror -threaded -rtsopts -with-rtsopts=-N
   build-depends:
       HsOpenSSL
@@ -451,7 +605,46 @@ executable spar-schema
       Paths_spar
   hs-source-dirs:
       schema/src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -j -Wno-redundant-constraints -Werror -threaded -rtsopts -with-rtsopts=-N
   build-depends:
       HsOpenSSL
@@ -541,7 +734,46 @@ test-suite spec
       Paths_spar
   hs-source-dirs:
       test
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -j -Wno-redundant-constraints -Werror -threaded -rtsopts -with-rtsopts=-N
   build-tool-depends:
       hspec-discover:hspec-discover
diff --git a/services/spar/test-integration/Test/Spar/Scim/UserSpec.hs b/services/spar/test-integration/Test/Spar/Scim/UserSpec.hs
index 118ecc67450..7b23d24b6b3 100644
--- a/services/spar/test-integration/Test/Spar/Scim/UserSpec.hs
+++ b/services/spar/test-integration/Test/Spar/Scim/UserSpec.hs
@@ -35,7 +35,7 @@ import Brig.Types.User as Brig
 import qualified Control.Exception
 import Control.Lens
 import Control.Monad.Except (MonadError (throwError))
-import Control.Monad.Random (Random (randomRIO))
+import Control.Monad.Random (randomRIO)
 import Control.Monad.Trans.Except
 import Control.Monad.Trans.Maybe
 import Control.Retry (exponentialBackoff, limitRetries, recovering)
diff --git a/stack-deps.nix b/stack-deps.nix
index b19d261cd7b..f7cc47ae211 100644
--- a/stack-deps.nix
+++ b/stack-deps.nix
@@ -25,7 +25,7 @@ pkgs.haskell.lib.buildStackProject {
     zlib
     lzma
   ];
-  ghc = pkgs.haskell.compiler.ghc884;
+  ghc = pkgs.haskell.compiler.ghc8107;
 
   # This is required as the environment variables exported before running stack
   # do not make it into the shell in which stack runs test.
diff --git a/stack.yaml b/stack.yaml
index d5e4cb78413..15a73f6b123 100644
--- a/stack.yaml
+++ b/stack.yaml
@@ -1,4 +1,19 @@
-resolver: lts-16.14
+resolver: lts-18.18
+
+# to bump blocks of custom dependencies to the latest version on hackage:
+#
+# /tmp/1.sh:
+# #!/bin/bash
+# cabal list "$1" | perl -ne '/^..'$1'$/ && { $x=1 }; /^$/ && { $x=0 }; if ($x) { /version: (.+)$/ && print "$1" }'
+#
+# /tmp/2.sh:
+# #!/bin/bash
+# perl -ne '/^- (\S+)-([01123456789\.]+)(\@\S+)?(.*)$/ && do { print "- $1-"; system("/tmp/1.sh $1"); print "$4\n" }'
+#
+# ...  and then pipe the blocks of extra-deps through /tmp/2.sh.
+# sorry for the hideous code, couldn't get it into one line (some
+# limitation to perl that i don't want to have to understand).
+# anyway it works!
 
 packages:
 - libs/api-bot
@@ -70,7 +85,7 @@ extra-deps:
   # a version > 1.0.0 of wai-middleware-prometheus is available
   # (required: https://github.com/fimad/prometheus-haskell/pull/45)
 - git: https://github.com/wireapp/saml2-web-sso
-  commit: 60398f375987b74d6b855b5d225e45dc3a96ac06  # https://github.com/wireapp/saml2-web-sso/pull/75  (Sep 10, 2021)
+  commit: 4227e38be5c0810012dc472fc6931f6087fbce68  # master (Dec 07, 2021)
 
 - git: https://github.com/kim/hs-collectd
   commit: 885da222be2375f78c7be36127620ed772b677c9
@@ -137,27 +152,27 @@ extra-deps:
 
 # Dropped from upstream snapshot
 - template-0.2.0.10
-- HaskellNet-0.5.2
-- smtp-mail-0.2.0.0
-- stm-containers-1.1.0.4 # Latest: lts-15.16
+- HaskellNet-0.6
+- smtp-mail-0.3.0.0
+- stm-containers-1.2
 - redis-resp-1.0.0
-- stm-hamt-1.2.0.4 # Latest: lts-15.16
-- primitive-unlifted-0.1.2.0 # Latest: lts-15.16
+- stm-hamt-1.2.0.6
+- primitive-unlifted-1.0.0.0
 - prometheus-2.2.2 # Only in nightly so far
 
 # Not on stackage
 - currency-codes-3.0.0.1
 - mime-0.4.0.2
 - data-timeout-0.3.1
-- geoip2-0.4.0.1
-- stomp-queue-0.3.1
+- geoip2-0.4.1.0
+- stomp-queue-0.5.1
 - text-icu-translit-0.1.0.7
 - wai-middleware-gunzip-0.0.2
 - cql-io-tinylog-0.1.0
 - invertible-hxt-0.1
 - base58-bytestring-0.1.0
-- stompl-0.5.0
-- pattern-trie-0.1.0
+- stompl-0.6.0
+- pattern-trie-0.1.1
 - markov-chain-usage-model-0.0.0
 - wai-predicates-1.0.0
 - redis-io-1.1.0
@@ -167,12 +182,12 @@ extra-deps:
 - wai-route-0.4.0
 
 # Not updated on Stackage yet
-- QuickCheck-2.14
-- splitmix-0.0.4 # needed for QuickCheck
+- QuickCheck-2.14.2
+- splitmix-0.1.0.4 # needed for QuickCheck
 - servant-mock-0.8.7
-- servant-swagger-ui-0.3.4.3.36.1
+- servant-swagger-ui-0.3.5.3.52.5
 - tls-1.5.5
-- cryptonite-0.28
+- cryptonite-0.29
 
 # For changes from #128 and #135, not released to hackage yet
 - git: https://github.com/haskell-servant/servant-swagger
@@ -188,18 +203,18 @@ extra-deps:
   - servant-client
   - servant-client-core
 
-- HsOpenSSL-x509-system-0.1.0.3@sha256:f4958ee0eec555c5c213662eff6764bddefe5665e2afcfd32733ce3801a9b687,1774 # Latest: lts-14.27
-- cql-4.0.2@sha256:a0006a5ac13d6f86d5eff28c11be80928246309f217ea6d5f5c8a76a5d16b48b,3157 # Latest: lts-14.27
-- cql-io-1.1.1@sha256:897ef0811b227c8b1a269b29b9c1ebfb09c46f00d66834e2e8c6f19ea7f90f7d,4611 # Latest: lts-14.27
-- primitive-extras-0.8@sha256:fca0310150496867f5b9421fe1541ecda87fae17eae44885a29f9c52dd00c8ff,2963 # Latest: lts-15.16
-- text-format-0.3.2@sha256:2a3fc17cf87120fcfdbca62a0da59759755549285841cdc1483081c35fb3d115,1814 # Latest: lts-14.27
-- hex-0.2.0@sha256:197d2561d2e216c4ead035b4911dabc6e678ac6257cb71b64e324c822f6f9f5a,726 # Latest: lts-14.27
+- HsOpenSSL-x509-system-0.1.0.4
+- cql-4.0.3
+- cql-io-1.1.1
+- primitive-extras-0.10.1.1
+- text-format-0.3.2
+- hex-0.2.0
 
 
 # Not in the upstream snapshot and not using latest version on hackage due to
 # breaking change
-- quickcheck-state-machine-0.6.0
-- servant-multipart-0.11.5@sha256:1633f715b5b53d648a1da69839bdc5046599f4f7244944d4bbf852dba38d8f4b,2319
+- quickcheck-state-machine-0.7.1
+- servant-multipart-0.12.1
 
 # Dependencies on upstream source
 
@@ -222,10 +237,20 @@ extra-deps:
     - x509-store
 
 # Not on stackage yet
-- polysemy-1.7.0.0
+- polysemy-1.7.1.0
 - polysemy-plugin-0.4.2.0
 - polysemy-check-0.9.0.0
 
+# polysemy-check has this upper bound
+- kind-generics-0.4.1.0
+
+# ad-hoc additions (on 2021-10-10)
+- proto-lens-0.7.1.0
+- proto-lens-protoc-0.7.1.0
+- proto-lens-runtime-0.7.0.1
+- proto-lens-setup-0.4.0.5
+- tracing-0.0.7.2
+
 ############################################################
 # Development tools
 ############################################################
@@ -233,5 +258,5 @@ extra-deps:
 - ormolu-0.1.4.1
 - ghc-lib-parser-8.10.1.20200412@sha256:b0517bb150a02957d7180f131f5b94abd2a7f58a7d1532a012e71618282339c2,8751  # for ormolu
 
-- headroom-0.2.1.0
-- implicit-hie-0.1.2.5
+- headroom-0.4.2.0
+- implicit-hie-0.1.2.6
diff --git a/stack.yaml.lock b/stack.yaml.lock
index 1635ea076ad..1e1c531b533 100644
--- a/stack.yaml.lock
+++ b/stack.yaml.lock
@@ -23,11 +23,11 @@ packages:
     git: https://github.com/wireapp/saml2-web-sso
     pantry-tree:
       size: 4887
-      sha256: 29e0138ca6bc33500b87cd6c06bbd899fe4ddaadcfd5117b211e7769f9f80161
-    commit: 60398f375987b74d6b855b5d225e45dc3a96ac06
+      sha256: 9d6d175cc7bbdb57558f25557e4d0d698c4aecc250f6ca03296a3d94671bf657
+    commit: 4227e38be5c0810012dc472fc6931f6087fbce68
   original:
     git: https://github.com/wireapp/saml2-web-sso
-    commit: 60398f375987b74d6b855b5d225e45dc3a96ac06
+    commit: 4227e38be5c0810012dc472fc6931f6087fbce68
 - completed:
     name: collectd
     version: 0.0.0.2
@@ -294,26 +294,26 @@ packages:
   original:
     hackage: template-0.2.0.10
 - completed:
-    hackage: HaskellNet-0.5.2@sha256:77fb8466fcbeb76f17366ffd7deb37550b6ea08a4d08bf721d0b597c2573336d,2069
+    hackage: HaskellNet-0.6@sha256:1b514b95acf1c56f39bebc27150c909988d0a6ad28a2db1210316cffed57cad7,2344
     pantry-tree:
-      size: 1499
-      sha256: 20f0361675729e606fb37b8a1865f4bd49d952f2d0148693b62f68fadf5801d5
+      size: 1689
+      sha256: 22cc61632129d47407d3e28c5291f21b7cc9a5df69304395d75d5ae341f567d4
   original:
-    hackage: HaskellNet-0.5.2
+    hackage: HaskellNet-0.6
 - completed:
-    hackage: smtp-mail-0.2.0.0@sha256:b91c81f6dbb41a9ceee8c443385118684ecec55006b77f7d3c0e49cffd2468cf,1211
+    hackage: smtp-mail-0.3.0.0@sha256:2e6d9cb29d09a5a04d77a905eb1b570b94b5654e24d40630ea96aa374474c12f,1239
     pantry-tree:
-      size: 449
-      sha256: 413c4c7e7c7573c8bf906c136a282aebfe37ecc25492ff4b5ec8c69ff8d190fe
+      size: 450
+      sha256: 4d319cb6c22b35ca043a83210cd09bfbf99eec3dca4945cd53ed5b7c96f7daca
   original:
-    hackage: smtp-mail-0.2.0.0
+    hackage: smtp-mail-0.3.0.0
 - completed:
-    hackage: stm-containers-1.1.0.4@sha256:f83a683357b6e3b1dda3e70d2077a37224ed534df1f74c4e11f3f6daa7945c5b,3248
+    hackage: stm-containers-1.2@sha256:a887f2e7692b7cf20e0b081e2d66e21076e2bd4b57016ec59c484edfa2d29397,3244
     pantry-tree:
       size: 761
-      sha256: 059c5a2d657d392aca0a887648f57380d6321734dc8879c056a44d4414308ac6
+      sha256: 20b1076bdb121347ccc512a67df697eed34815a8e35279b6b9a0951963b1eba2
   original:
-    hackage: stm-containers-1.1.0.4
+    hackage: stm-containers-1.2
 - completed:
     hackage: redis-resp-1.0.0@sha256:c134ac23e79d57071fdc8559e2b2e72280ea11786a8ba4118c10ed506dc7d991,1615
     pantry-tree:
@@ -322,19 +322,19 @@ packages:
   original:
     hackage: redis-resp-1.0.0
 - completed:
-    hackage: stm-hamt-1.2.0.4@sha256:7957497c022554b7599e790696d1a3e56359ad99e5da36a251894c626ca1f60a,3970
+    hackage: stm-hamt-1.2.0.6@sha256:fba86ccb4b45c5706c19b0e1315ba63dcac3b5d71de945ec001ba921fae80061,3972
     pantry-tree:
       size: 1009
-      sha256: d9a8be48da86bd4a2ba9d52ea29b9a74f1b686d439ba1bbfba04ab1a002391da
+      sha256: 1920790535af832b76e7583c33ecf51f8b0b0c3615ef1db1c8ed9be19622c1db
   original:
-    hackage: stm-hamt-1.2.0.4
+    hackage: stm-hamt-1.2.0.6
 - completed:
-    hackage: primitive-unlifted-0.1.2.0@sha256:9c3df73af54ed19fb3f4874da19334863cc414b22e578e27b5f52beeac4a60dd,1360
+    hackage: primitive-unlifted-1.0.0.0@sha256:16c3f149cf2fb3da64a43ffd0020d78a198454baded3a7f7f49a59397eea5770,2293
     pantry-tree:
-      size: 420
-      sha256: cc6ffb1b48aa3f514c107f5188d5d5beb4e61a4232a81be7025b54f9be66a837
+      size: 1719
+      sha256: 0ca7abed459d0240ee880bc52d957e35ca01017313ea94b5d026fc1842aba93c
   original:
-    hackage: primitive-unlifted-0.1.2.0
+    hackage: primitive-unlifted-1.0.0.0
 - completed:
     hackage: prometheus-2.2.2@sha256:d794f5fe975be2f3ca7d7af71a7aeeb006615ad7d98835fa42caba9457a51936,4288
     pantry-tree:
@@ -364,19 +364,19 @@ packages:
   original:
     hackage: data-timeout-0.3.1
 - completed:
-    hackage: geoip2-0.4.0.1@sha256:cee67aa8da78686c5e5e37f0e92502218ed7c6b2200a121dc4fb4060c703fa37,1316
+    hackage: geoip2-0.4.1.0@sha256:f8b69ea86198817141edab06cd10b2dcf23a906ea9f0ba2ce52045c7fea2e5c5,1316
     pantry-tree:
       size: 433
-      sha256: 364b9ff8d4a85b1265b70f83e7ab81eb1f94c752aa32416de19e739ca6bb8a05
+      sha256: 13b2f1557f8915c71902f576ccc1b42491f4fc38baef080a5b753df5e81b4766
   original:
-    hackage: geoip2-0.4.0.1
+    hackage: geoip2-0.4.1.0
 - completed:
-    hackage: stomp-queue-0.3.1@sha256:0f4ced5b67107d4dc06498985058236505470ca742dbfe5c6af0534d67ace9b5,2186
+    hackage: stomp-queue-0.5.1@sha256:47c47d21dc756c028c8253b51cf647d4fa0282777dda2265edde2f65284f9d14,2321
     pantry-tree:
-      size: 686
-      sha256: 29ffec14af759c9244c559dd54b7fcd13d3b054b0aea21d753d80fb3064720a5
+      size: 608
+      sha256: 2996c49e280fd1bf4111ffb8788d5729c48d663648e1dd6734c83ee20681c531
   original:
-    hackage: stomp-queue-0.3.1
+    hackage: stomp-queue-0.5.1
 - completed:
     hackage: text-icu-translit-0.1.0.7@sha256:c8eaaee3331417a250365474067b7cb0f196ebabd04b3fe834c4e2b5a212b5ce,1723
     pantry-tree:
@@ -413,19 +413,19 @@ packages:
   original:
     hackage: base58-bytestring-0.1.0
 - completed:
-    hackage: stompl-0.5.0@sha256:58a43198bc24a2332aecec65bc5de3ccb4fe93e470e217b892cd87545240e4ce,1895
+    hackage: stompl-0.6.0@sha256:fd7b39a754926102d3f9917213f646d5cd765ebcf23e70daf9eb99e44e441cef,1896
     pantry-tree:
       size: 357
-      sha256: f4d7a11d9ee71ea0c5504aea227105a7528d41a26972d35f813bb82ab7dc0321
+      sha256: 0bc21f1930468f6b75cab74ab6d4ff95bc1eedcda5c33c336d2599452eb45ace
   original:
-    hackage: stompl-0.5.0
+    hackage: stompl-0.6.0
 - completed:
-    hackage: pattern-trie-0.1.0@sha256:2ef9ad9a630f07e8e8c9a6689e47d7600b5ca3ebc7fe060d31bb687b1f122eed,2346
+    hackage: pattern-trie-0.1.1@sha256:265ecc98c4345a89f2711b9b00e4f52ed7c143ea20f10b76ca6ddc3066658143,2236
     pantry-tree:
-      size: 632
-      sha256: 9cf57bcb24b5da4d9ab314750810dce6c28ae082348e0afd60bdb12afdeeca6f
+      size: 751
+      sha256: dc1264e417abc23b25fc0b3b486880c0510a805cc0a19d2208f13d0ec8a0102d
   original:
-    hackage: pattern-trie-0.1.0
+    hackage: pattern-trie-0.1.1
 - completed:
     hackage: markov-chain-usage-model-0.0.0@sha256:1afa95faeb9213c4d960a669190078b41b89169462b8edd910472980671ba8c0,2112
     pantry-tree:
@@ -462,19 +462,19 @@ packages:
   original:
     hackage: wai-route-0.4.0
 - completed:
-    hackage: QuickCheck-2.14@sha256:3f536a4b86bef7ec39025f04ef8d76c5ac5a78ba0b42e660b25d0a8f9c811045,7004
+    hackage: QuickCheck-2.14.2@sha256:4ce29211223d5e6620ebceba34a3ca9ccf1c10c0cf387d48aea45599222ee5aa,7736
     pantry-tree:
-      size: 2203
-      sha256: 7067593c50ff2e5e83c637ac73009f4bd8f43c29ff256e976bbb14674033abe9
+      size: 2315
+      sha256: 2fe423d0ed7cd64f0f165d708779f48814e66c4f181c568468134af55d86a5f8
   original:
-    hackage: QuickCheck-2.14
+    hackage: QuickCheck-2.14.2
 - completed:
-    hackage: splitmix-0.0.4@sha256:fb9bb8b54a2e76c8a021fe5c4c3798047e1f60e168379a1f80693047fe00ad0e,4813
+    hackage: splitmix-0.1.0.4@sha256:714a55fd28d3e2533bd5b49e74f604ef8e5d7b06f249c8816f6c54aed431dcf1,6483
     pantry-tree:
-      size: 872
-      sha256: e58892088b95190bfb59a7c0803f7ef65338e57fc9b938d7c166563605003902
+      size: 1519
+      sha256: 79f4645c11b7a3861db0b596297f72804f509444d639a8fd7c0162b1ed80c578
   original:
-    hackage: splitmix-0.0.4
+    hackage: splitmix-0.1.0.4
 - completed:
     hackage: servant-mock-0.8.7@sha256:64cb3e52bbd51ab6cb25e3f412a99ea712c6c26f1efd117f01a8d1664df49c67,2306
     pantry-tree:
@@ -483,12 +483,12 @@ packages:
   original:
     hackage: servant-mock-0.8.7
 - completed:
-    hackage: servant-swagger-ui-0.3.4.3.36.1@sha256:b696e28ed2c9090ae3306535a80f4a54a876def2d33db0c795c911826c107cda,1746
+    hackage: servant-swagger-ui-0.3.5.3.52.5@sha256:4734c536b8b0c48993c337e880a5bd65ed521271937ce9da5feac360dea661ba,1746
     pantry-tree:
       size: 878
-      sha256: 137680a15ee0147cd19634d8296d90c2150ca4fd62ed3d56f7e07ccd8823810c
+      sha256: 822d19afe0e75bbc8bd2b685dc2cb4fd7d5972ed1e7b61546ce3e61cf77b8808
   original:
-    hackage: servant-swagger-ui-0.3.4.3.36.1
+    hackage: servant-swagger-ui-0.3.5.3.52.5
 - completed:
     hackage: tls-1.5.5@sha256:f6681d6624071211edd509a8f56e0c96b4f003bb349b7dc706d4333775a373c5,6996
     pantry-tree:
@@ -497,12 +497,12 @@ packages:
   original:
     hackage: tls-1.5.5
 - completed:
-    hackage: cryptonite-0.28@sha256:edf00c7b00b9a1c07a178c0fe446c6ebe462637d498590757c8eac2075bb0b43,18215
+    hackage: cryptonite-0.29@sha256:147724f6a8e4394fcbd51bf52aba7a8b92d3fc8f42055cd6ca9486655e2ab614,18312
     pantry-tree:
-      size: 23132
-      sha256: 3737ee32d6629b4b915c01911fdb9dc0e255b96233799479c29420d986634726
+      size: 23323
+      sha256: 087de3ed0552cfb1f84d03629b0f98c77aadc076b85bb5cb787f77c5e5dac136
   original:
-    hackage: cryptonite-0.28
+    hackage: cryptonite-0.29
 - completed:
     name: servant-swagger
     version: 1.1.11
@@ -567,61 +567,61 @@ packages:
     git: https://github.com/wireapp/servant.git
     commit: a4e15fe75f294816d9ead19ed8a48cae8e0b76e7
 - completed:
-    hackage: HsOpenSSL-x509-system-0.1.0.3@sha256:f4958ee0eec555c5c213662eff6764bddefe5665e2afcfd32733ce3801a9b687,1774
+    hackage: HsOpenSSL-x509-system-0.1.0.4@sha256:86be72558de4cee8f4e32f9cb8b63610d7624219910cfc205a23326078658676,1777
     pantry-tree:
-      size: 503
-      sha256: 2a097abbccc0382ebb565c8ab9932628f33471607c2174303c3c930d7685bd18
+      size: 508
+      sha256: 98f6b47d27550f29a90a8f5660cf09f72f139d9940fe00cd6b0cffbd5c210a15
   original:
-    hackage: HsOpenSSL-x509-system-0.1.0.3@sha256:f4958ee0eec555c5c213662eff6764bddefe5665e2afcfd32733ce3801a9b687,1774
+    hackage: HsOpenSSL-x509-system-0.1.0.4
 - completed:
-    hackage: cql-4.0.2@sha256:a0006a5ac13d6f86d5eff28c11be80928246309f217ea6d5f5c8a76a5d16b48b,3157
+    hackage: cql-4.0.3@sha256:10d6b09715699efec5c97f22887aaf65c8fa0b0916c926ef79bc21f4db460175,3157
     pantry-tree:
       size: 1281
-      sha256: 8cc6e57c6a794188ae79415cee38bd29e1c07f7426cfa533c9a57523c0a2ed23
+      sha256: 94433b7c7c46bea532fdc64c6988643a48e39b643948003b27e5bde1bdad3b24
   original:
-    hackage: cql-4.0.2@sha256:a0006a5ac13d6f86d5eff28c11be80928246309f217ea6d5f5c8a76a5d16b48b,3157
+    hackage: cql-4.0.3
 - completed:
     hackage: cql-io-1.1.1@sha256:897ef0811b227c8b1a269b29b9c1ebfb09c46f00d66834e2e8c6f19ea7f90f7d,4611
     pantry-tree:
       size: 2067
       sha256: 7ced76ae95b51fa1669b4fcaeec3825b5cb8cf1f4e37c53d0bddf6234742eba8
   original:
-    hackage: cql-io-1.1.1@sha256:897ef0811b227c8b1a269b29b9c1ebfb09c46f00d66834e2e8c6f19ea7f90f7d,4611
+    hackage: cql-io-1.1.1
 - completed:
-    hackage: primitive-extras-0.8@sha256:fca0310150496867f5b9421fe1541ecda87fae17eae44885a29f9c52dd00c8ff,2963
+    hackage: primitive-extras-0.10.1.1@sha256:47c4d211166bc31ebdb053f610e4b5387c01d00bde81840e59438469cef6c94e,2955
     pantry-tree:
-      size: 1105
-      sha256: e7c1d26202b80d1fca2ef780ec7fe76ede1275f4d9a996c6d44c08d8de1c45db
+      size: 1096
+      sha256: 55ee00adb4e2e6beedfb997b071b60014b28ce0b25fb946b1f4abfae9a5e01d1
   original:
-    hackage: primitive-extras-0.8@sha256:fca0310150496867f5b9421fe1541ecda87fae17eae44885a29f9c52dd00c8ff,2963
+    hackage: primitive-extras-0.10.1.1
 - completed:
     hackage: text-format-0.3.2@sha256:2a3fc17cf87120fcfdbca62a0da59759755549285841cdc1483081c35fb3d115,1814
     pantry-tree:
       size: 1029
       sha256: 2db26ddb77184186e0d5b2b020bdfbeb044c168024767b1fa3691682ca618896
   original:
-    hackage: text-format-0.3.2@sha256:2a3fc17cf87120fcfdbca62a0da59759755549285841cdc1483081c35fb3d115,1814
+    hackage: text-format-0.3.2
 - completed:
     hackage: hex-0.2.0@sha256:197d2561d2e216c4ead035b4911dabc6e678ac6257cb71b64e324c822f6f9f5a,726
     pantry-tree:
       size: 197
       sha256: 1e5aba0165fb8ffa93d1516a87026a59c245750ca5f2ed42bd53b8328620f98e
   original:
-    hackage: hex-0.2.0@sha256:197d2561d2e216c4ead035b4911dabc6e678ac6257cb71b64e324c822f6f9f5a,726
+    hackage: hex-0.2.0
 - completed:
-    hackage: quickcheck-state-machine-0.6.0@sha256:3e4f8df0f6b5d415e3c8840dc75034a63e37f56f5f8cfa1035ded16345235ac4,3825
+    hackage: quickcheck-state-machine-0.7.1@sha256:575f16ece44b20f204730b7b5d77a1ed91b33f4a961a4e70932fc8d602082b10,6153
     pantry-tree:
-      size: 1926
-      sha256: ae502fd7f4c6680294149bed482d1896904c1259d5ae614093da01e0731ec92e
+      size: 3022
+      sha256: edb32e2c7ac3be15e0d110b762990192d993326779f440984e56de0be5e0f714
   original:
-    hackage: quickcheck-state-machine-0.6.0
+    hackage: quickcheck-state-machine-0.7.1
 - completed:
-    hackage: servant-multipart-0.11.5@sha256:1633f715b5b53d648a1da69839bdc5046599f4f7244944d4bbf852dba38d8f4b,2319
+    hackage: servant-multipart-0.12.1@sha256:4b6a8c3f73d645e212f2a7a476f30a2ab7ed191945a3ff62154ab99d76dea7f0,1951
     pantry-tree:
-      size: 333
-      sha256: b3e1fd2ad2e654475be000c2f0ac6f717b5499436fa73eec50ceccddf352dcec
+      size: 332
+      sha256: 80f6033a74da5d7c6aded81c428d740a0bf6bfd49e13ce8cde68158abd5ff49f
   original:
-    hackage: servant-multipart-0.11.5@sha256:1633f715b5b53d648a1da69839bdc5046599f4f7244944d4bbf852dba38d8f4b,2319
+    hackage: servant-multipart-0.12.1
 - completed:
     name: HaskellNet-SSL
     version: 0.3.4.2
@@ -669,12 +669,12 @@ packages:
     git: https://github.com/vincenthz/hs-certificate
     commit: a899bda3d7666d25143be7be8f3105fc076703d9
 - completed:
-    hackage: polysemy-1.7.0.0@sha256:c972f33191113e2fe6809ea1cda24a6cabfeed2f115b3be0137dee7c65d08293,5977
+    hackage: polysemy-1.7.1.0@sha256:3ead7a332abd70b202920ed3bf2e36866de163f821e643adfdcc9d39867b8033,5977
     pantry-tree:
       size: 4577
-      sha256: 78c733f5dde13340e880bbb883dc64af948f6449da3a4025811cdc79c204dfde
+      sha256: 22f540602a4d5565d4d90bc6084eb4e578f1ed934917a4efd6b01f5b90f49fea
   original:
-    hackage: polysemy-1.7.0.0
+    hackage: polysemy-1.7.1.0
 - completed:
     hackage: polysemy-plugin-0.4.2.0@sha256:1dbcb892bb866926994dadafeb93e76ae4a6625dc3ae9ca0f4f419ee85cb2f7b,3154
     pantry-tree:
@@ -689,6 +689,48 @@ packages:
       sha256: a473605eda27f36717e3f0cbd66651563789107daa9b8d9db59b80cc07ff60d1
   original:
     hackage: polysemy-check-0.9.0.0
+- completed:
+    hackage: kind-generics-0.4.1.0@sha256:15e50867349de627c401af29f56b204dfb2ad2b12e83417132ffca3d5cd02462,1061
+    pantry-tree:
+      size: 390
+      sha256: 497a73c5243cd787c06b7b66258fccf6299e6a853fa44f050f72f0bf1967715f
+  original:
+    hackage: kind-generics-0.4.1.0
+- completed:
+    hackage: proto-lens-0.7.1.0@sha256:b151890929e71db5b8c2ad86cd758bcdf1dfcf25f34eb6c9ce19e3d7cd4eae39,2959
+    pantry-tree:
+      size: 1857
+      sha256: 2f1199d04d0588805e06faa0bf9a75898584d76243d4f945acbcc0e93913732e
+  original:
+    hackage: proto-lens-0.7.1.0
+- completed:
+    hackage: proto-lens-protoc-0.7.1.0@sha256:b0b92498af74fc4bb770d51f84405d591e73c085a0c1d9952dd3e14ce07b538f,2220
+    pantry-tree:
+      size: 1219
+      sha256: 1aaa82cb2823b33c9ea96608cc7ec245e54a0d14de8f18736be03220d8dbe683
+  original:
+    hackage: proto-lens-protoc-0.7.1.0
+- completed:
+    hackage: proto-lens-runtime-0.7.0.1@sha256:703f327422b2e204f8ea13c5e178edd8ab42ccd01c7a5a89fcb1b37ab474c68a,3038
+    pantry-tree:
+      size: 168
+      sha256: 145cb9a15b73d45b07cb3f9f0716256b2ed9e27ac296268ce100a4f0e477e110
+  original:
+    hackage: proto-lens-runtime-0.7.0.1
+- completed:
+    hackage: proto-lens-setup-0.4.0.5@sha256:ae4514963a6c20ad059bba427cd14b94c6007f614d797ebecae3c37f8bf0fa96,3108
+    pantry-tree:
+      size: 235
+      sha256: 14982fbc9ee0c6f9f9a59c2639b647613eb9c2cfa1d5b1b323077a15ae285ccf
+  original:
+    hackage: proto-lens-setup-0.4.0.5
+- completed:
+    hackage: tracing-0.0.7.2@sha256:25a531be1ffe4054085f2855fd5132be54aa2e6b31a730b26e2cb01bd96b22ea,1438
+    pantry-tree:
+      size: 672
+      sha256: b3059324bf8fea08874dd4f5518105f3edd6e469104242e652698f488a5227d5
+  original:
+    hackage: tracing-0.0.7.2
 - completed:
     hackage: ormolu-0.1.4.1@sha256:ed404eac6e4eb64da1ca5fb749e0f99907431a9633e6ba34e44d260e7d7728ba,6499
     pantry-tree:
@@ -704,22 +746,22 @@ packages:
   original:
     hackage: ghc-lib-parser-8.10.1.20200412@sha256:b0517bb150a02957d7180f131f5b94abd2a7f58a7d1532a012e71618282339c2,8751
 - completed:
-    hackage: headroom-0.2.1.0@sha256:084b72a071454516bff30c3f50e4f671fb12ee062602693ad5ffcafdea5fab99,8140
+    hackage: headroom-0.4.2.0@sha256:ebaf701628054472de745fa57b33ddf1021b99a8e4de5f5b96f21fb296b27652,10873
     pantry-tree:
-      size: 9195
-      sha256: 11d2ac77cee54cc1f222e574e4126189fe5b60a47a1aedbafc2ab0de709b29c6
+      size: 15450
+      sha256: cd772daa4d3ea56ca28764afd60186363bd92cbf69c0ba3c0a9c064507e79ecc
   original:
-    hackage: headroom-0.2.1.0
+    hackage: headroom-0.4.2.0
 - completed:
-    hackage: implicit-hie-0.1.2.5@sha256:517a98ef72f92f0a1617495222774fed3a751a64b0c06fbfc7b858d7aa5de279,2998
+    hackage: implicit-hie-0.1.2.6@sha256:f50a908979a574a881f753c0f9a5224f023f438b30fdefc5b7fa01803b07a280,2998
     pantry-tree:
       size: 844
-      sha256: 9bf2645187637b647dfaebf37a45a57e221b3527592ce3b1cfd9faf90339dac3
+      sha256: 87e1a41e292526d86b55668bca628cf917056d82001438dc6975e4f35cf5210d
   original:
-    hackage: implicit-hie-0.1.2.5
+    hackage: implicit-hie-0.1.2.6
 snapshots:
 - completed:
-    size: 532382
-    url: https://raw.githubusercontent.com/commercialhaskell/stackage-snapshots/master/lts/16/14.yaml
-    sha256: 1ef27e36f38824abafc43224ca612211b3828fa9ffd31ba0fc2867ae2e19ba90
-  original: lts-16.14
+    size: 586296
+    url: https://raw.githubusercontent.com/commercialhaskell/stackage-snapshots/master/lts/18/18.yaml
+    sha256: 63539429076b7ebbab6daa7656cfb079393bf644971156dc349d7c0453694ac2
+  original: lts-18.18
diff --git a/tools/api-simulations/api-simulations.cabal b/tools/api-simulations/api-simulations.cabal
index d8e720f3c1d..59a2b2dfa20 100644
--- a/tools/api-simulations/api-simulations.cabal
+++ b/tools/api-simulations/api-simulations.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 0bce6d3ef71a3fc2991a10dad9cb794a473111426a2f7d95762ef22bbc353058
+-- hash: cc1ee9817c17b416b041da1872f67634723249762332426dc63b0b1ab43309e8
 
 name:           api-simulations
 version:        0.4.2
@@ -25,7 +25,46 @@ library
       Paths_api_simulations
   hs-source-dirs:
       lib/src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       api-bot
@@ -49,7 +88,46 @@ executable api-loadtest
       Paths_api_simulations
   hs-source-dirs:
       loadtest/src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded -with-rtsopts=-N -with-rtsopts=-T
   build-depends:
       api-bot
@@ -81,7 +159,46 @@ executable api-smoketest
       Paths_api_simulations
   hs-source-dirs:
       smoketest/src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded -with-rtsopts=-N -with-rtsopts=-T
   build-depends:
       api-bot
diff --git a/tools/bonanza/bonanza.cabal b/tools/bonanza/bonanza.cabal
index d07743e8bc7..6b3221f53e6 100644
--- a/tools/bonanza/bonanza.cabal
+++ b/tools/bonanza/bonanza.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: d11a5dfdfd8b16afefbb6870c4bc71c097f7f86016ffa65d6fbdc74ece7cb504
+-- hash: e99811a9a954d2a94b4ac9e909d56d22ede51a464f80aefefd5b4e1b8b93b231
 
 name:           bonanza
 version:        3.6.0
@@ -44,7 +44,46 @@ library
       Paths_bonanza
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -funbox-small-strict-fields -fno-warn-unused-do-bind
   build-depends:
       aeson >=1.0
@@ -83,7 +122,46 @@ executable bonanza
   main-is: main/Main.hs
   other-modules:
       Paths_bonanza
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -funbox-small-strict-fields -fno-warn-unused-do-bind -threaded -rtsopts -with-rtsopts=-T -with-rtsopts=-N
   build-depends:
       base ==4.*
@@ -99,7 +177,46 @@ executable kibana-raw
   main-is: main/KibanaRaw.hs
   other-modules:
       Paths_bonanza
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -funbox-small-strict-fields -rtsopts
   build-depends:
       aeson >=1.0
@@ -119,7 +236,46 @@ executable kibanana
   main-is: main/Kibanana.hs
   other-modules:
       Paths_bonanza
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -funbox-small-strict-fields -fno-warn-unused-do-bind -threaded -rtsopts -with-rtsopts=-T -with-rtsopts=-N
   build-depends:
       async
@@ -148,7 +304,46 @@ test-suite bonanza-tests
       Paths_bonanza
   hs-source-dirs:
       test/unit
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded -with-rtsopts=-N
   build-depends:
       QuickCheck
diff --git a/tools/convert-to-cabal/shell.nix b/tools/convert-to-cabal/shell.nix
index 87266663a03..c708398b849 100644
--- a/tools/convert-to-cabal/shell.nix
+++ b/tools/convert-to-cabal/shell.nix
@@ -13,7 +13,7 @@ let
         "stack2cabal" = super.callCabal2nix "stack2cabal" source { };
       };
 
-      haskellPackages = pkgs.haskell.packages.ghc884.override {
+      haskellPackages = pkgs.haskell.packages.ghc8107.override {
         overrides = overlay;
       };
 
diff --git a/tools/db/auto-whitelist/auto-whitelist.cabal b/tools/db/auto-whitelist/auto-whitelist.cabal
index aca9fef9eab..695b541cf3e 100644
--- a/tools/db/auto-whitelist/auto-whitelist.cabal
+++ b/tools/db/auto-whitelist/auto-whitelist.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: a44f3136d459b6192979fc5f06b79873931418960cec00388852fba77d4d0f47
+-- hash: aecd5a2bbe1504d3601577aed1719da584856f3d5f53327650f3c80331619269
 
 name:           auto-whitelist
 version:        1.0.0
@@ -24,7 +24,46 @@ executable auto-whitelist
       Paths_auto_whitelist
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -funbox-strict-fields -threaded -with-rtsopts=-N -with-rtsopts=-T -rtsopts
   build-depends:
       base
diff --git a/tools/db/billing-team-member-backfill/billing-team-member-backfill.cabal b/tools/db/billing-team-member-backfill/billing-team-member-backfill.cabal
index 18b61ba03fa..cec990a25c0 100644
--- a/tools/db/billing-team-member-backfill/billing-team-member-backfill.cabal
+++ b/tools/db/billing-team-member-backfill/billing-team-member-backfill.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: f4b64220a67932d0f5b25d2a5da2c18ee914d31f0b1d9c14b1b43c11ebb692c8
+-- hash: ada20e0991745d0c8999668355177fca0aef12891245e599d89f28228f0961d4
 
 name:           billing-team-member-backfill
 version:        1.0.0
@@ -24,7 +24,46 @@ executable billing-team-member-backfill
       Paths_billing_team_member_backfill
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -funbox-strict-fields -threaded -with-rtsopts=-N -with-rtsopts=-T -rtsopts
   build-depends:
       base
diff --git a/tools/db/find-undead/find-undead.cabal b/tools/db/find-undead/find-undead.cabal
index 73b6442e470..3882556cc48 100644
--- a/tools/db/find-undead/find-undead.cabal
+++ b/tools/db/find-undead/find-undead.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 803cec639d33ee7123c779f5eedc7c78efdda2ae46ab9ecfc58e088e168b8ebc
+-- hash: 30202a4d538697375b0b0dc3d4789ad278c7b41e40169f1b41c538410d03d3da
 
 name:           find-undead
 version:        1.0.0
@@ -24,7 +24,46 @@ executable find-undead
       Paths_find_undead
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -funbox-strict-fields -threaded -with-rtsopts=-N -with-rtsopts=-T -rtsopts
   build-depends:
       aeson
diff --git a/tools/db/migrate-sso-feature-flag/migrate-sso-feature-flag.cabal b/tools/db/migrate-sso-feature-flag/migrate-sso-feature-flag.cabal
index dc80fff1e7f..df88ba36831 100644
--- a/tools/db/migrate-sso-feature-flag/migrate-sso-feature-flag.cabal
+++ b/tools/db/migrate-sso-feature-flag/migrate-sso-feature-flag.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 88d2d668ec329351cd3ab3108eab05b3db51898dedd0f6f9b85be620f4f1e4d5
+-- hash: 6a64c18d59c109cea4e58b9161d589c395fa1b34ba2705060aebc4926ee1f618
 
 name:           migrate-sso-feature-flag
 version:        1.0.0
@@ -24,7 +24,46 @@ executable migrate-sso-feature-flag
       Paths_migrate_sso_feature_flag
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -funbox-strict-fields -threaded -with-rtsopts=-N -with-rtsopts=-T -rtsopts
   build-depends:
       base
diff --git a/tools/db/move-team/move-team.cabal b/tools/db/move-team/move-team.cabal
index 8b3fb1e66c5..70b49422b5f 100644
--- a/tools/db/move-team/move-team.cabal
+++ b/tools/db/move-team/move-team.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 6f97fa57af68acb9606816e6048ebe009ec9c0f01a971d39ae9dbc5e2061346d
+-- hash: 2168cecbb403740519009eb790938bbfec816c047f81bc1ec44d6157ff798516
 
 name:           move-team
 version:        1.0.0
@@ -28,7 +28,46 @@ library
       Paths_move_team
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -funbox-strict-fields -threaded -with-rtsopts=-N -with-rtsopts=-T -rtsopts
   build-depends:
       aeson
@@ -63,7 +102,46 @@ executable move-team
       Paths_move_team
   hs-source-dirs:
       move-team
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -funbox-strict-fields -threaded -with-rtsopts=-N -with-rtsopts=-T -rtsopts
   build-depends:
       aeson
@@ -99,7 +177,46 @@ executable move-team-generate
       Paths_move_team
   hs-source-dirs:
       move-team-generate
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -funbox-strict-fields -threaded -with-rtsopts=-N -with-rtsopts=-T -rtsopts
   build-depends:
       aeson
diff --git a/tools/db/move-team/src/Schema.hs b/tools/db/move-team/src/Schema.hs
index 1958fb705b1..6706e6ebee0 100644
--- a/tools/db/move-team/src/Schema.hs
+++ b/tools/db/move-team/src/Schema.hs
@@ -40,7 +40,7 @@ import Wire.API.User.Password (PasswordResetKey)
 
 type RowBrigClients = (Maybe UUID, Maybe Text, Maybe Int32, Maybe Text, Maybe IP, Maybe Text, Maybe Double, Maybe Double, Maybe Text, Maybe UTCTime, Maybe Int32)
 
-selectBrigClients :: PrepQuery R (Identity ([UserId])) RowBrigClients
+selectBrigClients :: PrepQuery R (Identity [UserId]) RowBrigClients
 selectBrigClients = "SELECT user, client, class, cookie, ip, label, lat, lon, model, tstamp, type FROM clients WHERE user in ?"
 
 readBrigClients :: Env -> [UserId] -> ConduitM () [RowBrigClients] IO ()
@@ -57,7 +57,7 @@ readBrigClientsAll Env {..} =
     paginateC selectBrigClientsAll (paramsP LocalQuorum () envPageSize) x5
 
 exportBrigClientsFull :: Env -> FilePath -> IO ()
-exportBrigClientsFull env@Env {..} path = do
+exportBrigClientsFull env path = do
   putStrLn $ "Exporting " <> "brig.clients" <> " to " <> path
   withBinaryFile path WriteMode $ \handle ->
     runConduit $
@@ -74,7 +74,7 @@ importBrigClients Env {..} path = do
   if exists
     then do
       putStrLn $ "Importing " <> path <> " to " <> "brig.clients"
-      withBinaryFile path ReadMode $ \handle -> do
+      withBinaryFile path ReadMode $ \handle ->
         runConduit $
           sourceJsonLines handle
             .| transPipe (runClient envBrig) (sinkTableRows insertBrigClients)
@@ -86,7 +86,7 @@ importBrigClients Env {..} path = do
 
 type RowBrigConnection = (Maybe UUID, Maybe UUID, Maybe UUID, Maybe UTCTime, Maybe Text, Maybe Int32)
 
-selectBrigConnection :: PrepQuery R (Identity ([UserId])) RowBrigConnection
+selectBrigConnection :: PrepQuery R (Identity [UserId]) RowBrigConnection
 selectBrigConnection = "SELECT left, right, conv, last_update, message, status FROM connection WHERE left in ?"
 
 readBrigConnection :: Env -> [UserId] -> ConduitM () [RowBrigConnection] IO ()
@@ -103,7 +103,7 @@ readBrigConnectionAll Env {..} =
     paginateC selectBrigConnectionAll (paramsP LocalQuorum () envPageSize) x5
 
 exportBrigConnectionFull :: Env -> FilePath -> IO ()
-exportBrigConnectionFull env@Env {..} path = do
+exportBrigConnectionFull env path = do
   putStrLn $ "Exporting " <> "brig.connection" <> " to " <> path
   withBinaryFile path WriteMode $ \handle ->
     runConduit $
@@ -120,7 +120,7 @@ importBrigConnection Env {..} path = do
   if exists
     then do
       putStrLn $ "Importing " <> path <> " to " <> "brig.connection"
-      withBinaryFile path ReadMode $ \handle -> do
+      withBinaryFile path ReadMode $ \handle ->
         runConduit $
           sourceJsonLines handle
             .| transPipe (runClient envBrig) (sinkTableRows insertBrigConnection)
@@ -132,7 +132,7 @@ importBrigConnection Env {..} path = do
 
 type RowBrigLoginCodes = (Maybe UUID, Maybe Text, Maybe Int32, Maybe UTCTime)
 
-selectBrigLoginCodes :: PrepQuery R (Identity ([UserId])) RowBrigLoginCodes
+selectBrigLoginCodes :: PrepQuery R (Identity [UserId]) RowBrigLoginCodes
 selectBrigLoginCodes = "SELECT user, code, retries, timeout FROM login_codes WHERE user in ?"
 
 readBrigLoginCodes :: Env -> [UserId] -> ConduitM () [RowBrigLoginCodes] IO ()
@@ -149,7 +149,7 @@ readBrigLoginCodesAll Env {..} =
     paginateC selectBrigLoginCodesAll (paramsP LocalQuorum () envPageSize) x5
 
 exportBrigLoginCodesFull :: Env -> FilePath -> IO ()
-exportBrigLoginCodesFull env@Env {..} path = do
+exportBrigLoginCodesFull env path = do
   putStrLn $ "Exporting " <> "brig.login_codes" <> " to " <> path
   withBinaryFile path WriteMode $ \handle ->
     runConduit $
@@ -166,7 +166,7 @@ importBrigLoginCodes Env {..} path = do
   if exists
     then do
       putStrLn $ "Importing " <> path <> " to " <> "brig.login_codes"
-      withBinaryFile path ReadMode $ \handle -> do
+      withBinaryFile path ReadMode $ \handle ->
         runConduit $
           sourceJsonLines handle
             .| transPipe (runClient envBrig) (sinkTableRows insertBrigLoginCodes)
@@ -178,7 +178,7 @@ importBrigLoginCodes Env {..} path = do
 
 type RowBrigPasswordReset = (Maybe Ascii, Maybe Ascii, Maybe Int32, Maybe UTCTime, Maybe UUID)
 
-selectBrigPasswordReset :: PrepQuery R (Identity ([PasswordResetKey])) RowBrigPasswordReset
+selectBrigPasswordReset :: PrepQuery R (Identity [PasswordResetKey]) RowBrigPasswordReset
 selectBrigPasswordReset = "SELECT key, code, retries, timeout, user FROM password_reset WHERE key in ?"
 
 readBrigPasswordReset :: Env -> [PasswordResetKey] -> ConduitM () [RowBrigPasswordReset] IO ()
@@ -195,7 +195,7 @@ readBrigPasswordResetAll Env {..} =
     paginateC selectBrigPasswordResetAll (paramsP LocalQuorum () envPageSize) x5
 
 exportBrigPasswordResetFull :: Env -> FilePath -> IO ()
-exportBrigPasswordResetFull env@Env {..} path = do
+exportBrigPasswordResetFull env path = do
   putStrLn $ "Exporting " <> "brig.password_reset" <> " to " <> path
   withBinaryFile path WriteMode $ \handle ->
     runConduit $
@@ -212,7 +212,7 @@ importBrigPasswordReset Env {..} path = do
   if exists
     then do
       putStrLn $ "Importing " <> path <> " to " <> "brig.password_reset"
-      withBinaryFile path ReadMode $ \handle -> do
+      withBinaryFile path ReadMode $ \handle ->
         runConduit $
           sourceJsonLines handle
             .| transPipe (runClient envBrig) (sinkTableRows insertBrigPasswordReset)
@@ -224,7 +224,7 @@ importBrigPasswordReset Env {..} path = do
 
 type RowBrigPrekeys = (Maybe UUID, Maybe Text, Maybe Int32, Maybe Text)
 
-selectBrigPrekeys :: PrepQuery R (Identity ([UserId])) RowBrigPrekeys
+selectBrigPrekeys :: PrepQuery R (Identity [UserId]) RowBrigPrekeys
 selectBrigPrekeys = "SELECT user, client, key, data FROM prekeys WHERE user in ?"
 
 readBrigPrekeys :: Env -> [UserId] -> ConduitM () [RowBrigPrekeys] IO ()
@@ -241,7 +241,7 @@ readBrigPrekeysAll Env {..} =
     paginateC selectBrigPrekeysAll (paramsP LocalQuorum () envPageSize) x5
 
 exportBrigPrekeysFull :: Env -> FilePath -> IO ()
-exportBrigPrekeysFull env@Env {..} path = do
+exportBrigPrekeysFull env path = do
   putStrLn $ "Exporting " <> "brig.prekeys" <> " to " <> path
   withBinaryFile path WriteMode $ \handle ->
     runConduit $
@@ -258,7 +258,7 @@ importBrigPrekeys Env {..} path = do
   if exists
     then do
       putStrLn $ "Importing " <> path <> " to " <> "brig.prekeys"
-      withBinaryFile path ReadMode $ \handle -> do
+      withBinaryFile path ReadMode $ \handle ->
         runConduit $
           sourceJsonLines handle
             .| transPipe (runClient envBrig) (sinkTableRows insertBrigPrekeys)
@@ -270,7 +270,7 @@ importBrigPrekeys Env {..} path = do
 
 type RowBrigProperties = (Maybe UUID, Maybe Ascii, Maybe Blob)
 
-selectBrigProperties :: PrepQuery R (Identity ([UserId])) RowBrigProperties
+selectBrigProperties :: PrepQuery R (Identity [UserId]) RowBrigProperties
 selectBrigProperties = "SELECT user, key, value FROM properties WHERE user in ?"
 
 readBrigProperties :: Env -> [UserId] -> ConduitM () [RowBrigProperties] IO ()
@@ -287,7 +287,7 @@ readBrigPropertiesAll Env {..} =
     paginateC selectBrigPropertiesAll (paramsP LocalQuorum () envPageSize) x5
 
 exportBrigPropertiesFull :: Env -> FilePath -> IO ()
-exportBrigPropertiesFull env@Env {..} path = do
+exportBrigPropertiesFull env path = do
   putStrLn $ "Exporting " <> "brig.properties" <> " to " <> path
   withBinaryFile path WriteMode $ \handle ->
     runConduit $
@@ -304,7 +304,7 @@ importBrigProperties Env {..} path = do
   if exists
     then do
       putStrLn $ "Importing " <> path <> " to " <> "brig.properties"
-      withBinaryFile path ReadMode $ \handle -> do
+      withBinaryFile path ReadMode $ \handle ->
         runConduit $
           sourceJsonLines handle
             .| transPipe (runClient envBrig) (sinkTableRows insertBrigProperties)
@@ -316,7 +316,7 @@ importBrigProperties Env {..} path = do
 
 type RowBrigRichInfo = (Maybe UUID, Maybe Blob)
 
-selectBrigRichInfo :: PrepQuery R (Identity ([UserId])) RowBrigRichInfo
+selectBrigRichInfo :: PrepQuery R (Identity [UserId]) RowBrigRichInfo
 selectBrigRichInfo = "SELECT user, json FROM rich_info WHERE user in ?"
 
 readBrigRichInfo :: Env -> [UserId] -> ConduitM () [RowBrigRichInfo] IO ()
@@ -333,7 +333,7 @@ readBrigRichInfoAll Env {..} =
     paginateC selectBrigRichInfoAll (paramsP LocalQuorum () envPageSize) x5
 
 exportBrigRichInfoFull :: Env -> FilePath -> IO ()
-exportBrigRichInfoFull env@Env {..} path = do
+exportBrigRichInfoFull env path = do
   putStrLn $ "Exporting " <> "brig.rich_info" <> " to " <> path
   withBinaryFile path WriteMode $ \handle ->
     runConduit $
@@ -350,7 +350,7 @@ importBrigRichInfo Env {..} path = do
   if exists
     then do
       putStrLn $ "Importing " <> path <> " to " <> "brig.rich_info"
-      withBinaryFile path ReadMode $ \handle -> do
+      withBinaryFile path ReadMode $ \handle ->
         runConduit $
           sourceJsonLines handle
             .| transPipe (runClient envBrig) (sinkTableRows insertBrigRichInfo)
@@ -362,7 +362,7 @@ importBrigRichInfo Env {..} path = do
 
 type RowBrigUser = (Maybe UUID, Maybe [Float], Maybe Int32, Maybe Bool, Maybe [AssetIgnoreData], Maybe Ascii, Maybe Text, Maybe UTCTime, Maybe Text, Maybe Ascii, Maybe Int32, Maybe Text, Maybe Blob, Maybe Text, Maybe [Blob], Maybe UUID, Maybe Bool, Maybe UUID, Maybe Text, Maybe Int32, Maybe UUID)
 
-selectBrigUser :: PrepQuery R (Identity ([UserId])) RowBrigUser
+selectBrigUser :: PrepQuery R (Identity [UserId]) RowBrigUser
 selectBrigUser = "SELECT id, accent, accent_id, activated, assets, country, email, expires, handle, language, managed_by, name, password, phone, picture, provider, searchable, service, sso_id, status, team FROM user WHERE id in ?"
 
 readBrigUser :: Env -> [UserId] -> ConduitM () [RowBrigUser] IO ()
@@ -379,7 +379,7 @@ readBrigUserAll Env {..} =
     paginateC selectBrigUserAll (paramsP LocalQuorum () envPageSize) x5
 
 exportBrigUserFull :: Env -> FilePath -> IO ()
-exportBrigUserFull env@Env {..} path = do
+exportBrigUserFull env path = do
   putStrLn $ "Exporting " <> "brig.user" <> " to " <> path
   withBinaryFile path WriteMode $ \handle ->
     runConduit $
@@ -396,7 +396,7 @@ importBrigUser Env {..} path = do
   if exists
     then do
       putStrLn $ "Importing " <> path <> " to " <> "brig.user"
-      withBinaryFile path ReadMode $ \handle -> do
+      withBinaryFile path ReadMode $ \handle ->
         runConduit $
           sourceJsonLines handle
             .| transPipe (runClient envBrig) (sinkTableRows insertBrigUser)
@@ -408,7 +408,7 @@ importBrigUser Env {..} path = do
 
 type RowBrigUserHandle = (Maybe Text, Maybe UUID)
 
-selectBrigUserHandle :: PrepQuery R (Identity ([Handle])) RowBrigUserHandle
+selectBrigUserHandle :: PrepQuery R (Identity [Handle]) RowBrigUserHandle
 selectBrigUserHandle = "SELECT handle, user FROM user_handle WHERE handle in ?"
 
 readBrigUserHandle :: Env -> [Handle] -> ConduitM () [RowBrigUserHandle] IO ()
@@ -425,7 +425,7 @@ readBrigUserHandleAll Env {..} =
     paginateC selectBrigUserHandleAll (paramsP LocalQuorum () envPageSize) x5
 
 exportBrigUserHandleFull :: Env -> FilePath -> IO ()
-exportBrigUserHandleFull env@Env {..} path = do
+exportBrigUserHandleFull env path = do
   putStrLn $ "Exporting " <> "brig.user_handle" <> " to " <> path
   withBinaryFile path WriteMode $ \handle ->
     runConduit $
@@ -442,7 +442,7 @@ importBrigUserHandle Env {..} path = do
   if exists
     then do
       putStrLn $ "Importing " <> path <> " to " <> "brig.user_handle"
-      withBinaryFile path ReadMode $ \handle -> do
+      withBinaryFile path ReadMode $ \handle ->
         runConduit $
           sourceJsonLines handle
             .| transPipe (runClient envBrig) (sinkTableRows insertBrigUserHandle)
@@ -454,7 +454,7 @@ importBrigUserHandle Env {..} path = do
 
 type RowBrigUserKeys = (Maybe Text, Maybe UUID)
 
-selectBrigUserKeys :: PrepQuery R (Identity ([Int32])) RowBrigUserKeys
+selectBrigUserKeys :: PrepQuery R (Identity [Int32]) RowBrigUserKeys
 selectBrigUserKeys = "SELECT key, user FROM user_keys WHERE key in ?"
 
 readBrigUserKeys :: Env -> [Int32] -> ConduitM () [RowBrigUserKeys] IO ()
@@ -471,7 +471,7 @@ readBrigUserKeysAll Env {..} =
     paginateC selectBrigUserKeysAll (paramsP LocalQuorum () envPageSize) x5
 
 exportBrigUserKeysFull :: Env -> FilePath -> IO ()
-exportBrigUserKeysFull env@Env {..} path = do
+exportBrigUserKeysFull env path = do
   putStrLn $ "Exporting " <> "brig.user_keys" <> " to " <> path
   withBinaryFile path WriteMode $ \handle ->
     runConduit $
@@ -488,7 +488,7 @@ importBrigUserKeys Env {..} path = do
   if exists
     then do
       putStrLn $ "Importing " <> path <> " to " <> "brig.user_keys"
-      withBinaryFile path ReadMode $ \handle -> do
+      withBinaryFile path ReadMode $ \handle ->
         runConduit $
           sourceJsonLines handle
             .| transPipe (runClient envBrig) (sinkTableRows insertBrigUserKeys)
@@ -500,7 +500,7 @@ importBrigUserKeys Env {..} path = do
 
 type RowBrigUserKeysHash = (Maybe Blob, Maybe Int32, Maybe UUID)
 
-selectBrigUserKeysHash :: PrepQuery R (Identity ([Int32])) RowBrigUserKeysHash
+selectBrigUserKeysHash :: PrepQuery R (Identity [Int32]) RowBrigUserKeysHash
 selectBrigUserKeysHash = "SELECT key, key_type, user FROM user_keys_hash WHERE key in ?"
 
 readBrigUserKeysHash :: Env -> [Int32] -> ConduitM () [RowBrigUserKeysHash] IO ()
@@ -517,7 +517,7 @@ readBrigUserKeysHashAll Env {..} =
     paginateC selectBrigUserKeysHashAll (paramsP LocalQuorum () envPageSize) x5
 
 exportBrigUserKeysHashFull :: Env -> FilePath -> IO ()
-exportBrigUserKeysHashFull env@Env {..} path = do
+exportBrigUserKeysHashFull env path = do
   putStrLn $ "Exporting " <> "brig.user_keys_hash" <> " to " <> path
   withBinaryFile path WriteMode $ \handle ->
     runConduit $
@@ -534,7 +534,7 @@ importBrigUserKeysHash Env {..} path = do
   if exists
     then do
       putStrLn $ "Importing " <> path <> " to " <> "brig.user_keys_hash"
-      withBinaryFile path ReadMode $ \handle -> do
+      withBinaryFile path ReadMode $ \handle ->
         runConduit $
           sourceJsonLines handle
             .| transPipe (runClient envBrig) (sinkTableRows insertBrigUserKeysHash)
@@ -546,7 +546,7 @@ importBrigUserKeysHash Env {..} path = do
 
 type RowGalleyBillingTeamMember = (Maybe UUID, Maybe UUID)
 
-selectGalleyBillingTeamMember :: PrepQuery R (Identity (TeamId)) RowGalleyBillingTeamMember
+selectGalleyBillingTeamMember :: PrepQuery R (Identity TeamId) RowGalleyBillingTeamMember
 selectGalleyBillingTeamMember = "SELECT team, user FROM billing_team_member WHERE team = ?"
 
 readGalleyBillingTeamMember :: Env -> TeamId -> ConduitM () [RowGalleyBillingTeamMember] IO ()
@@ -563,7 +563,7 @@ readGalleyBillingTeamMemberAll Env {..} =
     paginateC selectGalleyBillingTeamMemberAll (paramsP LocalQuorum () envPageSize) x5
 
 exportGalleyBillingTeamMemberFull :: Env -> FilePath -> IO ()
-exportGalleyBillingTeamMemberFull env@Env {..} path = do
+exportGalleyBillingTeamMemberFull env path = do
   putStrLn $ "Exporting " <> "galley.billing_team_member" <> " to " <> path
   withBinaryFile path WriteMode $ \handle ->
     runConduit $
@@ -580,7 +580,7 @@ importGalleyBillingTeamMember Env {..} path = do
   if exists
     then do
       putStrLn $ "Importing " <> path <> " to " <> "galley.billing_team_member"
-      withBinaryFile path ReadMode $ \handle -> do
+      withBinaryFile path ReadMode $ \handle ->
         runConduit $
           sourceJsonLines handle
             .| transPipe (runClient envGalley) (sinkTableRows insertGalleyBillingTeamMember)
@@ -592,7 +592,7 @@ importGalleyBillingTeamMember Env {..} path = do
 
 type RowGalleyClients = (Maybe UUID, Maybe (Cassandra.Set Text))
 
-selectGalleyClients :: PrepQuery R (Identity ([UserId])) RowGalleyClients
+selectGalleyClients :: PrepQuery R (Identity [UserId]) RowGalleyClients
 selectGalleyClients = "SELECT user, clients FROM clients WHERE user in ?"
 
 readGalleyClients :: Env -> [UserId] -> ConduitM () [RowGalleyClients] IO ()
@@ -609,7 +609,7 @@ readGalleyClientsAll Env {..} =
     paginateC selectGalleyClientsAll (paramsP LocalQuorum () envPageSize) x5
 
 exportGalleyClientsFull :: Env -> FilePath -> IO ()
-exportGalleyClientsFull env@Env {..} path = do
+exportGalleyClientsFull env path = do
   putStrLn $ "Exporting " <> "galley.clients" <> " to " <> path
   withBinaryFile path WriteMode $ \handle ->
     runConduit $
@@ -626,7 +626,7 @@ importGalleyClients Env {..} path = do
   if exists
     then do
       putStrLn $ "Importing " <> path <> " to " <> "galley.clients"
-      withBinaryFile path ReadMode $ \handle -> do
+      withBinaryFile path ReadMode $ \handle ->
         runConduit $
           sourceJsonLines handle
             .| transPipe (runClient envGalley) (sinkTableRows insertGalleyClients)
@@ -638,7 +638,7 @@ importGalleyClients Env {..} path = do
 
 type RowGalleyConversation = (Maybe UUID, Maybe (Cassandra.Set Int32), Maybe Int32, Maybe UUID, Maybe Bool, Maybe Int64, Maybe Text, Maybe Int32, Maybe UUID, Maybe Int32)
 
-selectGalleyConversation :: PrepQuery R (Identity ([ConvId])) RowGalleyConversation
+selectGalleyConversation :: PrepQuery R (Identity [ConvId]) RowGalleyConversation
 selectGalleyConversation = "SELECT conv, access, access_role, creator, deleted, message_timer, name, receipt_mode, team, type FROM conversation WHERE conv in ?"
 
 readGalleyConversation :: Env -> [ConvId] -> ConduitM () [RowGalleyConversation] IO ()
@@ -655,7 +655,7 @@ readGalleyConversationAll Env {..} =
     paginateC selectGalleyConversationAll (paramsP LocalQuorum () envPageSize) x5
 
 exportGalleyConversationFull :: Env -> FilePath -> IO ()
-exportGalleyConversationFull env@Env {..} path = do
+exportGalleyConversationFull env path = do
   putStrLn $ "Exporting " <> "galley.conversation" <> " to " <> path
   withBinaryFile path WriteMode $ \handle ->
     runConduit $
@@ -672,7 +672,7 @@ importGalleyConversation Env {..} path = do
   if exists
     then do
       putStrLn $ "Importing " <> path <> " to " <> "galley.conversation"
-      withBinaryFile path ReadMode $ \handle -> do
+      withBinaryFile path ReadMode $ \handle ->
         runConduit $
           sourceJsonLines handle
             .| transPipe (runClient envGalley) (sinkTableRows insertGalleyConversation)
@@ -684,7 +684,7 @@ importGalleyConversation Env {..} path = do
 
 type RowGalleyMember = (Maybe UUID, Maybe UUID, Maybe Text, Maybe Bool, Maybe Text, Maybe Bool, Maybe Text, Maybe Bool, Maybe Text, Maybe Int32, Maybe UUID, Maybe UUID, Maybe Int32, Maybe Text, Maybe UUID)
 
-selectGalleyMember :: PrepQuery R (Identity ([ConvId])) RowGalleyMember
+selectGalleyMember :: PrepQuery R (Identity [ConvId]) RowGalleyMember
 selectGalleyMember = "SELECT conv, user, conversation_role, hidden, hidden_ref, otr_archived, otr_archived_ref, otr_muted, otr_muted_ref, otr_muted_status, provider, service, status, user_remote_domain, user_remote_id FROM member WHERE conv in ?"
 
 readGalleyMember :: Env -> [ConvId] -> ConduitM () [RowGalleyMember] IO ()
@@ -701,7 +701,7 @@ readGalleyMemberAll Env {..} =
     paginateC selectGalleyMemberAll (paramsP LocalQuorum () envPageSize) x5
 
 exportGalleyMemberFull :: Env -> FilePath -> IO ()
-exportGalleyMemberFull env@Env {..} path = do
+exportGalleyMemberFull env path = do
   putStrLn $ "Exporting " <> "galley.member" <> " to " <> path
   withBinaryFile path WriteMode $ \handle ->
     runConduit $
@@ -718,7 +718,7 @@ importGalleyMember Env {..} path = do
   if exists
     then do
       putStrLn $ "Importing " <> path <> " to " <> "galley.member"
-      withBinaryFile path ReadMode $ \handle -> do
+      withBinaryFile path ReadMode $ \handle ->
         runConduit $
           sourceJsonLines handle
             .| transPipe (runClient envGalley) (sinkTableRows insertGalleyMember)
@@ -730,7 +730,7 @@ importGalleyMember Env {..} path = do
 
 type RowGalleyTeam = (Maybe UUID, Maybe Bool, Maybe UUID, Maybe Bool, Maybe Text, Maybe Text, Maybe Text, Maybe Int32, Maybe Int32)
 
-selectGalleyTeam :: PrepQuery R (Identity (TeamId)) RowGalleyTeam
+selectGalleyTeam :: PrepQuery R (Identity TeamId) RowGalleyTeam
 selectGalleyTeam = "SELECT team, binding, creator, deleted, icon, icon_key, name, search_visibility, status FROM team WHERE team = ?"
 
 readGalleyTeam :: Env -> TeamId -> ConduitM () [RowGalleyTeam] IO ()
@@ -747,7 +747,7 @@ readGalleyTeamAll Env {..} =
     paginateC selectGalleyTeamAll (paramsP LocalQuorum () envPageSize) x5
 
 exportGalleyTeamFull :: Env -> FilePath -> IO ()
-exportGalleyTeamFull env@Env {..} path = do
+exportGalleyTeamFull env path = do
   putStrLn $ "Exporting " <> "galley.team" <> " to " <> path
   withBinaryFile path WriteMode $ \handle ->
     runConduit $
@@ -764,7 +764,7 @@ importGalleyTeam Env {..} path = do
   if exists
     then do
       putStrLn $ "Importing " <> path <> " to " <> "galley.team"
-      withBinaryFile path ReadMode $ \handle -> do
+      withBinaryFile path ReadMode $ \handle ->
         runConduit $
           sourceJsonLines handle
             .| transPipe (runClient envGalley) (sinkTableRows insertGalleyTeam)
@@ -776,7 +776,7 @@ importGalleyTeam Env {..} path = do
 
 type RowGalleyTeamConv = (Maybe UUID, Maybe UUID, Maybe Bool)
 
-selectGalleyTeamConv :: PrepQuery R (Identity (TeamId)) RowGalleyTeamConv
+selectGalleyTeamConv :: PrepQuery R (Identity TeamId) RowGalleyTeamConv
 selectGalleyTeamConv = "SELECT team, conv, managed FROM team_conv WHERE team = ?"
 
 readGalleyTeamConv :: Env -> TeamId -> ConduitM () [RowGalleyTeamConv] IO ()
@@ -793,7 +793,7 @@ readGalleyTeamConvAll Env {..} =
     paginateC selectGalleyTeamConvAll (paramsP LocalQuorum () envPageSize) x5
 
 exportGalleyTeamConvFull :: Env -> FilePath -> IO ()
-exportGalleyTeamConvFull env@Env {..} path = do
+exportGalleyTeamConvFull env path = do
   putStrLn $ "Exporting " <> "galley.team_conv" <> " to " <> path
   withBinaryFile path WriteMode $ \handle ->
     runConduit $
@@ -810,7 +810,7 @@ importGalleyTeamConv Env {..} path = do
   if exists
     then do
       putStrLn $ "Importing " <> path <> " to " <> "galley.team_conv"
-      withBinaryFile path ReadMode $ \handle -> do
+      withBinaryFile path ReadMode $ \handle ->
         runConduit $
           sourceJsonLines handle
             .| transPipe (runClient envGalley) (sinkTableRows insertGalleyTeamConv)
@@ -822,7 +822,7 @@ importGalleyTeamConv Env {..} path = do
 
 type RowGalleyTeamFeatures = (Maybe UUID, Maybe Int32, Maybe Int32, Maybe Int32, Maybe Int32, Maybe Int32, Maybe Int32, Maybe Int32, Maybe Int32)
 
-selectGalleyTeamFeatures :: PrepQuery R (Identity (TeamId)) RowGalleyTeamFeatures
+selectGalleyTeamFeatures :: PrepQuery R (Identity TeamId) RowGalleyTeamFeatures
 selectGalleyTeamFeatures = "SELECT team_id, app_lock_enforce, app_lock_inactivity_timeout_secs, app_lock_status, digital_signatures, legalhold_status, search_visibility_status, sso_status, validate_saml_emails FROM team_features WHERE team_id = ?"
 
 readGalleyTeamFeatures :: Env -> TeamId -> ConduitM () [RowGalleyTeamFeatures] IO ()
@@ -839,7 +839,7 @@ readGalleyTeamFeaturesAll Env {..} =
     paginateC selectGalleyTeamFeaturesAll (paramsP LocalQuorum () envPageSize) x5
 
 exportGalleyTeamFeaturesFull :: Env -> FilePath -> IO ()
-exportGalleyTeamFeaturesFull env@Env {..} path = do
+exportGalleyTeamFeaturesFull env path = do
   putStrLn $ "Exporting " <> "galley.team_features" <> " to " <> path
   withBinaryFile path WriteMode $ \handle ->
     runConduit $
@@ -856,7 +856,7 @@ importGalleyTeamFeatures Env {..} path = do
   if exists
     then do
       putStrLn $ "Importing " <> path <> " to " <> "galley.team_features"
-      withBinaryFile path ReadMode $ \handle -> do
+      withBinaryFile path ReadMode $ \handle ->
         runConduit $
           sourceJsonLines handle
             .| transPipe (runClient envGalley) (sinkTableRows insertGalleyTeamFeatures)
@@ -868,7 +868,7 @@ importGalleyTeamFeatures Env {..} path = do
 
 type RowGalleyTeamMember = (Maybe UUID, Maybe UUID, Maybe UTCTime, Maybe UUID, Maybe Int32, Maybe Permissions)
 
-selectGalleyTeamMember :: PrepQuery R (Identity (TeamId)) RowGalleyTeamMember
+selectGalleyTeamMember :: PrepQuery R (Identity TeamId) RowGalleyTeamMember
 selectGalleyTeamMember = "SELECT team, user, invited_at, invited_by, legalhold_status, perms FROM team_member WHERE team = ?"
 
 readGalleyTeamMember :: Env -> TeamId -> ConduitM () [RowGalleyTeamMember] IO ()
@@ -885,7 +885,7 @@ readGalleyTeamMemberAll Env {..} =
     paginateC selectGalleyTeamMemberAll (paramsP LocalQuorum () envPageSize) x5
 
 exportGalleyTeamMemberFull :: Env -> FilePath -> IO ()
-exportGalleyTeamMemberFull env@Env {..} path = do
+exportGalleyTeamMemberFull env path = do
   putStrLn $ "Exporting " <> "galley.team_member" <> " to " <> path
   withBinaryFile path WriteMode $ \handle ->
     runConduit $
@@ -902,7 +902,7 @@ importGalleyTeamMember Env {..} path = do
   if exists
     then do
       putStrLn $ "Importing " <> path <> " to " <> "galley.team_member"
-      withBinaryFile path ReadMode $ \handle -> do
+      withBinaryFile path ReadMode $ \handle ->
         runConduit $
           sourceJsonLines handle
             .| transPipe (runClient envGalley) (sinkTableRows insertGalleyTeamMember)
@@ -914,7 +914,7 @@ importGalleyTeamMember Env {..} path = do
 
 type RowGalleyTeamNotifications = (Maybe UUID, Maybe TimeUuid, Maybe Blob)
 
-selectGalleyTeamNotifications :: PrepQuery R (Identity (TeamId)) RowGalleyTeamNotifications
+selectGalleyTeamNotifications :: PrepQuery R (Identity TeamId) RowGalleyTeamNotifications
 selectGalleyTeamNotifications = "SELECT team, id, payload FROM team_notifications WHERE team = ?"
 
 readGalleyTeamNotifications :: Env -> TeamId -> ConduitM () [RowGalleyTeamNotifications] IO ()
@@ -931,7 +931,7 @@ readGalleyTeamNotificationsAll Env {..} =
     paginateC selectGalleyTeamNotificationsAll (paramsP LocalQuorum () envPageSize) x5
 
 exportGalleyTeamNotificationsFull :: Env -> FilePath -> IO ()
-exportGalleyTeamNotificationsFull env@Env {..} path = do
+exportGalleyTeamNotificationsFull env path = do
   putStrLn $ "Exporting " <> "galley.team_notifications" <> " to " <> path
   withBinaryFile path WriteMode $ \handle ->
     runConduit $
@@ -948,7 +948,7 @@ importGalleyTeamNotifications Env {..} path = do
   if exists
     then do
       putStrLn $ "Importing " <> path <> " to " <> "galley.team_notifications"
-      withBinaryFile path ReadMode $ \handle -> do
+      withBinaryFile path ReadMode $ \handle ->
         runConduit $
           sourceJsonLines handle
             .| transPipe (runClient envGalley) (sinkTableRows insertGalleyTeamNotifications)
@@ -960,7 +960,7 @@ importGalleyTeamNotifications Env {..} path = do
 
 type RowGalleyUser = (Maybe UUID, Maybe UUID, Maybe Text, Maybe UUID)
 
-selectGalleyUser :: PrepQuery R (Identity ([UserId])) RowGalleyUser
+selectGalleyUser :: PrepQuery R (Identity [UserId]) RowGalleyUser
 selectGalleyUser = "SELECT user, conv, conv_remote_domain, conv_remote_id FROM user WHERE user in ?"
 
 readGalleyUser :: Env -> [UserId] -> ConduitM () [RowGalleyUser] IO ()
@@ -977,7 +977,7 @@ readGalleyUserAll Env {..} =
     paginateC selectGalleyUserAll (paramsP LocalQuorum () envPageSize) x5
 
 exportGalleyUserFull :: Env -> FilePath -> IO ()
-exportGalleyUserFull env@Env {..} path = do
+exportGalleyUserFull env path = do
   putStrLn $ "Exporting " <> "galley.user" <> " to " <> path
   withBinaryFile path WriteMode $ \handle ->
     runConduit $
@@ -994,7 +994,7 @@ importGalleyUser Env {..} path = do
   if exists
     then do
       putStrLn $ "Importing " <> path <> " to " <> "galley.user"
-      withBinaryFile path ReadMode $ \handle -> do
+      withBinaryFile path ReadMode $ \handle ->
         runConduit $
           sourceJsonLines handle
             .| transPipe (runClient envGalley) (sinkTableRows insertGalleyUser)
@@ -1006,7 +1006,7 @@ importGalleyUser Env {..} path = do
 
 type RowGalleyUserTeam = (Maybe UUID, Maybe UUID)
 
-selectGalleyUserTeam :: PrepQuery R (Identity ([UserId])) RowGalleyUserTeam
+selectGalleyUserTeam :: PrepQuery R (Identity [UserId]) RowGalleyUserTeam
 selectGalleyUserTeam = "SELECT user, team FROM user_team WHERE user in ?"
 
 readGalleyUserTeam :: Env -> [UserId] -> ConduitM () [RowGalleyUserTeam] IO ()
@@ -1023,7 +1023,7 @@ readGalleyUserTeamAll Env {..} =
     paginateC selectGalleyUserTeamAll (paramsP LocalQuorum () envPageSize) x5
 
 exportGalleyUserTeamFull :: Env -> FilePath -> IO ()
-exportGalleyUserTeamFull env@Env {..} path = do
+exportGalleyUserTeamFull env path = do
   putStrLn $ "Exporting " <> "galley.user_team" <> " to " <> path
   withBinaryFile path WriteMode $ \handle ->
     runConduit $
@@ -1040,7 +1040,7 @@ importGalleyUserTeam Env {..} path = do
   if exists
     then do
       putStrLn $ "Importing " <> path <> " to " <> "galley.user_team"
-      withBinaryFile path ReadMode $ \handle -> do
+      withBinaryFile path ReadMode $ \handle ->
         runConduit $
           sourceJsonLines handle
             .| transPipe (runClient envGalley) (sinkTableRows insertGalleyUserTeam)
@@ -1052,7 +1052,7 @@ importGalleyUserTeam Env {..} path = do
 
 type RowGundeckNotifications = (Maybe UUID, Maybe TimeUuid, Maybe (Cassandra.Set Text), Maybe Blob)
 
-selectGundeckNotifications :: PrepQuery R (Identity ([UserId])) RowGundeckNotifications
+selectGundeckNotifications :: PrepQuery R (Identity [UserId]) RowGundeckNotifications
 selectGundeckNotifications = "SELECT user, id, clients, payload FROM notifications WHERE user in ?"
 
 readGundeckNotifications :: Env -> [UserId] -> ConduitM () [RowGundeckNotifications] IO ()
@@ -1069,7 +1069,7 @@ readGundeckNotificationsAll Env {..} =
     paginateC selectGundeckNotificationsAll (paramsP LocalQuorum () envPageSize) x5
 
 exportGundeckNotificationsFull :: Env -> FilePath -> IO ()
-exportGundeckNotificationsFull env@Env {..} path = do
+exportGundeckNotificationsFull env path = do
   putStrLn $ "Exporting " <> "gundeck.notifications" <> " to " <> path
   withBinaryFile path WriteMode $ \handle ->
     runConduit $
@@ -1086,7 +1086,7 @@ importGundeckNotifications Env {..} path = do
   if exists
     then do
       putStrLn $ "Importing " <> path <> " to " <> "gundeck.notifications"
-      withBinaryFile path ReadMode $ \handle -> do
+      withBinaryFile path ReadMode $ \handle ->
         runConduit $
           sourceJsonLines handle
             .| transPipe (runClient envGundeck) (sinkTableRows insertGundeckNotifications)
@@ -1098,7 +1098,7 @@ importGundeckNotifications Env {..} path = do
 
 type RowSparScimExternal = (Maybe UUID, Maybe Text, Maybe UUID)
 
-selectSparScimExternal :: PrepQuery R (Identity (TeamId)) RowSparScimExternal
+selectSparScimExternal :: PrepQuery R (Identity TeamId) RowSparScimExternal
 selectSparScimExternal = "SELECT team, external_id, user FROM scim_external WHERE team = ?"
 
 readSparScimExternal :: Env -> TeamId -> ConduitM () [RowSparScimExternal] IO ()
@@ -1115,7 +1115,7 @@ readSparScimExternalAll Env {..} =
     paginateC selectSparScimExternalAll (paramsP LocalQuorum () envPageSize) x5
 
 exportSparScimExternalFull :: Env -> FilePath -> IO ()
-exportSparScimExternalFull env@Env {..} path = do
+exportSparScimExternalFull env path = do
   putStrLn $ "Exporting " <> "spar.scim_external" <> " to " <> path
   withBinaryFile path WriteMode $ \handle ->
     runConduit $
@@ -1132,7 +1132,7 @@ importSparScimExternal Env {..} path = do
   if exists
     then do
       putStrLn $ "Importing " <> path <> " to " <> "spar.scim_external"
-      withBinaryFile path ReadMode $ \handle -> do
+      withBinaryFile path ReadMode $ \handle ->
         runConduit $
           sourceJsonLines handle
             .| transPipe (runClient envSpar) (sinkTableRows insertSparScimExternal)
@@ -1144,7 +1144,7 @@ importSparScimExternal Env {..} path = do
 
 type RowSparScimUserTimes = (Maybe UUID, Maybe UTCTime, Maybe UTCTime)
 
-selectSparScimUserTimes :: PrepQuery R (Identity ([UserId])) RowSparScimUserTimes
+selectSparScimUserTimes :: PrepQuery R (Identity [UserId]) RowSparScimUserTimes
 selectSparScimUserTimes = "SELECT uid, created_at, last_updated_at FROM scim_user_times WHERE uid in ?"
 
 readSparScimUserTimes :: Env -> [UserId] -> ConduitM () [RowSparScimUserTimes] IO ()
@@ -1161,7 +1161,7 @@ readSparScimUserTimesAll Env {..} =
     paginateC selectSparScimUserTimesAll (paramsP LocalQuorum () envPageSize) x5
 
 exportSparScimUserTimesFull :: Env -> FilePath -> IO ()
-exportSparScimUserTimesFull env@Env {..} path = do
+exportSparScimUserTimesFull env path = do
   putStrLn $ "Exporting " <> "spar.scim_user_times" <> " to " <> path
   withBinaryFile path WriteMode $ \handle ->
     runConduit $
@@ -1178,7 +1178,7 @@ importSparScimUserTimes Env {..} path = do
   if exists
     then do
       putStrLn $ "Importing " <> path <> " to " <> "spar.scim_user_times"
-      withBinaryFile path ReadMode $ \handle -> do
+      withBinaryFile path ReadMode $ \handle ->
         runConduit $
           sourceJsonLines handle
             .| transPipe (runClient envSpar) (sinkTableRows insertSparScimUserTimes)
@@ -1190,7 +1190,7 @@ importSparScimUserTimes Env {..} path = do
 
 type RowSparUser = (Maybe Text, Maybe Text, Maybe UUID)
 
-selectSparUser :: PrepQuery R (Identity ([Text])) RowSparUser
+selectSparUser :: PrepQuery R (Identity [Text]) RowSparUser
 selectSparUser = "SELECT issuer, sso_id, uid FROM user WHERE issuer in ?"
 
 readSparUser :: Env -> [Text] -> ConduitM () [RowSparUser] IO ()
@@ -1207,7 +1207,7 @@ readSparUserAll Env {..} =
     paginateC selectSparUserAll (paramsP LocalQuorum () envPageSize) x5
 
 exportSparUserFull :: Env -> FilePath -> IO ()
-exportSparUserFull env@Env {..} path = do
+exportSparUserFull env path = do
   putStrLn $ "Exporting " <> "spar.user" <> " to " <> path
   withBinaryFile path WriteMode $ \handle ->
     runConduit $
@@ -1224,7 +1224,7 @@ importSparUser Env {..} path = do
   if exists
     then do
       putStrLn $ "Importing " <> path <> " to " <> "spar.user"
-      withBinaryFile path ReadMode $ \handle -> do
+      withBinaryFile path ReadMode $ \handle ->
         runConduit $
           sourceJsonLines handle
             .| transPipe (runClient envSpar) (sinkTableRows insertSparUser)
diff --git a/tools/db/repair-handles/repair-handles.cabal b/tools/db/repair-handles/repair-handles.cabal
index a5b8fd26193..105feb83981 100644
--- a/tools/db/repair-handles/repair-handles.cabal
+++ b/tools/db/repair-handles/repair-handles.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: abd13346fea0b0196ba60cf22bfa4c3b8b06b83ef7cc88c1d32c276e695b8f3c
+-- hash: c8ad3a3ca71a54e03d9bb6572dad0629da8c5940cfe20febf7cf1971d549f042
 
 name:           repair-handles
 version:        1.0.0
@@ -26,7 +26,46 @@ executable repair-handles
   hs-source-dirs:
       repair-handles
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       base
diff --git a/tools/db/service-backfill/service-backfill.cabal b/tools/db/service-backfill/service-backfill.cabal
index 3bc5aa2cd0d..4a1ed2deb16 100644
--- a/tools/db/service-backfill/service-backfill.cabal
+++ b/tools/db/service-backfill/service-backfill.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 7e34405c46813f3294b0ecb9bf520e7b75d83db1c83cbcf779de12f46c7957b5
+-- hash: d72d11c1f8954ebb055cecdaed92fb6e31c1b534a8083b486f14bbcf5849e0ba
 
 name:           service-backfill
 version:        1.0.0
@@ -24,7 +24,46 @@ executable service-backfill
       Paths_service_backfill
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -funbox-strict-fields -threaded -with-rtsopts=-N -with-rtsopts=-T -rtsopts
   build-depends:
       base
diff --git a/tools/makedeb/makedeb.cabal b/tools/makedeb/makedeb.cabal
index 0adc3c7da9d..5f2263addb8 100644
--- a/tools/makedeb/makedeb.cabal
+++ b/tools/makedeb/makedeb.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 7fe255326cb9428aeec3221e074cd2eec369cad640361ae18e967e7f095fd0a8
+-- hash: 80100f7bcc806d6eef6f942564fb7afa966abe1df367224e68b29a904fbe3cf2
 
 name:           makedeb
 version:        0.3.0
@@ -27,7 +27,46 @@ library
       Paths_makedeb
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path
   build-depends:
       base >=4.6 && <5.0
@@ -43,7 +82,46 @@ executable makedeb
   main-is: src/Main.hs
   other-modules:
       Paths_makedeb
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded
   build-depends:
       base
diff --git a/tools/rex/Makefile b/tools/rex/Makefile
index ea9333710b0..1e2b30bf8c0 100644
--- a/tools/rex/Makefile
+++ b/tools/rex/Makefile
@@ -33,11 +33,3 @@ fast: init
 .PHONY:
 compile:
 	stack build . --pedantic --test --bench --no-run-benchmarks --no-copy-bins
-
-# build a statically linked binary by compiling on alpine. Will result in a 'rex-static' binary in dist.
-.PHONY: static
-static: $(SRC)
-	docker run --rm \
-		-v $(CURDIR)/../..:/wire-server \
-		quay.io/wire/alpine-builder:develop \
-		sh -c 'apk add --no-cache zlib-static && cd /wire-server/tools/rex && stack --system-ghc --local-bin-path . --allow-different-user install --flag rex:static . && mv rex dist/rex-static'
diff --git a/tools/stern/Makefile b/tools/stern/Makefile
index 8c3e13ba012..f44dd49a56d 100644
--- a/tools/stern/Makefile
+++ b/tools/stern/Makefile
@@ -58,7 +58,7 @@ $(DEB):
 docker:
 	$(foreach executable,$(EXECUTABLES),\
 	docker build -t $(DOCKER_USER)/$(executable):$(DOCKER_TAG) \
-	-f ../../build/alpine/Dockerfile.executable \
+	-f ../../build/ubuntu/Dockerfile.executable \
 	--build-arg executable=$(executable) \
 	../.. && \
 	docker tag $(DOCKER_USER)/$(executable):$(DOCKER_TAG) $(DOCKER_USER)/$(executable):latest && \
diff --git a/tools/stern/stern.cabal b/tools/stern/stern.cabal
index 2f0b829f765..ac2f1c8d88f 100644
--- a/tools/stern/stern.cabal
+++ b/tools/stern/stern.cabal
@@ -1,10 +1,10 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.33.0.
+-- This file has been generated from package.yaml by hpack version 0.34.4.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: c35978462e5fa7b7a1d42ade1d2c284bc4c709ce2a423d9d64ceb831b086a034
+-- hash: 0da74867ac45ba54dd475f434f41b57a45950a001354df87fe6286f1c2db55d9
 
 name:           stern
 version:        1.7.2
@@ -35,7 +35,46 @@ library
       Paths_stern
   hs-source-dirs:
       src
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -funbox-strict-fields
   build-depends:
       aeson >=0.11
@@ -80,7 +119,46 @@ executable stern
   main-is: src/Main.hs
   other-modules:
       Paths_stern
-  default-extensions: AllowAmbiguousTypes BangPatterns ConstraintKinds DataKinds DefaultSignatures DerivingStrategies DerivingVia DeriveFunctor DeriveGeneric DeriveLift DeriveTraversable EmptyCase FlexibleContexts FlexibleInstances FunctionalDependencies GADTs InstanceSigs KindSignatures LambdaCase MultiParamTypeClasses MultiWayIf NamedFieldPuns NoImplicitPrelude OverloadedStrings PackageImports PatternSynonyms PolyKinds QuasiQuotes RankNTypes ScopedTypeVariables StandaloneDeriving TemplateHaskell TupleSections TypeApplications TypeFamilies TypeFamilyDependencies TypeOperators UndecidableInstances ViewPatterns
+  default-extensions:
+      AllowAmbiguousTypes
+      BangPatterns
+      ConstraintKinds
+      DataKinds
+      DefaultSignatures
+      DerivingStrategies
+      DerivingVia
+      DeriveFunctor
+      DeriveGeneric
+      DeriveLift
+      DeriveTraversable
+      EmptyCase
+      FlexibleContexts
+      FlexibleInstances
+      FunctionalDependencies
+      GADTs
+      InstanceSigs
+      KindSignatures
+      LambdaCase
+      MultiParamTypeClasses
+      MultiWayIf
+      NamedFieldPuns
+      NoImplicitPrelude
+      OverloadedStrings
+      PackageImports
+      PatternSynonyms
+      PolyKinds
+      QuasiQuotes
+      RankNTypes
+      ScopedTypeVariables
+      StandaloneDeriving
+      TemplateHaskell
+      TupleSections
+      TypeApplications
+      TypeFamilies
+      TypeFamilyDependencies
+      TypeOperators
+      UndecidableInstances
+      ViewPatterns
   ghc-options: -O2 -Wall -Wincomplete-uni-patterns -Wincomplete-record-updates -Wpartial-fields -fwarn-tabs -optP-Wno-nonportable-include-path -threaded -rtsopts -with-rtsopts=-T
   build-depends:
       base

From b02e8a69071c6f7872f742fa3ec338188b831eae Mon Sep 17 00:00:00 2001
From: Akshay Mankar <akshay@wire.com>
Date: Mon, 17 Jan 2022 13:27:25 +0100
Subject: [PATCH 71/74] nix/cryptobox: Fix cargoSha256 (#2050)

---
 nix/overlays/wire-server.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nix/overlays/wire-server.nix b/nix/overlays/wire-server.nix
index dd5a6b81880..9ba8ca872fb 100644
--- a/nix/overlays/wire-server.nix
+++ b/nix/overlays/wire-server.nix
@@ -13,7 +13,7 @@ self: super: {
           rev = "4067ad96b125942545dbdec8c1a89f1e1b65d013";
           sha256 = "1i9dlhw0xk1viglyhail9fb36v1awrypps8jmhrkz8k1bhx98ci3";
         };
-        cargoSha256 = "0zs8ibv7rinrrzp9naxd7yak7kn1gp3pjb3g8i4wf7xw2hkkq81z";
+        cargoSha256 = "sha256-Afr3ShCXDCwTQNdeCZbA5/aosRt+KFpGfT1mrob6cog=";
 
         patchLibs = super.lib.optionalString super.stdenv.isDarwin ''
             install_name_tool -id $out/lib/libcryptobox.dylib $out/lib/libcryptobox.dylib

From 096c48c1f9b6b01572c737bd296dddd7cb5ddabb Mon Sep 17 00:00:00 2001
From: Stefan Matting <smatting@users.noreply.github.com>
Date: Mon, 17 Jan 2022 14:10:35 +0100
Subject: [PATCH 72/74] Add release notes for #2030 (#2049)

---
 changelog.d/0-release-notes/update-sft-urls | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 changelog.d/0-release-notes/update-sft-urls

diff --git a/changelog.d/0-release-notes/update-sft-urls b/changelog.d/0-release-notes/update-sft-urls
new file mode 100644
index 00000000000..baafc1bae80
--- /dev/null
+++ b/changelog.d/0-release-notes/update-sft-urls
@@ -0,0 +1 @@
+Wire cloud operators: Make sure [#35](https://github.com/wireapp/ansible-sft/pull/35) is applied to all SFT servers before deploying. (#2030)

From 653adbb7c6e202e353aa3efe5fdaff0f711c2d97 Mon Sep 17 00:00:00 2001
From: Akshay Mankar <akshay@wire.com>
Date: Tue, 18 Jan 2022 09:38:31 +0100
Subject: [PATCH 73/74] Changelog: Add entry for [2020-01-18]

---
 CHANGELOG.md                                  | 78 +++++++++++++++++++
 changelog.d/0-release-notes/cargohold-domain  |  1 -
 changelog.d/0-release-notes/pr-2028           |  1 -
 changelog.d/0-release-notes/ubuntu-images     |  3 -
 changelog.d/0-release-notes/update-sft-urls   |  1 -
 changelog.d/1-api-changes/pr-2027             |  1 -
 changelog.d/1-api-changes/qualified-assets    |  1 -
 changelog.d/1-api-changes/remote-assets       |  4 -
 .../1-api-changes/remove-resumable-uploads    |  1 -
 .../2-features/helm-brig-setDefaultLocale     |  1 -
 changelog.d/2-features/pr-1976                |  1 -
 changelog.d/2-features/pr-1980                |  1 -
 changelog.d/2-features/pr-2028                |  1 -
 .../3-bug-fixes/fix-cargohold-streaming       |  1 -
 changelog.d/4-docs/pr-1869                    |  1 -
 changelog.d/4-docs/sqservices-1127            |  1 -
 changelog.d/4-docs/stern-docs                 |  1 -
 changelog.d/5-internal/avoid-servant-generics |  1 -
 changelog.d/5-internal/brig-faster-doc        |  1 -
 .../cabal-integration-test-improvement        |  1 -
 changelog.d/5-internal/cabal-make-c-test-all  |  1 -
 changelog.d/5-internal/fix-cabal-install      |  1 -
 changelog.d/5-internal/fix-cargohold-flake    |  1 -
 changelog.d/5-internal/fix-integration-yaml   |  1 -
 changelog.d/5-internal/ghc-8107               |  1 -
 changelog.d/5-internal/hlint-federator        |  1 -
 changelog.d/5-internal/in-mem-specs           |  1 -
 .../5-internal/integration-spar-polysemy      |  1 -
 changelog.d/5-internal/map-federation-tests   |  1 -
 changelog.d/5-internal/nixpkgs                |  1 -
 changelog.d/5-internal/pr-2008                |  1 -
 changelog.d/5-internal/pr-2023                |  1 -
 changelog.d/5-internal/restund-chart          |  1 -
 changelog.d/5-internal/restund-chart-followup |  1 -
 .../5-internal/schema-profunctor-optional     |  1 -
 .../5-internal/servantify-cannon-public-api   |  1 -
 changelog.d/5-internal/sftd-multi-sft         |  1 -
 changelog.d/5-internal/sftd-multi-sft-fixup   |  1 -
 changelog.d/5-internal/simplify-ranged-schema |  1 -
 .../5-internal/split-cannon-benchmarks        |  1 -
 changelog.d/5-internal/sqservices-1118        |  1 -
 changelog.d/5-internal/sqservices-1118-2      |  1 -
 changelog.d/5-internal/sqservices-1169        |  1 -
 changelog.d/6-federation/federator-streaming  |  1 -
 changelog.d/6-federation/named-fed-api-routes |  1 -
 .../6-federation/sft-brig-configmap-fix       |  1 -
 changelog.d/6-federation/sft-fix-ipv4-http    |  1 -
 .../6-federation/sft-replace-ipv4-w-disco     |  1 -
 changelog.d/6-federation/sft-servers-all      |  1 -
 .../6-federation/sft-servers-all-fixup        |  1 -
 changelog.d/6-federation/sftd_disco           |  1 -
 51 files changed, 78 insertions(+), 55 deletions(-)
 delete mode 100644 changelog.d/0-release-notes/cargohold-domain
 delete mode 100644 changelog.d/0-release-notes/pr-2028
 delete mode 100644 changelog.d/0-release-notes/ubuntu-images
 delete mode 100644 changelog.d/0-release-notes/update-sft-urls
 delete mode 100644 changelog.d/1-api-changes/pr-2027
 delete mode 100644 changelog.d/1-api-changes/qualified-assets
 delete mode 100644 changelog.d/1-api-changes/remote-assets
 delete mode 100644 changelog.d/1-api-changes/remove-resumable-uploads
 delete mode 100644 changelog.d/2-features/helm-brig-setDefaultLocale
 delete mode 100644 changelog.d/2-features/pr-1976
 delete mode 100644 changelog.d/2-features/pr-1980
 delete mode 100644 changelog.d/2-features/pr-2028
 delete mode 100644 changelog.d/3-bug-fixes/fix-cargohold-streaming
 delete mode 100644 changelog.d/4-docs/pr-1869
 delete mode 100644 changelog.d/4-docs/sqservices-1127
 delete mode 100644 changelog.d/4-docs/stern-docs
 delete mode 100644 changelog.d/5-internal/avoid-servant-generics
 delete mode 100644 changelog.d/5-internal/brig-faster-doc
 delete mode 100644 changelog.d/5-internal/cabal-integration-test-improvement
 delete mode 100644 changelog.d/5-internal/cabal-make-c-test-all
 delete mode 100644 changelog.d/5-internal/fix-cabal-install
 delete mode 100644 changelog.d/5-internal/fix-cargohold-flake
 delete mode 100644 changelog.d/5-internal/fix-integration-yaml
 delete mode 100644 changelog.d/5-internal/ghc-8107
 delete mode 100644 changelog.d/5-internal/hlint-federator
 delete mode 100644 changelog.d/5-internal/in-mem-specs
 delete mode 100644 changelog.d/5-internal/integration-spar-polysemy
 delete mode 100644 changelog.d/5-internal/map-federation-tests
 delete mode 100644 changelog.d/5-internal/nixpkgs
 delete mode 100644 changelog.d/5-internal/pr-2008
 delete mode 100644 changelog.d/5-internal/pr-2023
 delete mode 100644 changelog.d/5-internal/restund-chart
 delete mode 100644 changelog.d/5-internal/restund-chart-followup
 delete mode 100644 changelog.d/5-internal/schema-profunctor-optional
 delete mode 100644 changelog.d/5-internal/servantify-cannon-public-api
 delete mode 100644 changelog.d/5-internal/sftd-multi-sft
 delete mode 100644 changelog.d/5-internal/sftd-multi-sft-fixup
 delete mode 100644 changelog.d/5-internal/simplify-ranged-schema
 delete mode 100644 changelog.d/5-internal/split-cannon-benchmarks
 delete mode 100644 changelog.d/5-internal/sqservices-1118
 delete mode 100644 changelog.d/5-internal/sqservices-1118-2
 delete mode 100644 changelog.d/5-internal/sqservices-1169
 delete mode 100644 changelog.d/6-federation/federator-streaming
 delete mode 100644 changelog.d/6-federation/named-fed-api-routes
 delete mode 100644 changelog.d/6-federation/sft-brig-configmap-fix
 delete mode 100644 changelog.d/6-federation/sft-fix-ipv4-http
 delete mode 100644 changelog.d/6-federation/sft-replace-ipv4-w-disco
 delete mode 100644 changelog.d/6-federation/sft-servers-all
 delete mode 100644 changelog.d/6-federation/sft-servers-all-fixup
 delete mode 100644 changelog.d/6-federation/sftd_disco

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 67998fb7958..a29b97fdf47 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,83 @@
 <!-- if you're not the release manager, do your edits to changelog under CHANGELOG.d/ -->
 
+# [2022-01-18]
+
+## Release notes
+
+* This release introduces a mandatory `federationDomain` configuration setting to cargohold. Please update your `values/wire-server/values.yaml` to set `cargohold.settings.federationDomain` to the same value as the corresponding option in galley (and brig). (#1990)
+* The brig server config option `setDefaultLocale` has been replaced by `setDefaultUserLocale` and `setDefaultTemplateLocale` (see docs/reference/config-options.md for details) (#2028)
+* From this release onwards, the images for haskell components (brig, galley,
+  cargohold, etc.) will be using Ubuntu 20.04 as the base. The images are about
+  30-35 MB larger than the previous alpine based images. (#1852)
+* Wire cloud operators: Make sure [#35](https://github.com/wireapp/ansible-sft/pull/35) is applied to all SFT servers before deploying. (#2030)
+
+## API changes
+
+* The deprecated endpoint `GET /teams` now ignores query parameters `ids`, `start` (#2027)
+* Add qualified v4 endpoints for downloading and deleting assets. The upload API is still on the same path, but the asset object it returns now contains a `domain` field. Note that federated behaviour is still not implemented. (#2002)
+* Enable downloading assets from a remote (federated) cargohold instance via the v4 API.
+  The content of remote assets is returned as stream with content type
+  `application/octet-stream`.
+  Please refer to the Swagger API documentation for more details. (#2004)
+* Remove resumable upload API (#1998)
+
+## Features
+
+* Allow configuring setDefaultLocale in brig using helm chart (#2025)
+* If the guest links team feature is disabled guest links will be revoked. (#1976)
+* Revoke guest links if feature is disabled. If the guest links team feature is disabled `get /conversations/join`, `post /conversations/:cnv/code`, and `get /conversations/:cnv/code` will return an error. (#1980)
+* Specialize `setDefaultLocale` to distinguish between default user locale and default template locale if the user's locale is n/a. (#2028)
+
+## Bug fixes and other updates
+
+* Fix an issue with remote asset streaming (#2037, #2038)
+
+## Documentation
+
+* Annotate a first batch of integration and unit tests to map them to externally-facing documentation (#1869)
+* Add the description to several test cases (#1991)
+* Improve documentation for stern tool and helm chart (#2032)
+
+## Internal changes
+
+* Replace servant-generic in Galley with a custom `Named` combinator (#2022)
+* The Swagger documentation module is not regenerated anymore if its content is unchanged (#2018)
+* cabal-run-integration.sh - remove Makefile indirection (#2044)
+* Fix test runner for global cabal make target (#1987)
+* The `cabal-install-artefacts.sh` script now creates the `dist` directory if it does not exist (#2007)
+* Set `purge: false` in fake-s3 chart (#1981)
+* Add missing backendTwo.carghold in integration.yaml (#2039)
+* Use GHC 8.10.7 and stack 2.7.3 for builds (#1852)
+* Fix non-controversial HLint issues in federator to improve code quality (#2011)
+* Added laws for DefaultSsoCode, Now, IdP and ScimExternalIdStore (#1940)
+* Moved specifications for Spar effects out of the test suite and into the library (#2005)
+* Tag integration tests for security audit. (#2000)
+* Upgrade nixpkgs pin used to provision developement dependencies (#1852)
+* Servantify Galley Teams API. (#2008, #2010, #2027)
+* When sending an activation code, the blocked domains are checked before the whitelist. This only affects the wire SaaS staging environment (there is no whitelist configuration in prod, and blocked domains are not applicable to on-prem installations). (#2023)
+* Add a helm chart that deploys [restund](https://docs.wire.com/understand/restund.html) (#2003)
+* Publish restund helm chart (#2036)
+* Improve optional field API in schema-profunctor (#1988)
+* Migrate the public API of Cannon to Servant. (There is an internal API that is not yet migrated.) (#2024)
+* sftd chart: Add multiSFT option, remove additionalArgs option (#1992)
+* sftd chart: Fix quoted args for multiSFT option (#1999)
+* `rangedSchema` does not need to be passed singletons explicitly anymore (#2017)
+* Split cannon benchmarks and tests (#1986)
+* Tag integration tests for certification. (#1985)
+* Tag integration tests for certification. (#2001)
+* New internal endpoint to configure the guest links team feature. (#1993)
+
+## Federation changes
+
+* Make federator capable of streaming responses (#1966)
+* Use `Named` routes for the federation API (#2033)
+* Fix Brig's configmap for SFT lookups (#2015)
+* SFTD chart: provide a /sft_servers_all.json url that can be used by brig to populate /calls/config/v2 (#2019)
+* Allow making HTTP-only requests to SFTs via an IPv4 address (#2026)
+* Replace IPv4-HTTP-only Approach to SFT Server Lookup with /sft_servers_all.json (#2030)
+* Extend GET /calls/config/v2 to include all SFT servers in federation (#2012)
+* Improve Brig's configuration for SFTs and fix a call to SFT servers (#2014)
+
 # [2021-12-10]
 
 ## Release notes
diff --git a/changelog.d/0-release-notes/cargohold-domain b/changelog.d/0-release-notes/cargohold-domain
deleted file mode 100644
index 33e8403cf87..00000000000
--- a/changelog.d/0-release-notes/cargohold-domain
+++ /dev/null
@@ -1 +0,0 @@
-This release introduces a mandatory `federationDomain` configuration setting to cargohold. Please update your `values/wire-server/values.yaml` to set `cargohold.settings.federationDomain` to the same value as the corresponding option in galley (and brig).
diff --git a/changelog.d/0-release-notes/pr-2028 b/changelog.d/0-release-notes/pr-2028
deleted file mode 100644
index cc4cf7d5a47..00000000000
--- a/changelog.d/0-release-notes/pr-2028
+++ /dev/null
@@ -1 +0,0 @@
-The brig server config option `setDefaultLocale` has been replaced by `setDefaultUserLocale` and `setDefaultTemplateLocale` (see docs/reference/config-options.md for details)
diff --git a/changelog.d/0-release-notes/ubuntu-images b/changelog.d/0-release-notes/ubuntu-images
deleted file mode 100644
index 16c9c4dd5ba..00000000000
--- a/changelog.d/0-release-notes/ubuntu-images
+++ /dev/null
@@ -1,3 +0,0 @@
-From this release onwards, the images for haskell components (brig, galley,
-cargohold, etc.) will be using Ubuntu 20.04 as the base. The images are about
-30-35 MB larger than the previous alpine based images.
\ No newline at end of file
diff --git a/changelog.d/0-release-notes/update-sft-urls b/changelog.d/0-release-notes/update-sft-urls
deleted file mode 100644
index baafc1bae80..00000000000
--- a/changelog.d/0-release-notes/update-sft-urls
+++ /dev/null
@@ -1 +0,0 @@
-Wire cloud operators: Make sure [#35](https://github.com/wireapp/ansible-sft/pull/35) is applied to all SFT servers before deploying. (#2030)
diff --git a/changelog.d/1-api-changes/pr-2027 b/changelog.d/1-api-changes/pr-2027
deleted file mode 100644
index 4c7f70a85f5..00000000000
--- a/changelog.d/1-api-changes/pr-2027
+++ /dev/null
@@ -1 +0,0 @@
-The deprecated endpoint `GET /teams` now ignores query parameters `ids`, `start`
diff --git a/changelog.d/1-api-changes/qualified-assets b/changelog.d/1-api-changes/qualified-assets
deleted file mode 100644
index 62e988dde3e..00000000000
--- a/changelog.d/1-api-changes/qualified-assets
+++ /dev/null
@@ -1 +0,0 @@
-Add qualified v4 endpoints for downloading and deleting assets. The upload API is still on the same path, but the asset object it returns now contains a `domain` field. Note that federated behaviour is still not implemented.
diff --git a/changelog.d/1-api-changes/remote-assets b/changelog.d/1-api-changes/remote-assets
deleted file mode 100644
index a80a382c27a..00000000000
--- a/changelog.d/1-api-changes/remote-assets
+++ /dev/null
@@ -1,4 +0,0 @@
-Enable downloading assets from a remote (federated) cargohold instance via the v4 API. 
-The content of remote assets is returned as stream with content type
-`application/octet-stream`.
-Please refer to the Swagger API documentation for more details.
diff --git a/changelog.d/1-api-changes/remove-resumable-uploads b/changelog.d/1-api-changes/remove-resumable-uploads
deleted file mode 100644
index a73bc51b5bc..00000000000
--- a/changelog.d/1-api-changes/remove-resumable-uploads
+++ /dev/null
@@ -1 +0,0 @@
-Remove resumable upload API
diff --git a/changelog.d/2-features/helm-brig-setDefaultLocale b/changelog.d/2-features/helm-brig-setDefaultLocale
deleted file mode 100644
index 7fcdf370267..00000000000
--- a/changelog.d/2-features/helm-brig-setDefaultLocale
+++ /dev/null
@@ -1 +0,0 @@
-Allow configuring setDefaultLocale in brig using helm chart
\ No newline at end of file
diff --git a/changelog.d/2-features/pr-1976 b/changelog.d/2-features/pr-1976
deleted file mode 100644
index e67dd816a08..00000000000
--- a/changelog.d/2-features/pr-1976
+++ /dev/null
@@ -1 +0,0 @@
-If the guest links team feature is disabled guest links will be revoked.
diff --git a/changelog.d/2-features/pr-1980 b/changelog.d/2-features/pr-1980
deleted file mode 100644
index 1eafba32ca6..00000000000
--- a/changelog.d/2-features/pr-1980
+++ /dev/null
@@ -1 +0,0 @@
-Revoke guest links if feature is disabled. If the guest links team feature is disabled `get /conversations/join`, `post /conversations/:cnv/code`, and `get /conversations/:cnv/code` will return an error.
diff --git a/changelog.d/2-features/pr-2028 b/changelog.d/2-features/pr-2028
deleted file mode 100644
index 03d788286ee..00000000000
--- a/changelog.d/2-features/pr-2028
+++ /dev/null
@@ -1 +0,0 @@
-Specialize `setDefaultLocale` to distinguish between default user locale and default template locale if the user's locale is n/a.
diff --git a/changelog.d/3-bug-fixes/fix-cargohold-streaming b/changelog.d/3-bug-fixes/fix-cargohold-streaming
deleted file mode 100644
index 38d8b2fe84d..00000000000
--- a/changelog.d/3-bug-fixes/fix-cargohold-streaming
+++ /dev/null
@@ -1 +0,0 @@
-Fix an issue with remote asset streaming (#2037, #2038)
diff --git a/changelog.d/4-docs/pr-1869 b/changelog.d/4-docs/pr-1869
deleted file mode 100644
index 5b3e780a9e3..00000000000
--- a/changelog.d/4-docs/pr-1869
+++ /dev/null
@@ -1 +0,0 @@
-Annotate a first batch of integration and unit tests to map them to externally-facing documentation
diff --git a/changelog.d/4-docs/sqservices-1127 b/changelog.d/4-docs/sqservices-1127
deleted file mode 100644
index bb5629509ae..00000000000
--- a/changelog.d/4-docs/sqservices-1127
+++ /dev/null
@@ -1 +0,0 @@
-Add the description to several test cases
diff --git a/changelog.d/4-docs/stern-docs b/changelog.d/4-docs/stern-docs
deleted file mode 100644
index 6b94b16d142..00000000000
--- a/changelog.d/4-docs/stern-docs
+++ /dev/null
@@ -1 +0,0 @@
-Improve documentation for stern tool and helm chart
\ No newline at end of file
diff --git a/changelog.d/5-internal/avoid-servant-generics b/changelog.d/5-internal/avoid-servant-generics
deleted file mode 100644
index 0ab6f411a3c..00000000000
--- a/changelog.d/5-internal/avoid-servant-generics
+++ /dev/null
@@ -1 +0,0 @@
-Replace servant-generic in Galley with a custom `Named` combinator
diff --git a/changelog.d/5-internal/brig-faster-doc b/changelog.d/5-internal/brig-faster-doc
deleted file mode 100644
index edd39960037..00000000000
--- a/changelog.d/5-internal/brig-faster-doc
+++ /dev/null
@@ -1 +0,0 @@
-The Swagger documentation module is not regenerated anymore if its content is unchanged
diff --git a/changelog.d/5-internal/cabal-integration-test-improvement b/changelog.d/5-internal/cabal-integration-test-improvement
deleted file mode 100644
index e46afe7e4a2..00000000000
--- a/changelog.d/5-internal/cabal-integration-test-improvement
+++ /dev/null
@@ -1 +0,0 @@
-cabal-run-integration.sh - remove Makefile indirection
diff --git a/changelog.d/5-internal/cabal-make-c-test-all b/changelog.d/5-internal/cabal-make-c-test-all
deleted file mode 100644
index 305c0c8d6ce..00000000000
--- a/changelog.d/5-internal/cabal-make-c-test-all
+++ /dev/null
@@ -1 +0,0 @@
-Fix test runner for global cabal make target
diff --git a/changelog.d/5-internal/fix-cabal-install b/changelog.d/5-internal/fix-cabal-install
deleted file mode 100644
index f09f1ea0b38..00000000000
--- a/changelog.d/5-internal/fix-cabal-install
+++ /dev/null
@@ -1 +0,0 @@
-The `cabal-install-artefacts.sh` script now creates the `dist` directory if it does not exist
diff --git a/changelog.d/5-internal/fix-cargohold-flake b/changelog.d/5-internal/fix-cargohold-flake
deleted file mode 100644
index 3281ab93589..00000000000
--- a/changelog.d/5-internal/fix-cargohold-flake
+++ /dev/null
@@ -1 +0,0 @@
-Set `purge: false` in fake-s3 chart
diff --git a/changelog.d/5-internal/fix-integration-yaml b/changelog.d/5-internal/fix-integration-yaml
deleted file mode 100644
index 789f497c98f..00000000000
--- a/changelog.d/5-internal/fix-integration-yaml
+++ /dev/null
@@ -1 +0,0 @@
-Add missing backendTwo.carghold in integration.yaml
diff --git a/changelog.d/5-internal/ghc-8107 b/changelog.d/5-internal/ghc-8107
deleted file mode 100644
index b1581527d97..00000000000
--- a/changelog.d/5-internal/ghc-8107
+++ /dev/null
@@ -1 +0,0 @@
-Use GHC 8.10.7 and stack 2.7.3 for builds
\ No newline at end of file
diff --git a/changelog.d/5-internal/hlint-federator b/changelog.d/5-internal/hlint-federator
deleted file mode 100644
index 96c1fac4dc7..00000000000
--- a/changelog.d/5-internal/hlint-federator
+++ /dev/null
@@ -1 +0,0 @@
-Fix non-controversial HLint issues in federator to improve code quality
diff --git a/changelog.d/5-internal/in-mem-specs b/changelog.d/5-internal/in-mem-specs
deleted file mode 100644
index 57fd8d6b57a..00000000000
--- a/changelog.d/5-internal/in-mem-specs
+++ /dev/null
@@ -1 +0,0 @@
-Added laws for DefaultSsoCode, Now, IdP and ScimExternalIdStore
diff --git a/changelog.d/5-internal/integration-spar-polysemy b/changelog.d/5-internal/integration-spar-polysemy
deleted file mode 100644
index f12d69de1cf..00000000000
--- a/changelog.d/5-internal/integration-spar-polysemy
+++ /dev/null
@@ -1 +0,0 @@
-Moved specifications for Spar effects out of the test suite and into the library
diff --git a/changelog.d/5-internal/map-federation-tests b/changelog.d/5-internal/map-federation-tests
deleted file mode 100644
index b53c1449dde..00000000000
--- a/changelog.d/5-internal/map-federation-tests
+++ /dev/null
@@ -1 +0,0 @@
-Tag integration tests for security audit.
\ No newline at end of file
diff --git a/changelog.d/5-internal/nixpkgs b/changelog.d/5-internal/nixpkgs
deleted file mode 100644
index 750845b483e..00000000000
--- a/changelog.d/5-internal/nixpkgs
+++ /dev/null
@@ -1 +0,0 @@
-Upgrade nixpkgs pin used to provision developement dependencies
\ No newline at end of file
diff --git a/changelog.d/5-internal/pr-2008 b/changelog.d/5-internal/pr-2008
deleted file mode 100644
index 49afa225615..00000000000
--- a/changelog.d/5-internal/pr-2008
+++ /dev/null
@@ -1 +0,0 @@
-Servantify Galley Teams API. (#2008, #2010, #2027)
diff --git a/changelog.d/5-internal/pr-2023 b/changelog.d/5-internal/pr-2023
deleted file mode 100644
index 826977a5870..00000000000
--- a/changelog.d/5-internal/pr-2023
+++ /dev/null
@@ -1 +0,0 @@
-When sending an activation code, the blocked domains are checked before the whitelist. This only affects the wire SaaS staging environment (there is no whitelist configuration in prod, and blocked domains are not applicable to on-prem installations).
diff --git a/changelog.d/5-internal/restund-chart b/changelog.d/5-internal/restund-chart
deleted file mode 100644
index b0addd486b1..00000000000
--- a/changelog.d/5-internal/restund-chart
+++ /dev/null
@@ -1 +0,0 @@
-Add a helm chart that deploys [restund](https://docs.wire.com/understand/restund.html)
diff --git a/changelog.d/5-internal/restund-chart-followup b/changelog.d/5-internal/restund-chart-followup
deleted file mode 100644
index d702a17ab53..00000000000
--- a/changelog.d/5-internal/restund-chart-followup
+++ /dev/null
@@ -1 +0,0 @@
-Publish restund helm chart
diff --git a/changelog.d/5-internal/schema-profunctor-optional b/changelog.d/5-internal/schema-profunctor-optional
deleted file mode 100644
index 4e66ad936cc..00000000000
--- a/changelog.d/5-internal/schema-profunctor-optional
+++ /dev/null
@@ -1 +0,0 @@
-Improve optional field API in schema-profunctor
diff --git a/changelog.d/5-internal/servantify-cannon-public-api b/changelog.d/5-internal/servantify-cannon-public-api
deleted file mode 100644
index 1a60973e2b6..00000000000
--- a/changelog.d/5-internal/servantify-cannon-public-api
+++ /dev/null
@@ -1 +0,0 @@
-Migrate the public API of Cannon to Servant. (There is an internal API that is not yet migrated.)
diff --git a/changelog.d/5-internal/sftd-multi-sft b/changelog.d/5-internal/sftd-multi-sft
deleted file mode 100644
index a0324fe7496..00000000000
--- a/changelog.d/5-internal/sftd-multi-sft
+++ /dev/null
@@ -1 +0,0 @@
-sftd chart: Add multiSFT option, remove additionalArgs option
diff --git a/changelog.d/5-internal/sftd-multi-sft-fixup b/changelog.d/5-internal/sftd-multi-sft-fixup
deleted file mode 100644
index 78b95439e69..00000000000
--- a/changelog.d/5-internal/sftd-multi-sft-fixup
+++ /dev/null
@@ -1 +0,0 @@
-sftd chart: Fix quoted args for multiSFT option
diff --git a/changelog.d/5-internal/simplify-ranged-schema b/changelog.d/5-internal/simplify-ranged-schema
deleted file mode 100644
index c6a3e875811..00000000000
--- a/changelog.d/5-internal/simplify-ranged-schema
+++ /dev/null
@@ -1 +0,0 @@
-`rangedSchema` does not need to be passed singletons explicitly anymore
diff --git a/changelog.d/5-internal/split-cannon-benchmarks b/changelog.d/5-internal/split-cannon-benchmarks
deleted file mode 100644
index 2122a84d6b9..00000000000
--- a/changelog.d/5-internal/split-cannon-benchmarks
+++ /dev/null
@@ -1 +0,0 @@
-Split cannon benchmarks and tests
diff --git a/changelog.d/5-internal/sqservices-1118 b/changelog.d/5-internal/sqservices-1118
deleted file mode 100644
index 0d240283035..00000000000
--- a/changelog.d/5-internal/sqservices-1118
+++ /dev/null
@@ -1 +0,0 @@
-Tag integration tests for certification.
diff --git a/changelog.d/5-internal/sqservices-1118-2 b/changelog.d/5-internal/sqservices-1118-2
deleted file mode 100644
index 0d240283035..00000000000
--- a/changelog.d/5-internal/sqservices-1118-2
+++ /dev/null
@@ -1 +0,0 @@
-Tag integration tests for certification.
diff --git a/changelog.d/5-internal/sqservices-1169 b/changelog.d/5-internal/sqservices-1169
deleted file mode 100644
index cc2869e0494..00000000000
--- a/changelog.d/5-internal/sqservices-1169
+++ /dev/null
@@ -1 +0,0 @@
-New internal endpoint to configure the guest links team feature.
diff --git a/changelog.d/6-federation/federator-streaming b/changelog.d/6-federation/federator-streaming
deleted file mode 100644
index 7901572b90b..00000000000
--- a/changelog.d/6-federation/federator-streaming
+++ /dev/null
@@ -1 +0,0 @@
-Make federator capable of streaming responses
diff --git a/changelog.d/6-federation/named-fed-api-routes b/changelog.d/6-federation/named-fed-api-routes
deleted file mode 100644
index c41471a3636..00000000000
--- a/changelog.d/6-federation/named-fed-api-routes
+++ /dev/null
@@ -1 +0,0 @@
-Use `Named` routes for the federation API
diff --git a/changelog.d/6-federation/sft-brig-configmap-fix b/changelog.d/6-federation/sft-brig-configmap-fix
deleted file mode 100644
index d271b241cf3..00000000000
--- a/changelog.d/6-federation/sft-brig-configmap-fix
+++ /dev/null
@@ -1 +0,0 @@
-Fix Brig's configmap for SFT lookups
diff --git a/changelog.d/6-federation/sft-fix-ipv4-http b/changelog.d/6-federation/sft-fix-ipv4-http
deleted file mode 100644
index bc0be239d8f..00000000000
--- a/changelog.d/6-federation/sft-fix-ipv4-http
+++ /dev/null
@@ -1 +0,0 @@
-Allow making HTTP-only requests to SFTs via an IPv4 address
diff --git a/changelog.d/6-federation/sft-replace-ipv4-w-disco b/changelog.d/6-federation/sft-replace-ipv4-w-disco
deleted file mode 100644
index 569d5284c7c..00000000000
--- a/changelog.d/6-federation/sft-replace-ipv4-w-disco
+++ /dev/null
@@ -1 +0,0 @@
-Replace IPv4-HTTP-only Approach to SFT Server Lookup with /sft_servers_all.json
diff --git a/changelog.d/6-federation/sft-servers-all b/changelog.d/6-federation/sft-servers-all
deleted file mode 100644
index ec9339bdca7..00000000000
--- a/changelog.d/6-federation/sft-servers-all
+++ /dev/null
@@ -1 +0,0 @@
-Extend GET /calls/config/v2 to include all SFT servers in federation
diff --git a/changelog.d/6-federation/sft-servers-all-fixup b/changelog.d/6-federation/sft-servers-all-fixup
deleted file mode 100644
index 25c1a8fb06d..00000000000
--- a/changelog.d/6-federation/sft-servers-all-fixup
+++ /dev/null
@@ -1 +0,0 @@
-Improve Brig's configuration for SFTs and fix a call to SFT servers
diff --git a/changelog.d/6-federation/sftd_disco b/changelog.d/6-federation/sftd_disco
deleted file mode 100644
index f7754d070a9..00000000000
--- a/changelog.d/6-federation/sftd_disco
+++ /dev/null
@@ -1 +0,0 @@
-SFTD chart: provide a /sft_servers_all.json url that can be used by brig to populate /calls/config/v2

From 2fd80aaeca592fa0bd688c393dea6cf72e890ab3 Mon Sep 17 00:00:00 2001
From: Paolo Capriotti <paolo@capriotti.io>
Date: Wed, 19 Jan 2022 09:20:16 +0100
Subject: [PATCH 74/74] Update CHANGELOG

---
 CHANGELOG.md | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a29b97fdf47..e6b66eb36bf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,11 +14,7 @@
 ## API changes
 
 * The deprecated endpoint `GET /teams` now ignores query parameters `ids`, `start` (#2027)
-* Add qualified v4 endpoints for downloading and deleting assets. The upload API is still on the same path, but the asset object it returns now contains a `domain` field. Note that federated behaviour is still not implemented. (#2002)
-* Enable downloading assets from a remote (federated) cargohold instance via the v4 API.
-  The content of remote assets is returned as stream with content type
-  `application/octet-stream`.
-  Please refer to the Swagger API documentation for more details. (#2004)
+* Add qualified v4 endpoints for downloading and deleting assets. The upload API is still on the same path, but the asset object it returns now contains a `domain` field. (#2002)
 * Remove resumable upload API (#1998)
 
 ## Features
@@ -77,6 +73,7 @@
 * Replace IPv4-HTTP-only Approach to SFT Server Lookup with /sft_servers_all.json (#2030)
 * Extend GET /calls/config/v2 to include all SFT servers in federation (#2012)
 * Improve Brig's configuration for SFTs and fix a call to SFT servers (#2014)
+* Enable downloading assets from a remote (federated) cargohold instance via the v4 API. The content of remote assets is returned as stream with content type `application/octet-stream`. Please refer to the Swagger API documentation for more details. (#2004)
 
 # [2021-12-10]